In March 2026, researchers at Google Quantum AI published a paper cutting the estimated cost of breaking Bitcoin's signature scheme by roughly twenty times. Headlines turned one line of it into a number: nine minutes.
That number is real. It is also the most misread figure in crypto this year. Here is what a quantum computer would actually break, what the nine minutes assumes, and what any of it means if your coins sit on an Indonesian exchange.
What is actually at risk
Bitcoin uses two different kinds of cryptography, and only one of them is in danger.
Mining is fine. Proof of work relies on SHA-256, a hash function. A quantum computer running Grover's algorithm would get roughly a square-root speed-up against it, which mining difficulty absorbs without drama. Nobody serious is worried about this.
Signatures are the problem. Bitcoin proves ownership with ECDSA and Schnorr signatures over the secp256k1 curve. Shor's algorithm breaks that class of maths outright. Given a public key and a large enough quantum computer, the private key can be derived.
So the question is not whether Bitcoin gets hacked. It is whether your public key is visible, and for how long.
The number everyone quotes
The Google paper, whose authors include Ryan Babbush and Hartmut Neven from Google Quantum AI alongside Dan Boneh of Stanford and Justin Drake of the Ethereum Foundation, found the attack could need fewer than 500,000 physical qubits. The prior benchmark, a 2023 paper by Litinski, put it near nine million.
Nothing was built to achieve that. The arithmetic for how to run the attack got better.
The nine-minute figure describes the compute time for an on-spend attack once such a machine exists and has completed roughly half its work in advance. It assumes microsecond gate times, perfect error correction, and fault-tolerant execution at a scale nobody has demonstrated. Safeheron's technical review of the paper put it plainly: the figure is an order-of-magnitude reference, not a statement about what anyone can do.
The largest superconducting processors in operation today are in the low thousands of physical qubits, and none run error-corrected circuits continuously for the hours this attack would require.
How much bitcoin is exposed
Estimates cluster between 6.5 and 7 million BTC, roughly a third of circulating supply. The figure most widely cited now is 6.9 million.
Two categories account for it.
Pay-to-public-key addresses. About 1.7 million BTC sit in the earliest address format, which wrote the public key directly onto the chain. This includes the roughly one million coins attributed to Satoshi Nakamoto. These keys have been visible since 2009 and cannot be hidden again.
Reused addresses. Modern formats hide the public key behind a hash until you spend. Spend once and the key is published forever. Every address that has sent a transaction and still holds a balance is in this category.
Estimates differ because researchers draw the boundary differently, particularly around dormant coins and Taproot outputs. Treat the range as the honest answer and be suspicious of anyone quoting one figure to three decimal places.
The fix exists. Fitting it into a block is the hard part.
This is the part that gets lost in the Q-Day arguments. Post-quantum signature schemes are not hypothetical. NIST finalised them as FIPS 204 and FIPS 205 two years ago, and they work.
They are also enormous. A Schnorr signature is 64 bytes. ML-DSA-44 is 2,420 bytes. SLH-DSA-128s, the conservative hash-based option, is 7,856 bytes, roughly 123 times larger.
A Bitcoin block holds about four million weight units. Migrating millions of coins to signatures that size is not a weekend soft fork. It is a multi-year block space problem, and it is the strongest argument for starting early rather than waiting for proof that the threat has arrived.
Two proposals, two philosophies
Bitcoin has no agreed plan, and the disagreement is not really technical.
BIP-360 proposes Pay-to-Merkle-Root, a new output type that removes the quantum-vulnerable key path spend so public keys are never permanently exposed. It is authored by Hunter Beast, Ethan Heilman and Isabel Foxen Duke, and remains in draft. It protects coins going forward. It does nothing for coins already exposed.
BIP-361 goes further. Authored by Jameson Lopp and five others, also in draft, it sets a sunset for legacy signatures in two phases: about three years after activation, sending funds to quantum-vulnerable addresses becomes invalid; two years after that, spending with ECDSA and Schnorr is restricted. Coins nobody migrates become unspendable.
That second proposal is where the fight is. It would freeze Satoshi's coins, and anyone else's, whether the owner is dead, indifferent, or simply not paying attention. Critics have called it confiscatory. Supporters argue that leaving several hundred billion dollars of exposed coins on the table is an invitation to whoever builds the machine first.
Jameson Lopp has argued for burning rather than confiscating, describing a future quantum attacker as a vampire feeding on the system. Tether's Paolo Ardoino has taken the opposite position, that letting old coins re-enter circulation is preferable to changing consensus rules.
Both sides are arguing about property rights, not physics.
Governments are already on a clock
While Bitcoin debates, the institutions it now trades alongside have deadlines.
