When will quantum computers threaten Bitcoin?
Most credible expert forecasts cluster in the 2030s to 2040s. The threshold is roughly 2,000-4,000 fault-tolerant logical qubits running Shor's algorithm. Current machines have hundreds to low thousands of noisy physical qubits — orders of magnitude short on quality, not just quantity.
The bottleneck is error correction, not raw qubit count. A logical qubit currently requires thousands of physical qubits to stabilize. Recent surface-code progress (Google, IBM, Quantinuum) has cut overhead materially, but the gap to a 2,000-logical-qubit Shor-capable machine is still many orders of magnitude.
Industry roadmaps published by major hardware vendors target the late 2020s for the first useful error-corrected machines, with cryptographically relevant scale extending into the 2030s. NIST has finalized post-quantum standards (ML-KEM, ML-DSA, SLH-DSA) precisely because the timeline is uncertain enough that migration cannot wait.
For Bitcoin specifically, the timeline that matters is whichever comes first: capability against secp256k1, or rollout of a PQ-signature soft-fork. Both are multi-year programs.
Related questions
Why do timeline estimates vary so much?
Because they depend on whether you measure physical qubits, logical qubits, or end-to-end Shor cost. Each abstraction layer hides exponential overhead. Optimists count physical-qubit growth; pessimists count error-correction breakeven; both can be right at different points in the stack.
Could a nation-state already have a secret machine?
Possible but unlikely at the required scale. The supply chain for cryogenic systems, dilution refrigerators, and superconducting fabrication is small and largely visible. A surprise breakthrough is possible; a hidden 2,000-logical-qubit facility is much harder to conceal than people assume.