Quantum Bitcoin Break Estimated at 62 Minutes

Bitcoin cryptography on the secp256k1 curve was estimated at 62 minutes for a quantum computer with 29,600 physical qubits. This is the calculation of researchers from the French startup Alice & Bob and their co-authors.

This refers to a scenario in which a quantum machine can recover private keys from known public ones. But the authors themselves describe this as an upper bound for the model, not a ready-made real-world Bitcoin break. The IACR 2026/2665 preprint was published on October 28, 2026.

Why does this estimate not mean an immediate threat?

Because the calculation relies on very strict assumptions. The model includes a 1 μs error-correction cycle, a 10 μs reaction time, a phase error pZ = 5×10⁻⁴, and no bit-flip errors.

The authors themselves write that this is close to a 100-year bit-flip time. If bit-flips occur roughly once an hour, then RSA-2048 already requires about 45,000 qubits. For Bitcoin, this matters because the issue is not one token, but the underlying signature scheme the network has used for years. This is also a good place to mention our piece on Solana’s faster finalization, because technical changes in blockchains often look minor until they run into security limits.

There is another nuance. The main target of the work, if you look at the full calculation, is not Bitcoin but RSA-2048. For it, the authors cite 22,593 physical cat qubits and 3.14 days. The estimate for secp256k1, which Bitcoin uses, partially transfers these same calculations. In other words, this is not a separate end-to-end break of the coin, but rather an upper estimate of the capabilities of a specific architecture.

What exactly did the authors show?

The paper discusses a superconducting cat qubit architecture. It lowers the physical resource requirements compared with some other approaches. Against this backdrop, the estimate for cryptocurrency ECC cryptography looks lower than previous calculations.

For comparison, in March 2026 one research team estimated similar attacks on cryptocurrency ECC cryptography at fewer than 500,000 physical qubits and execution in minutes. The new work reduces the qubit requirement by about 17 times. But that does not mean the danger is 17 times closer. The architecture and the error assumptions have changed as well.

"The estimate for secp256k1 reuses operations from the RSA-2048 model. This is an upper bound, not a separate practical attack scenario against Bitcoin," the IACR preprint description says.

In other words, the 62-minute figure sounds dramatic, but it should be read carefully. It is a laboratory calculation. Not a checklist for breaking the network tomorrow.

• 29,600 physical qubits in the model for secp256k1.

• 62 minutes to carry out the attack in the authors’ calculation.

• 22,593 physical qubits and 3.14 days for RSA-2048.

• A 1 μs error-correction cycle in the model assumptions.

• pZ = 5×10⁻⁴, with no bit-flip errors.

• Preprint publication: October 28, 2026.

What does this mean for investors?

For Bitcoin holders, the main takeaway is simple: the risk has not disappeared, but there is no reason to panic yet. Quantum security is no longer just a conference theory. In May 2026, one analytics platform estimated that 6.04 million BTC, or 30.2% of the issued supply, had exposed on-chain public keys. Later, another media outlet reported 31.2% and an additional 222,000 BTC of exposure added since May.

This matters because a visible public key is what theoretically makes assets more vulnerable to a quantum scenario. But there is still a long distance between theory and practice. In real hardware, Alice & Bob reported only three demonstrators on October 20, 2026: two 6-qubit chips and one 12-qubit chip. That is very far from 29,600 qubits.

For the market, this means one thing: the topic of quantum migration is becoming more concrete. Bitcoin already has draft BIP-360 and BIP-361 proposals related to post-quantum migration and the retirement of old signatures. But the BIP repository itself says that Draft status does not mean consensus or future implementation. So investors should watch not for flashy headlines, but for whether real rules for migrating addresses and signatures emerge.

There is also a practical takeaway for Ukrainian users. If you hold BTC long term, it is better not to ignore the issue of addresses and key reuse. And when you need to quickly cash out coins into hryvnia, it is convenient to have an option ready to sell Bitcoin to Monobank.

Frequently asked questions

Does this work mean Bitcoin can be broken in 62 minutes?

No. This is a calculation for a specific quantum architecture with very strong assumptions about errors. The authors themselves present it as an upper bound, not as a ready attack scenario against the Bitcoin network.

How much Bitcoin already has exposed public keys?

According to one analytics platform as of May 20, 2026, this is 6.04 million BTC, or 30.2% of the issued supply. An update cited by another media outlet on October 8, 2026, raised the share to 31.2%.

Does Bitcoin have a plan to move to post-quantum protection?

Yes, but for now these are only drafts. The BIP repository mentions BIP-360 and BIP-361, both with Draft status. That means there is discussion, but no final network decision yet.

The topic of quantum security for Bitcoin no longer looks abstract. But this preprint shows something else: there are years of engineering work between a laboratory estimate and a real risk. And that is what the market should be watching now.

This material is not financial advice. Cryptocurrency trading involves significant risks. Part of this text was prepared with the help of artificial intelligence based on public sources and reviewed by our editorial team.