Watch out Bitcoin devs. Google says post-quantum migration needs to happen by 2029.

The crypto industry’s reaction was that a quantum computing threat was still distant when Google unveiled its Willow quantum chip in December 2024.

Bitcoin uses SHA-256 for mining and ECDSA for signatures, both of which are theoretically vulnerable to quantum decryption, but the consensus was that the threat was decades away. Breaking encryption would require millions of physical qubits (a unit of information in quantum systems). Willow had just 105.

That story has marginally changed sixteen months later, and Google isn’t dismissing anything.

The company announced this week that it is setting a 2029 deadline to migrate its authentication services to post-quantum cryptography, citing progress in quantum hardware, error correction, and factoring resource estimates.

Google’s security engineering team wrote that quantum computers “will pose a significant threat to current cryptographic standards, and specifically to encryption and digital signatures,” and that the threat to digital signatures specifically “requires the transition to PQC prior to a cryptographically relevant quantum computer.”

These risks are not theoretical. The Android 17 mobile operating system is already integrating post-quantum digital signature protection. Chrome already supports post-quantum key exchange. Google Cloud offers post-quantum solutions to enterprise customers.

Here’s why it matters

Classical computers process information as bits, each one either a 0 or a 1, and solve problems by checking possibilities one at a time. Quantum computers use qubits that can exist as both 0 and 1 simultaneously, a property called superposition, which lets them explore vast numbers of possibilities in parallel.

For most everyday tasks, the advantage is negligible. But for specific problems like factoring the large prime numbers that underpin modern encryption, a sufficiently powerful quantum computer could solve in minutes what would take a classical machine longer than the age of the universe.

Bitcoin uses ECDSA (Elliptic Curve Digital Signature Algorithm) to sign transactions, which is exactly the category of cryptography Google flagged as requiring migration before a quantum computer capable of breaking it arrives.

A sufficiently powerful quantum computer running Shor’s algorithm could derive private keys from public keys, allowing an attacker to spend any bitcoin whose public key has been exposed on the blockchain.

Shor’s is a quantum computing method that can crack the math protecting passwords and wallets exponentially faster than normal computers.

When CoinDesk wrote about Willow in December 2024, the math was reassuring. Chris Osborn, founder of Solana ecosystem project Dialect, laid it out clearly at the time: roughly 5,000 logical qubits are needed to run Shor’s algorithm against current encryption, and each logical qubit requires thousands of physical qubits for error correction.

That meant millions of physical qubits, against Willow’s 105. The gap seemed enormous.

What’s changed isn’t the qubit count. It’s the error correction trajectory and the institutional response. Google went from demonstrating “below threshold” error correction, meaning they could turn noisy physical qubits into usable logical ones for the first time, to setting a corporate migration deadline in 16 months.

When the company that builds the quantum computers urges developers to migrate by 2029, that’s a signal that the gap is closing faster than the public timeline suggests.

Ethereum co-founder Vitalik Buterin was already calling for urgency in October 2024, a month before the Willow announcement.

“Quantum computing experts such as Scott Aaronson have also recently started taking the possibility of quantum computers actually working in the medium term much more seriously,” Buterin wrote at the time.

“This has consequences across the entire Ethereum roadmap: it means that each piece of the Ethereum protocol that currently depends on elliptic curves will need to have some hash-based or otherwise quantum-resistant replacement.”

How Ethereum and Bitcoin developers are responding

The contrast with how the two largest blockchain networks are responding could not be sharper.

The Ethereum Foundation treated that as a directive and built accordingly. Eight years of work, now visible in weekly shipping devnets and a public roadmap with fork-level specificity.

Bitcoin’s governance model makes this kind of coordinated response structurally harder. There is no Ethereum Foundation equivalent to fund and direct a multi-year engineering effort.

Protocol changes require broad consensus among a decentralized developer community that has historically moved slowly and deliberately, a feature for stability but a liability when facing a deadline.

The last major cryptographic upgrade to Bitcoin, Taproot, took years of discussion before activation in 2021.

Ethereum launched pq.ethereum.org this week, a dedicated hub for its post-quantum security effort that has been underway since 2018. The Ethereum Foundation’s post-quantum team, cryptography team, protocol architecture team, and protocol coordination team have spent eight years building toward a migration that touches every layer of the protocol.

More than 10 client teams are shipping weekly devnets through what the foundation calls PQ Interop. The roadmap maps specific milestones across four upcoming hard forks, from a post-quantum key registry to full PQ consensus.

Bitcoin, on the other hand, has no equivalent effort. No coordinated roadmap. No multi-team engineering program. No fork milestones.

Nic Carter, one of Bitcoin’s most prominent advocates and co-founder of crypto fund Castle Island Ventures, said the quiet part out loud this week.

“Elliptic curve cryptography is on the brink of obsolescence,” he wrote on X. “Whether it’s 3 or 10 years, it’s over and we need to accept that. The only thing that matters is how quickly blockchain developers recognize that they need to bake in cryptographic mutability into their networks.”

Carter contrasted the two approaches directly. Ethereum’s approach, he said, was “best in class,” describing how the network “gets together and announces a specific, detailed PQ roadmap by 2029, sets it as top strategic priority, folds PQ into ongoing roadmap, detailed FAQ, no fear, just action.”

Bitcoin’s approach, Carter said, was “worst in class.” He noted there is currently one group working on a quantum-related proposal that has “received zero buy-in from top devs,” with developers pointing to isolated pieces of research as evidence of progress while having “no coherent strategy, no roadmap.”

“Everyone knows I’m a bitcoiner and would like bitcoin to win,” Carter added. “Not saying this to hurt feelings. Saying this to spur action.”

The urgency isn’t universally shared, however.

Firms such as CoinShares argue that fears of an imminent quantum threat to bitcoin are overstated, and it estimates that only about 10,200 BTC is concentrated enough in vulnerable legacy address types that its theft could cause “appreciable market disruption.”

The remaining exposed supply, roughly 1.6 million BTC in older Pay-to-Public-Key addresses, is scattered across more than 32,000 separate wallets averaging about 50 BTC each, making them slow and unprofitable to crack individually, as CoinDesk reported at the time.

But the question isn’t whether quantum computing will eventually threaten blockchain cryptography. Google, the Ethereum Foundation, NIST, and now prominent Bitcoin advocates all agree it will.

It is whether three years is enough time to migrate a global, decentralized protocol that has no central authority to set deadlines, no coordinated engineering team to execute them, and a culture that treats urgency with suspicion.

Ethereum’s answer is that eight years of preparation put it in a position to execute the migration across four hard forks. Google’s answer is that 2029 is the deadline, and the migration is already underway in its products.

Bitcoin’s answer, so far, is silence. And as Carter warned, “ETHBTC will start to reflect the divergence in prioritization” if that silence continues.