What Is Q-Day?

The term gives security teams a shorthand for a threshold whose timing nobody can pin down for the time being, and the cryptography it breaks is wired into systems we can't swap easily or quickly.

The part that especially trips people up is the timeline (or rather the lack thereof), given the fact that Q-Day has no scheduled date. Its timing is a moving probability that climbs as quantum hardware improves, so the honest answer to "when" is spread over years.

This piece covers what Q-Day is, what it breaks, when credible forecasts put it, and why it already shapes decisions today.

Why it's called Q-Day

Q-Day is also called Y2Q, short for "years to quantum," as a deliberate nod to Y2K. The comparison helps as much as it misleads. Y2K had a fixed deadline everyone could see coming, and Q-Day doesn't. Nobody can pinpoint a date; there are only expert odds that keep shifting toward the present.

Y2K vs. Y2Q. Source: qLABS

Some people call it the "quantum apocalypse," which is a massive overstatement. Q-Day doesn’t mean the lights will go out. The only thing that will change is that a specific kind of math will stop protecting data and money the way it does now.

What breaks on Q-Day

The threat is specific, which is why "quantum breaks all encryption" doesn’t address it properly. Shor's algorithm, run on a large fault-tolerant quantum computer, solves the two math problems that public-key cryptography leans on: integer factorization and the discrete logarithm.

This breaks RSA, Diffie-Hellman, ECDSA, and Schnorr, which are all the algorithms behind secure web sessions, encrypted email, VPNs, and blockchain signatures. Ed25519, the system Cardano and Solana sign with, falls the same way.

However, symmetric cryptography holds up. Grover's algorithm speeds up brute-force search, but it only cuts a hash like SHA-256 from 256-bit to about 128-bit security, which stays out of reach nonetheless. So, the mining and block history on a chain like Bitcoin will survive Q-Day. The signatures won't. We break that down in 'Can Quantum Computers Break Blockchain'.

When it comes to crypto holders, they’re facing concrete consequences. Once a capable machine exists, crypto assets still protected by nothing more than an exposed public key will be at risk of being taken by whoever runs the attack first, assuming they finish the key derivation before the funds move or the chain migrates. That said, the ledger will keep running the entire time.

When is Q-Day?

Nobody can put a year on it, let alone the specific date, but there are estimates. The Global Risk Institute's quantum threat tracking and the government migration roadmaps it cites from Canada and the EU converge on the early-to-mid-2030s as when a machine that can break public-key cryptography could emerge. That benchmark is RSA-2048, not Bitcoin’s curve, so read it as a general risk signal rather than a Bitcoin countdown. Aggressive vendor roadmaps point to the late 2020s.

Two things muddy the public conversation. First, several widely quoted dates aren't Q-Day predictions at all. Google's 2029 timeline and various government deadlines are targets for migrating off vulnerable cryptography, set early on purpose. They aren't predictions of a code-breaking machine arriving that year.

Q-Day estimates cluster in the early-to-mid-2030s. Source: qLABS

Second, the resource estimates keep falling. In March 2026, Google Quantum AI put the cost of breaking secp256k1, the curve behind Bitcoin, below 500,000 physical qubits, about a 20x drop from the prior best. Separately, Iceberg Quantum estimated that RSA-2048, a different target, could be broken with under 100,000 physical qubits.

Falling estimates lower the engineering bar, but they don't set a date. Today's best public hardware runs a few thousand physical qubits with error rates far too high for the attack, so the distance is still large. Nevertheless, the speed at which it's closing is the part worth watching.

Why the threat starts before Q-Day

Waiting until Q-Day to start worrying seriously undermines the upcoming threat. The exposure has already started, through a tactic called harvest now, decrypt later, which targets encrypted data.

It works like this: an attacker collects ciphertext today and decrypts it once a capable machine exists. Anything that has to stay secret for years, from medical files to state archives, is exposed at this very moment, because a copy taken now can be opened later. 

Crypto faces a related but separate problem. A crypto asset isn't a file that gets decrypted. Instead, a public key revealed on-chain stays there forever, and a future quantum attacker can derive the private key behind it and forge a transaction. The ledger itself does the archiving.

