The Q-Day threat is the point at which a quantum computer can derive a private key from its public key, breaking RSA and the elliptic-curve signatures blockchains use. As of October 2026, NIST says no such machine exists. Experts surveyed for the Global Risk Institute's report published in March 2026 put one, on average, at 28–49% likely within 10 years.
Hash functions, AES encryption and proof-of-work mining are not where that risk sits. And the years that headlines attach to Q-Day (2029, 2033, 2035) come from four different kinds of source, only some of which predict when the machine will exist. For what Q-Day is and the published estimates of the machine it needs, see What Is Q-Day?.
What the Experts Forecast
Since 2019, the Global Risk Institute and evolutionQ have surveyed quantum computing researchers every year, keeping the key question unchanged: how likely is it that a quantum computer able to factor a 2048-bit RSA number in under 24 hours will be built within 5, 10, 15, 20 and 30 years? The 2025 edition collected answers from 26 experts during 2025 and was published on March 9, 2026. evolutionQ, which runs the survey, sells quantum-safe security products, as the report discloses.
Respondents pick one of seven likelihood bands instead of a single number. The middle band, "neither likely nor unlikely," covers anything from 30% to 70%. The report therefore gives two averages: one that reads every answer at the bottom of its band and one that reads it at the top. That is where "28–49% within 10 years" comes from. For 15 years, the range is 51–70%.
Read at the top of each band, the 10-year figure went from 27% in the 2022 survey to 31%, then 34%, then about 49% in 2025. The 5-year figure went from 6% to about 15%. Read at the bottom, the 10-year average rose from about 19% to about 28% between the 2024 and 2025 surveys. The figures come from the 2023 and 2024 executive summaries and the 2025 report.
The 15-point rise in 2025 is the largest change across those four surveys, though the authors warn that year-to-year comparisons are affected by changes in the size and makeup of the expert pool. The experts are also far from agreed. Half of them (13 of 26) still put the 10-year chance below 30%; the other half put it at about 50% or higher. Read at the top of each band, 49% is the highest 10-year figure in any of the surveys so far. The 2019–2021 surveys did give higher odds for the same calendar window, the mid-2030s, and the authors caution against reading the lower numbers that followed as a slowdown in the field.
Michele Mosca, who co-authors the report, put a number on it before the surveys began. In 2015 he estimated "a 1/2 chance of breaking RSA-2048 by 2031."
Four Kinds of Q-Day Year
| Year | What it is | Source |
|---|---|---|
| 2029 | Its own migration target | |
| 2029 | Fault-tolerant machine target | IBM, Quantinuum |
| 2030–2042 | Modeled range, 2033 baseline | Project Eleven |
| 28–49% in 10 years | Expert survey average | Global Risk Institute |
| 2030, 2035 | RSA and ECC deprecated, then disallowed | NIST |
Google's 2029 is the deadline it set for its own post-quantum migration. NIST will deprecate quantum-vulnerable public-key algorithms after 2030 and disallow them under its standards after 2035. These dates say when systems should be ready. The full list of government deadlines is in our Q-Day explainer.
IBM and Quantinuum's dates are hardware targets. IBM plans to deliver Starling by 2029, "capable of running quantum circuits comprising 100 million quantum gates on 200 logical qubits." Quantinuum plans to deliver Apollo, a "universal, fully fault-tolerant quantum computer," by 2029. Google's leaner circuit for breaking 256-bit elliptic-curve keys uses under 1,200 logical qubits, so by our arithmetic Starling's target is about one sixth of that. The gate counts do not compare directly: IBM's figure is quantum gates in general, while Google's counts Toffoli gates, which dominate the cost of fault-tolerant circuits.
Project Eleven, which sells post-quantum custody for digital assets, published a model in May 2026 that places Q-Day at a 2033 baseline, with optimistic and pessimistic scenarios at 2030 and 2042. Of all the dates here, only that model and the survey try to say when a cryptographically relevant machine will exist. When a headline gives a year, ask which kind it is.
Why the Survey May Understate the Risk to Blockchains
The survey asks about RSA-2048. The report does not ask about the 256-bit elliptic curves that most blockchains rely on, and its responses were collected in 2025, before two March 2026 papers cut the estimates for those curves.
Under the same hardware assumptions, those estimates are lower than for RSA. Google Quantum AI estimates that a superconducting machine with fewer than 500,000 physical qubits could break a 256-bit elliptic-curve key in a few minutes, under standard hardware assumptions. For RSA-2048, Craig Gidney's 2025 estimate is under a million qubits and under a week. A preprint by Caltech and Oratomic researchers, all shareholders of Oratomic, which is building fault-tolerant quantum computers, puts Shor's algorithm at cryptographic scale on as few as 10,000 neutral-atom qubits. Its fastest design needs about 10 days for a 256-bit elliptic-curve key with 26,000 qubits, and 97 days for RSA-2048 with about 102,000. Experiments have already trapped arrays of more than 6,000 coherent neutral-atom qubits, though the authors write that "substantial engineering challenges remain."
