Alice & Bob, a quantum computing company, published a model that lowers the estimated hardware cost of breaking Bitcoin's cryptography to 29,588 physical qubits. CoinDesk reported the figure on October 29, 2026. It is roughly 17 times smaller than the sub-500,000-qubit estimate Google released in March 2026, and it sits far below earlier academic work that counted the requirement in the millions.
Bitcoin traded near $80,080 as of October 29, 2026, down about 0.5% on the day, and the price did not move on the paper. That is the correct reaction for now. The result is theoretical, and no machine close to the required scale exists. The reason it matters is the direction of travel: each revision of this estimate has made the attack cheaper, not harder.
A smaller qubit count than Google modeled
The work, led by Dahmun Goudarzi, a senior cryptanalyst at Alice & Bob who holds a PhD in cryptography, models a quantum machine running Shor's algorithm against the elliptic-curve signatures that guard Bitcoin addresses. The headline output is the qubit budget: 29,588 physical qubits, with an attack running about 62 minutes.
The arithmetic lines up with the comparison. At 29,588 qubits, 17 times that figure lands just under 500,000, which is where Google's March estimate sat. Two years ago the same question drew answers in the millions. The hardware target is not falling because physical qubits are getting easier to build. It is falling because cryptanalysts keep finding more efficient ways to run the same attack, which lowers the bar the hardware eventually has to clear.
Six million exposed coins carry the real risk
A Bitcoin address is only vulnerable once its public key is visible on-chain, and that happens the moment the address sends a transaction. CoinDesk puts the count of coins sitting at addresses with exposed public keys at more than 6 million. Those are the balances a working quantum attacker would target first, because the hard cryptographic step is already half-solved for them.
Addresses that have only ever received funds are in a different position. Their public keys stay hashed behind the address string and never appear in the clear, so a Shor's-algorithm attack has nothing to work with until the coins move. That distinction is the practical fault line in any quantum discussion: the exposure is tied to spending history, not to the size of a balance.
A 62-minute attack cannot touch a live payment
The 62-minute window is also the reason this is not an immediate threat to active transactions. Bitcoin's average block time is about 10 minutes, so a confirmed transaction is buried under several blocks long before an hour passes. An attacker could not intercept an unconfirmed payment and race it to the chain. The danger is to coins that sit exposed and unmoved for long stretches, where there is no clock running against the attacker.
That caveat is worth holding onto. The paper describes a capability, not an event. It assumes a fault-tolerant quantum computer that does not yet exist and may not for years. The useful information is the trend line, which gives planners a rough date to build around rather than an open-ended "someday."
Migration is the part that takes years
Goudarzi did not soften the conclusion. "Yes, it becomes of utmost importance that migration starts now," he said. "We know how hard and long this task can be." The researchers expect falling resource requirements and improving hardware to converge in the early 2030s, which sounds distant until you weigh it against how long a change to Bitcoin actually takes.
A post-quantum signature scheme would have to be designed, standardized, coded, tested, and then adopted across miners, nodes, exchanges, and hardware vendors such as Ledger. Coordinating that across a decentralized network with no central switch is measured in years, not quarters. The same keys protect the wallets that fund everyday crypto spending, so the migration reaches further than cold storage alone.
Holders are not powerless while that plays out. Anyone running their own self-custody setup can lower exposure today by avoiding address reuse and sweeping balances to a fresh address after spending, which keeps public keys hashed and out of sight. None of that defeats a mature quantum computer, but it narrows the attack surface during the window the researchers are warning about.
Overview
Alice & Bob's model drops the estimated cost of breaking a Bitcoin key to 29,588 qubits, 17 times below Google's March 2026 figure and far under older million-qubit estimates. The attack takes about 62 minutes, too slow to hit a live transaction but a direct concern for the 6 million-plus coins held at addresses with exposed public keys. The findings are theoretical and point to the early 2030s. The practical takeaway is timing: migrating Bitcoin to quantum-resistant cryptography is slow, and the people doing the math now say the work needs to start before the hardware catches up.
