Cryptopolitan surveyed its newsletter readers on whether quantum computing could break Bitcoin by 2035. The question carries added urgency after an unreleased AI model discovered a flaw in a post-quantum signature scheme on July 28 — a vulnerability that two years of expert human review had overlooked. No quantum computer was involved in that discovery. This report examines Bitcoin's underlying cryptographic architecture, the specific threat quantum computing poses to BTC, and why the AI-driven cryptanalysis breakthrough introduces a new dimension to the quantum risk timeline.

Where Readers Stand

Combining respondents who answered "yes, they probably will" with the "before 2030" cohort, 47% of readers believe a quantum break of Bitcoin is plausible within the next nine years. The largest elliptic-curve key ever broken on actual quantum hardware remains 15 bits — achieved in April by a researcher claiming Project Eleven's Q-Day Prize. Bitcoin's keys, by contrast, are 256 bits. Bridging that gap within nine years would demand an extraordinary pace of engineering progress. Roughly one-third of the audience currently regards this as a genuine possibility.

What Is Actually at Risk for BTC

Bitcoin does not encrypt data. Every transaction on the network has been publicly visible since its inception. What Bitcoin does is sign and hash — two distinct mathematical operations with very different quantum threat profiles.

The signing mechanism is the exposed component. When spending Bitcoin, a wallet generates a signature proving ownership using elliptic curve cryptography known as secp256k1. Bitcoin has employed two signing methods: ECDSA since launch and Schnorr since 2021. Both rely on the same foundational assumption — that deriving a private key from a public key is computationally infeasible.

Shor's algorithm directly challenges that assumption. With a sufficiently large quantum computer, it can reverse-engineer a private key from its corresponding public key. In March, Google researchers published estimates putting the requirement at fewer than 1,200 logical qubits and under 500,000 physical qubits. A subsequent paper from Caltech and Oratomic reduced that figure to approximately 10,000 qubits using a neutral-atom architecture. No machine approaching these specifications has been built. IBM's most advanced publicly disclosed quantum processor, Condor, operates at roughly 1,121 physical qubits — none error-corrected — and the overhead required to convert noisy physical qubits into stable logical qubits remains a substantial engineering barrier. However, those estimates previously ran into the millions, and the downward trajectory explains why Bitcoin developers no longer treat this as a distant 2040s concern.

The hashing side is considerably more resilient. Bitcoin uses SHA-256 for mining, address generation, and block linkage. The most effective known quantum attack, Grover's algorithm, provides only a quadratic speedup — reducing 256-bit security to approximately 128-bit, which remains far beyond any machine currently theorized. Mining and chain structure are not the vulnerable points.

The precise framing is therefore narrower than "quantum breaks Bitcoin." The coins genuinely at risk are those whose public keys are already visible on-chain. This occurs when an address has been spent from previously, or when funds reside in older address formats that expose keys by default. Current estimates place this exposure between 6.5 and 6.9 million BTC — roughly one-quarter to one-third of total supply — including approximately 1.7 million coins in early addresses widely attributed to Satoshi Nakamoto.

Coins held in modern addresses that have never been spent from do not expose a public key. For those, a quantum attacker would have only the brief window during which a transaction sits unconfirmed in the mempool. That remains a serious problem, but a significantly smaller one than headline figures suggest.

Bitcoin's Response to the Quantum Threat

On February 11, 2026, BIP-360 was merged into the official Bitcoin BIP repository — the network's first formal quantum-resistance proposal to reach that milestone. It introduces a new output type called Pay-to-Merkle-Root (P2MR), authored by Hunter Beast, Ethan Heilman, and Isabel Foxen Duke.

P2MR is essentially Taproot with the key-path spend removed. Taproot commits to both an internal public key and a Merkle root of scripts, meaning the key is always derivable from on-chain data. P2MR commits solely to the Merkle root. No public key appears until an actual spend occurs, and even then only the specific leaf used is revealed. This closes the long-exposure vulnerability.

A companion proposal, BIP-361, followed on April 14 with a three-phase plan to sunset ECDSA and Schnorr spends entirely. That proposal has drawn debate, as its third phase would effectively freeze coins that are never migrated.

Heilman's own estimate projects seven years from consensus formation to full quantum resilience — a timeline he characterizes as optimistic. The breakdown: two and a half years for review and testing, half a year for activation, then five additional years before roughly 90% of wallets, custodians, Lightning nodes, and treasury software have fully upgraded. Notably, BIP-360 does not include post-quantum signatures. Those were removed in July 2025 and deferred to a future proposal. The algorithms Bitcoin ultimately adopts will most likely be ML-DSA or SLH-DSA, both already finalized by NIST as FIPS 204 and FIPS 205 in August 2024, capping an eight-year standardization effort that drew submissions from cryptographers worldwide. The same elliptic-curve vulnerability that Bitcoin faces extends across virtually all digital infrastructure — from TLS connections securing internet traffic to SWIFT messaging between banks — which is why NIST's process carries implications well beyond any single cryptocurrency.

A Post-Quantum Scheme Failed — Without a Quantum Computer

On July 28, Anthropic's Frontier Red Team published findings from Claude Mythos Preview, a model not publicly available. Operating semi-autonomously in an agentic configuration, the model identified a previously unknown attack against HAWK — one of nine finalists in NIST's additional post-quantum signature competition and the sole lattice-based scheme to advance to round three in May.

The attack exploited a symmetry in HAWK's lattice structure that no reviewer had previously utilized. For the HAWK-256 parameter set, it reduced the estimated computational work for key recovery from approximately 2^64 operations to roughly 2^38 — the difference between "no adversary on Earth can attempt this" and "a well-funded team could plausibly try."

The details are unsettling. HAWK had already withstood two rounds of expert human review over two years. The AI model found the flaw in approximately 60 hours at a cost of roughly $100,000 in API spending. The researcher supervising the project held a theoretical computer science background but was not a lattice cryptography specialist.

Sophie Schmieg, a post-quantum cryptographer at Google, summarized the implications succinctly: "Basically with this paper, HAWK is dead." The HAWK team withdrew the scheme from NIST consideration the following day, noting that the obvious fixes — doubling parameters or moving to higher-rank modules — would render it uncompetitive against alternatives.

No quantum computer was involved at any stage. The technology that failed was post-quantum cryptography itself, broken by a classical AI model over a long weekend.

What the Poll Actually Revealed

Every poll option addressed the same underlying question: when will quantum hardware arrive. Readers divided reasonably on that question, and 47% placing the threat within nine years is a defensible interpretation given how rapidly qubit estimates have shifted this year.

However, the HAWK result suggests that hardware timelines may not be the binding constraint. The 33% who voted "not that soon" or "only after 2050" were placing a bet on quantum engineering — and they may well be correct. That wager does not, however, protect against a classical attack on whatever replacement algorithm is ultimately chosen.

The 20% who answered "no idea" merit acknowledgment. In an audience that follows these developments closely, one in five declining to predict is not apathy. It more likely reflects an accurate assessment of the compounding uncertainties: hardware progress, algorithm selection, consensus timelines, and now AI-assisted cryptanalysis advancing faster than the review processes designed to detect such weaknesses.