We think this means the survey, if anything, understates how close the threat is for chains, since it asks about the harder of the two targets. The report itself makes no claim about elliptic curves.
What a Quantum Computer Would Break
A cryptographically relevant quantum computer (CRQC) runs Shor's algorithm to derive the private key from a public key. That is enough to forge any RSA or elliptic-curve signature whose public key it can see. Google writes that most blockchains rely on 256-bit elliptic-curve cryptography "for critical aspects of their security," and its March 2026 paper shows the exposure goes beyond wallet signatures:
| Component | Where it's used | What a CRQC does |
|---|---|---|
| Account signatures (secp256k1) | Bitcoin, Ethereum | Signs as the owner |
| BLS validator signatures | Ethereum consensus | Signs as the validator |
| ECDH key exchange | Zcash, Monero, Mimblewimble | Recovers shared secrets |
| Pedersen, KZG, Bulletproofs | Mimblewimble, Ethereum data availability, Monero | Recovers setup secrets once |
The last row gets the least attention. These schemes rely on secrets behind fixed public parameters, which nobody is supposed to know. A quantum computer would have to recover those secrets only once, and then, in the paper's words, "the resulting secrets can be reused to launch multiple attacks later using classical computers." For Pedersen commitments, which hide transaction amounts, the paper says an attacker could create new coins.
The ECDH row is the one about confidentiality. An eavesdropper who stores traffic today could recover the shared secrets once a CRQC exists, the pattern known as harvest now, decrypt later.
What It Would Not Break
NIST's October 2026 transition report says its symmetric standards, including hash functions and block ciphers such as AES, are "significantly less vulnerable to known quantum attacks" than its public-key standards. NIST believes every approved symmetric algorithm with at least 128 bits of security meets category 1 of its post-quantum security categories. The 112-bit ones will be disallowed in 2030.
Several guides that rank for Q-Day advise more. Fortinet's says "Transitioning from AES-128 to AES-256 provides sufficient protection," and Aliro's says that after Q-Day "the AES-128 security level is just 64." NIST's own FAQ explains why it does not require the switch. Grover's algorithm, the quantum shortcut for brute-force key search, delivers its full speedup only if every step runs in series, and real attacks run in parallel. "AES 128 will remain secure for decades to come," NIST writes, and applications "can continue to use AES with key sizes 128, 192, or 256 bits." Both key sizes stay on its list.
Proof-of-work mining is outside the threat too. Google's paper says quantum attacks on mining are "not something to worry about in the next several decades." Error correction eats most of Grover's speedup, and mining is won with massively parallel hardware, which Grover cannot exploit well. The risk the authors do see is indirect: if quantum attacks on transactions crashed a coin's value, mining could become unprofitable faster than the network adjusts its difficulty.
Hashes also protect public keys that have not been revealed. Where a chain records only the hash of a public key, a CRQC "cannot derive a public key from its hash value." That protection ends when the owner spends, because the transaction reveals the public key.
This answers a common question: how long would a quantum computer take to crack 256-bit encryption? It depends which 256 bits. An AES-256 key is a symmetric key that NIST expects to stay safe. A 256-bit elliptic-curve key is the kind that secures crypto wallets, and for that, Google's estimate is a few minutes on a large enough machine. Fortinet's guide says a quantum computer "could solve these problems in seconds"; the published estimates above run from minutes for elliptic curves to days or months for RSA-2048, depending on the hardware.
Mosca's Inequality on a Blockchain
The survey report opens with a rule Mosca proposed. Add how long data must stay secure (its shelf life) to how long the upgrade will take (migration time). If that sum is longer than the time until a CRQC arrives, organizations "may fail to shield their assets from quantum-enabled breaches."
On a public chain, the terms change shape, and here we are reasoning beyond the report. Little on chain is secret, so shelf life is better read as how long a key must stay unforgeable. For an address whose public key is already visible, that is as long as funds sit there, which is why Google's paper treats "dormant wallets with reused keys" as targets for at-rest attacks. Migration time includes getting a decentralized network to agree on the upgrade. With the experts' 10-year range at 28–49%, a chain that needs five years to migrate is planning against odds that GRI calls "quite possible."
Where QDay Network Stands
QDay Network signs transactions with classical ECDSA today, like the chains above. Its signatures follow a migration path: hybrid ECDSA + ML-DSA-65 in progress on Aevum Testnet, then native post-quantum signing on the 2027 roadmap.