Q-Day is the day a quantum computer becomes able to break the public-key cryptography in wide use today, RSA and elliptic-curve cryptography, by running Shor's algorithm. As of October 2026, NIST says no quantum computer capable of this exists, and Google says that "no one knows precisely when it will arrive" (Google, February 2026).
For a blockchain, the part that breaks is the signature. A forged signature lets someone spend coins they do not own, which is why chains worry about Q-Day even though everything on them is already public. And many of the years attached to Q-Day in headlines (2029, 2030, 2035) are migration deadlines set by Google, the US government and NIST for finishing the move to new cryptography. They say nothing about when the machine will exist.
Which Cryptography Breaks
Public-key cryptography uses a pair of keys. The public key can be shared with anyone; the private key stays secret and proves that you are you. RSA and elliptic-curve cryptography (ECC) are the two families in wide use, and they protect everything from HTTPS connections to crypto wallets. Google notes that most blockchains "currently rely on ECDLP-256 for critical aspects of their security" (Google Research, March 2026). ECDLP-256 is the math problem behind 256-bit elliptic-curve keys.
Both families rest on problems that ordinary computers cannot solve in any useful time: factoring very large numbers (RSA) and computing discrete logarithms (ECC). In 1994, Peter Shor gave efficient quantum algorithms for both. The algorithm has existed for three decades. What is missing is a machine large and reliable enough to run it against real key sizes.
Researchers call that machine a cryptographically relevant quantum computer, or CRQC. Google's researchers write that large-scale CRQCs "will also be able to break current, widely used public-key cryptography." Q-Day is the day the first one works.
Some cryptography survives it far better. NIST's final transition report, IR 8547, published October 27, 2026, says its symmetric standards, including block ciphers such as AES and the SHA hash functions, "are significantly less vulnerable to known quantum attacks than the public-key cryptography standards."
Encryption and Signatures Break Differently
Public-key cryptography does two jobs. It sets up encrypted connections, and it signs things to prove who sent them. A CRQC threatens both, on different clocks.
Google drew the line in its March 2026 post: "The threat to encryption is relevant today with store-now-decrypt-later attacks, while digital signatures are a future threat that require the transition to PQC prior to a Cryptographically Relevant Quantum Computer (CRQC)." Encrypted traffic recorded today can be read once a CRQC exists, so that data is exposed already. The pattern is better known as harvest now, decrypt later.
Signatures run on the other clock. Forging one needs a working CRQC at the moment of the attack, so nothing can be forged before Q-Day. The replacement still has to be in place before then, because any key whose public key is exposed on that day can be taken over.
Blockchains sit on the signature side. A public chain has little to decrypt: balances and transactions are visible to everyone. What a CRQC could do is derive a wallet's private key from its public key and sign transactions as the owner.
A March 2026 paper by Google Quantum AI researchers and co-authors (arXiv 2603.28846) separates two ways that could happen:
- On-spend attacks target a transaction in transit. Once a user broadcasts a transaction, the attacker has to derive the private key before it is recorded on the chain: about 400 milliseconds on Solana, about 12 seconds on Ethereum, and about 10 minutes on average on Bitcoin.
- At-rest attacks target public keys that stay exposed for a long time, "such as dormant wallets with reused keys." The attacker has days or more.
By the paper's estimate, a superconducting machine that has done half the work in advance could derive the private key roughly 9 to 12 minutes after the public key appears, close to Bitcoin's 10-minute average block time. The authors expect fast hardware like this to be capable of both kinds of attack, and slower designs (neutral atoms, ion traps) only of attacks on keys at rest, at least at first.
Google's practical advice for holders is to avoid "exposing or reusing vulnerable wallet addresses."
How Close Is Q-Day?
Two numbers answer this: how large a machine the best published attack needs, and how large today's machines are. Here are four published estimates, two for RSA and two for elliptic curves.
| Year | Breaks | Estimated machine |
|---|---|---|
| 2019 | RSA-2048 | 20 million noisy qubits, 8 hours |
| 2023 | 256-bit elliptic curve | About 9 million physical qubits |
| 2025 | RSA-2048 | Under 1 million noisy qubits, under a week |
| 2026 | 256-bit elliptic curve | Under 500,000 physical qubits, minutes |
Craig Gidney and Martin Ekerå published the 2019 RSA estimate. Gidney alone published the 2025 one, keeping the 2019 hardware assumptions, including a 0.1% gate error rate and a 1-microsecond error-correction cycle.
The 2023 row is the 2026 paper's estimate for an approach Daniel Litinski published in 2023, on a photonic machine. For 2026, Google assumes superconducting hardware with a 0.1% physical error rate and calls the result "an approximately 20-fold reduction in the number of physical qubits required to solve ECDLP-256." Compare RSA with RSA and curves with curves: the two pairs measure different problems.
Now the hardware. Google's Willow chip, announced in December 2024, has 105 qubits. By our arithmetic, the 2026 estimate needs up to about 4,800 times as many physical qubits (500,000 divided by 105). Qubit count is also only one of the gaps: the estimates assume error rates and control speeds holding across hundreds of thousands of qubits at once.
Two caveats come from the 2026 paper itself. The authors did not publish the attack circuits; they released a zero-knowledge proof that lets others check the estimate without seeing them. And they write that the estimates "could be reduced substantially by making more aggressive assumptions about hardware capabilities." In both pairs of rows the requirement has only gone down.
Is Q-Day Real? Forecasts and Deadlines
The machine does not exist yet. The deadlines for being ready for it do, and they are the years many headlines carry:
- Google, 2029. Google set 2029 as the timeline for its own post-quantum migration, citing "progress on quantum computing hardware development, quantum error correction, and quantum factoring resource estimates." The post does not say a CRQC will exist in 2029.
- US federal systems, 2030 and 2031. Executive Order 14412 and OMB Memorandum M-26-15 require high-value assets and high-impact systems to adopt post-quantum cryptography for key establishment by December 31, 2030, and for digital signatures by December 31, 2031 (NIST summary).
- NIST, 2030 and 2035. NIST will deprecate quantum-vulnerable public-key algorithms, RSA and ECDSA among them, after 2030, and disallow them under its standards after 2035.
- United Kingdom, 2035. The NCSC set 2035 as its target for completing migration.
The deadlines come early because migration is slow. NIST's report puts it plainly: "Past cryptographic migrations have taken over a decade, and this more complex migration will likely take at least that long."
So Q-Day is real in the sense that matters for planning: the algorithm is known, the published estimates keep falling, and the standards bodies have set dates to finish moving. What nobody knows, Google included, is the year the machine arrives. Our recommendation: when a headline attaches a year to Q-Day, check whose deadline it is before reading it as a prediction.
Q-Day and QDay Network
QDay Network is a post-quantum, EVM-compatible blockchain built for agent payments: AI agents paying per request in stablecoins, within limits their owners set. The name is shared; the network and the event are different things. An agent's wallet signs every payment it makes, so the signature question applies to each one. QDay's signatures follow a migration path: classical ECDSA today, hybrid ECDSA + ML-DSA-65 in progress on Aevum Testnet, and native post-quantum signing on the 2027 roadmap. ML-DSA is the lattice-based signature algorithm NIST published as FIPS 204 in August 2024, its primary standard for digital signatures.