This is why an uncertain date offers no comfort. The migration has to finish before Q-Day arrives, with time to spare.

How to prepare for Q-Day

Now for some good news: the replacement cryptography already exists. NIST finalized its first post-quantum standards in August 2024, and more are on the way. The hard part is deployment. Swapping the cryptography that live systems and blockchains depend on, without breaking anything or losing funds, takes years, which is exactly why the early migration deadlines exist.

If you hold crypto, you don't have to wait on its underlying chain to become quantum-resistant. On Bitcoin and other chains that keep the public key behind a hash until you spend, using a fresh address and emptying it in full when you do shortens how long a key sits exposed. But that protection only goes so far.

Some Bitcoin output types (old pay-to-public-key, Taproot) expose the key regardless, and even hash-hidden ones reveal it during the spend. It helps the least on account-based chains like Solana, where the address is the public key. It lowers exposure without making anything quantum-safe. 

You can also add a post-quantum lock at the application layer. A disclosure first: qLABS builds products in this space, including the vault below and the index further down, so weigh it accordingly. qVAULT is a non-custodial qLABS smart contract that requires a Falcon signature on top of your normal wallet, therefore a broken ECDSA key alone can't authorize a withdrawal. 

Falcon is the scheme NIST picked as the basis of its forthcoming, yet-to-be-finalized FN-DSA standard. The vault currently lists qONE and HYPE on HyperEVM, and Fairyproof audited its contracts. This protection lives inside its own contract. It doesn't reach HyperEVM or its validators, and it's one option among several. As you read this, keep in mind that none of what’s written here is financial advice.

Where does the blockchain supporting your assets stand? Our L1 Quantum Vulnerability Index scores the ten largest chains on qLABS's own 0-to-10 scale, which blends signature exposure, market value, chain age, and preparedness. Each scores above the midpoint, and Bitcoin sits highest at 8.33.

Where that leaves you

Q-Day’s timing behaves like a probability, and treating it like a distant certainty is a mistake. The algorithms that replace today's signatures are already standardized. It’s getting them onto live systems and chains before a capable machine shows up that’s the slow part, which is why the work has to run ahead of the threat.

If you hold assets on the blockchain, the year is the wrong thing to chase. Know your exposure and start shrinking it now. Check where your chain ranks on the qLVI, and see whether your crypto is safe from quantum computing.

FAQ

What is Q-Day?

Q-Day is the day a cryptographically relevant quantum computer can break the public-key cryptography, RSA, and elliptic-curve schemes that secure most digital systems, including crypto wallets. It's also called Y2Q, short for "years to quantum."

When is Q-Day?

No fixed date exists. The Global Risk Institute's tracking and the government migration roadmaps it cites converge on the early-to-mid-2030s for a machine that could break public-key cryptography, with aggressive vendor roadmaps pointing to the late 2020s. GRI's benchmark is RSA-2048, not Bitcoin's curve. Widely quoted years like 2029 are usually migration deadlines rather than Q-Day forecasts.

Is Q-Day a single fixed date?

No. Q-Day is an event. Its timing is what expert surveys model as a probability distribution, and the date will only be obvious in hindsight, once a machine does it.

What happens to Bitcoin on Q-Day?

Bitcoin's mining and block history keep working, because Grover's algorithm doesn't meaningfully dent SHA-256. The vulnerable part is signatures. Coins guarded only by a public key that's already on-chain can be taken by whoever runs Shor's algorithm first, assuming they get there before the funds move or the chain migrates. Bitcoin scores highest on our qLVI at 8.33, an index that also weighs market value, chain age, and preparedness.

Can Q-Day be stopped?

You can't stop quantum computers from arriving. What you can do is migrate vulnerable systems onto post-quantum cryptography before they get here. NIST standardized the replacement schemes in 2024. The rest is deployment across systems and chains.

qLABS Editorial. Sources are linked inline. See the L1 Quantum Vulnerability Index for our full methodology and conflict-of-interest disclosure.