A US executive order signed on 22 June 2026 requires federal agencies to adopt post-quantum key establishment for high-value systems by the end of 2030, and quantum-resistant digital signatures by the end of 2031. Contractors follow.
Banks and payment networks work to those timelines. Any regulated financial institution touching digital assets will be asked how its custody stack migrates, and the answer will need to be more specific than "we are monitoring the situation".
The honest counterweight
Three things argue against treating this as urgent.
No machine is close. The gap between 500,000 error-corrected qubits and today's hardware is not one of degree. Fault-tolerant architecture, error-correction scaling and real-time decoding are unsolved engineering problems, not funding problems.
The estimate could move again, in either direction. It fell twentyfold in three years because researchers found better circuits. Hardware constraints could just as easily push practical requirements back up.
The migration itself carries risk. A rushed soft fork that freezes coins incorrectly, or a new address type with a flaw, would do more damage sooner than any quantum computer currently can.
What this means if you hold in Indonesia
Here is the part almost no coverage addresses, and it is the part that matters here.
Nearly all of Indonesia's 22.93 million registered crypto accounts hold through exchanges licensed by OJK, not through self-custody. If you are one of them, you cannot migrate your own coins to a quantum-resistant address, because the keys are not yours to move. Your exchange holds them.
That makes this a custody question, not a wallet question. The useful thing an Indonesian holder can do is not to read another Q-Day thread. It is to ask their exchange three things: whether cold storage uses addresses that have been reused, whether the custody provider has a published post-quantum migration plan, and what happens to customer coins if Bitcoin adopts something like BIP-361 and a deadline starts running.
Most exchanges anywhere cannot answer those questions today. The ones that can are the ones worth using.
If you do hold your own keys, the free precaution is unchanged and worth repeating: use a fresh address for every receipt, and do not leave a balance sitting on an address you have already spent from.
Web3 Week Asia: where the custody question gets asked
Web3 Week Asia takes place on 11-12 November 2026 in Jakarta, Indonesia. It is a two-day blockchain event that puts OJK, the exchanges licensed under POJK 27/2024, custodians and builders in the same building.
The 2025 edition drew more than 5,000 participants, over 100 speakers and more than 200 companies.
Quantum risk is exactly the kind of question that is impossible to resolve on a panel and easy to resolve in a corridor. If you want to know whether the platform holding your coins has a migration plan, an Indonesia crypto event where its executives are standing in front of you is a better venue than a support ticket.
Frequently asked questions
Can quantum computers hack Bitcoin today?
No. The attack targets Bitcoin's signature scheme, not its mining. It would need roughly 500,000 error-corrected physical qubits running fault-tolerant circuits. The largest machines in operation are in the low thousands of physical qubits and cannot sustain the circuits required.
How much bitcoin is vulnerable to quantum attack?
Estimates range from 6.5 to 7 million BTC, around a third of supply, with 6.9 million the most commonly cited figure. About 1.7 million sit in early pay-to-public-key addresses, including coins attributed to Satoshi Nakamoto. The rest are addresses whose public keys were exposed by spending.
When and where is Web3 Week Asia 2026?
Web3 Week Asia takes place on 11-12 November 2026 in Jakarta, Indonesia. It is a two-day crypto and blockchain event covering markets, regulation, infrastructure and venture investment across Southeast Asia.
Sources
The BIP-360 specification, its Pay-to-Merkle-Root design and current draft status: https://bip360.org/bip360.html
What actually drove bitcoin back above US$85,000, our earlier analysis: https://www.w3w.asia/articles/bitcoin-85000-rally-september-2026
The Google Quantum AI resource estimate is from the March 2026 paper as reported by Forbes and The Quantum Insider. The technical critique of the nine-minute figure is from Safeheron. Vulnerable supply figures are from CoinDesk's reporting of February and April 2026 and subsequent coverage. BIP-361's phase structure and authorship are from the specification at bips.dev. Signature sizes are from NIST FIPS 204 and FIPS 205. The executive order deadlines are from Cybersecurity Dive and Skadden. Indonesian account figures are from OJK as reported by CNBC Indonesia and Kompas. The framing question was posed by Bloomberg in July 2026; this article updates it with what has happened since.
Methodology: the qubit estimates compare a superconducting architecture against a photonic one, so the twentyfold figure is the reduction reported by the researchers rather than a like-for-like measurement, and the charts say so. Vulnerable supply is given as a range because published estimates differ on how dormant and Taproot coins are counted. Signature sizes are the standard parameter sets; multipliers are calculated from them. Nothing in this article should be read as a prediction of when a cryptographically relevant quantum computer will exist, because no reliable basis for such a prediction currently exists.
This article is for information only and is not investment advice.
