The Clock Just Got Louder: Why Q-Day Is Now a Balance-Sheet Problem
By Jay Dembani, Founder at FinSaAIstra
Most custodians holding institutional Bitcoin and Ethereum have pencilled quantum risk in for somewhere around 2030, safely behind more pressing priorities on the roadmap. A specific date landed this month that makes that timeline look optimistic.
In September 2026, IonQ's chief executive Niccolo de Masi put a specific date on the moment quantum computers become capable of breaking the encryption that protects Bitcoin and most of the internet: 2028. The claim has a paper behind it.
On September 3, IonQ published a 70-page resource estimate titled "Computing 256-bit elliptic curve discrete logarithms in 26 days on a fault-tolerant trapped-ion quantum computer with 20,000 qubits." The paper's own figure is 19,397 physical qubits and 25.7 days per attempt, specific to the secp256k1 curve that secures every Bitcoin and Ethereum wallet. No machine at that scale exists yet; this is a blueprint, not a demonstrated attack. IonQ is targeting 256-qubit systems by 2027 and 10,000 physical qubits by 2028. Google moved first, and publicly: in a March 2026 blog post authored by two of its own security engineers, it committed its entire infrastructure, Chrome, Android, Cloud, Gmail, and certificate signing included, to a 2029 post-quantum migration deadline.
IonQ has attached a company name, a hardware roadmap, and a shipping date to a number that, until recently, lived only in academic papers.
Four papers, twelve months, one steep curve
The calendar date is almost beside the point. What matters is the hardware trend behind it, and that trend has moved faster than most people modelling this risk expected.
In 2019, breaking RSA-2048, the encryption underneath most banking, email, and web traffic, was estimated to need roughly 20 million physical qubits. In 2025, Google Quantum AI's Craig Gidney cut that estimate to under a million, purely through better algorithms and error-correction architecture, with no new hardware required. In February 2026, a Sydney startup called Iceberg Quantum published an architecture that could bring the number below 100,000. And in March 2026, a Google Quantum AI paper co-authored with researchers from the Ethereum Foundation and Stanford went further: elliptic-curve cryptography, the scheme protecting Bitcoin, Ethereum, and effectively every major blockchain, could be broken with under 500,000 qubits, in minutes rather than days. Under the paper's own modelling, a "primed" quantum computer would have roughly a 41 percent chance of deriving a private key before a single Bitcoin block confirms.
Four estimates, four steep drops, inside about a year. Any one of these papers on its own is easy to file under academic curiosity. It's the sequence that matters: the curve is bending faster than the people modelling this risk expected, and a risk committee is supposed to price that in before the event lands, not scramble once it has.
Why blockchain is exposed in a way most systems are not
A bank can rotate its cryptography behind closed doors, on whatever schedule its risk committee sets, without asking anyone's permission. Bitcoin and Ethereum don't work that way. Moving either to post-quantum signatures means getting consensus across thousands of independent nodes, miners, validators, and wallet providers, none of whom answer to a single risk committee.
That coordination problem runs into a specific technical fact: a Bitcoin or Ethereum address that has ever sent a transaction has its public key permanently visible on-chain. By the Citi Institute's own January 2026 estimate, roughly a quarter of all Bitcoin in circulation and more than 65 percent of Ethereum's supply sits in addresses of exactly this kind: already exposed, waiting only for the hardware to catch up.
Custodians and institutional asset managers holding these assets on behalf of clients are, in effect, carrying a disclosure obligation they have not yet been asked to price.
The rest of the balance sheet is exposed too
The same cryptography protecting Bitcoin, RSA and elliptic-curve schemes secures the transaction records, authentication systems, and regulatory filings behind every bank and payment network too. Traditional finance doesn't get to watch this one from the sidelines. The Citi Institute's modeling of a single quantum attack on one of the five largest US financial institutions, targeting its Fedwire access specifically, puts the indirect economic impact at $2 to $3.3 trillion in GDP-at-risk: a 10 to 17 percent decline in annual US GDP.
The most urgent part of that exposure has already happened. Harvest-Now, Decrypt-Later attacks work by intercepting and archiving encrypted data today, then decrypting it once a capable quantum computer exists, and they don't wait around for Q-Day. Whatever data an adversary judges worth the wait is being harvested right now. For any institution holding customer records, transaction histories, or regulatory filings that need to stay confidential for a decade or more, that exposure window opened years ago.
Where the deadlines stand, and what they don't solve
The policy side of this has stopped being vague. NIST's IR 8547 timeline calls for quantum-vulnerable algorithms to be deprecated after 2030 and disallowed after 2035.
On June 22, 2026, the White House signed Executive Order 14412, "Securing the Nation Against Advanced Cryptographic Attacks," setting 2030 and 2031 deadlines for federal systems and covered contractors to adopt quantum resistant cryptography. EU member states are due to publish national post-quantum transition strategies by the end of this year.
That regulatory architecture doesn't do the migration work itself. Someone still has to map where RSA and elliptic-curve cryptography sit across every application, vendor integration, and blockchain dependency an institution touches, then build the crypto-agility to swap those algorithms out without re-engineering everything around them. It's years of unglamorous inventory and architecture work, and most institutions, digital-asset custodians very much included, aren't moving at the pace the last twelve months of research now justify.
Q-Day is arriving in installments: a slow drip of published papers, each one nudging the deadline a little closer, until the institutions that pencilled in 2030 as a safe planning horizon look up and find it's already moved.
Sources:
Citi Institute, "Quantum Threat: The Trillion-Dollar Security Race Is On," January 2026 (Fedwire GDP-at-risk figure, Bitcoin/Ethereum exposure percentages, inherited from prior verification on FinSaAIstra; not re-verified in this pass)
The Quantum Insider, "Q-Day Just Got Closer: Three Papers in Three Months Are Rewriting the Quantum Threat Timeline," March 31, 2026 (secondary synthesis of the Gidney, Iceberg Quantum, and Google/Ethereum Foundation/Stanford papers; primary papers not independently checked)
IonQ, "Computing 256-bit elliptic curve discrete logarithms in 26 days on a fault-tolerant trapped-ion quantum computer with 20,000 qubits," September 3, 2026 (via postquantum.com reporting)
Crypto Briefing, "IonQ CEO predicts Q-Day will arrive in 2028, putting Bitcoin encryption in the crosshairs," September 10, 2026
Google Security Engineering (Heather Adkins, Sophie Schmieg), post-quantum migration announcement, March 25, 2026 (via SecureWorld reporting)
The White House, Fact Sheet: Executive Order 14412, "Securing the Nation Against Advanced Cryptographic Attacks," June 22, 2026
NIST IR 8547, "Transition to Post-Quantum Cryptography Standards" (initial public draft, November 2024)
