YFarmX logoYFarmXIntelligence for an accelerating worldBriefings
YFarmX logoYFarmX
YFarmX
Security Desk · live board

Quantum Threat Tracker

2029 is Google’s target for completing its post-quantum migration

The day a quantum computer can break today's encryption is called Q-Day. No machine can do it yet, and no one can name the year one will. This board tracks the published evidence: expert surveys, the standards, who has actually migrated to quantum-safe cryptography, which blockchains are ready, and the hardware milestones.

Updated 13 Oct 2026 · 8 forecasts · 26 milestones

The road to Q-Day

Soonest milestone

2029Estimated

is a target year on IBM’s and Microsoft’s hardware roadmaps. Google separately uses 2029 as its migration deadline. These are engineering and security-planning targets. Breaking RSA-2048 requires much larger reliable machines.

Hardware roadmaps describe proposed machines, while resource studies estimate the qubits and operations needed to attack cryptography. Expert surveys assess the probability of such machines arriving within a given period. The Global Risk Institute’s 2025 survey, published on 9 March 2026, puts the probability of breaking RSA-2048 within 24 hours at 28–49% within ten years and 51–70% within fifteen years. Google’s 2029 date is its own migration deadline.

Who forecasts what

  1. 2029GooglePolicy deadlineGoogle targets completion of its migration to post-quantum cryptography by 2029. This date governs its security preparations.Google migration announcement ↗our page →
  2. 2029IBMHardware milestoneStarling: a fault-tolerant machine of about 200 logical qubits, far short of what breaking RSA-2048 would need.IBM Quantum ↗our page →
  3. 2029MicrosoftHardware milestoneMajorana 2, unveiled on 2 June 2026, came with a target of a scalable quantum computer by 2029, half the original timeline; DARPA began on-site testing of its qubits in Maryland on 22 September. A hardware target, far short of what breaking RSA-2048 would need.Microsoft Source ↗our page →
  4. 2030NISTPolicy deadlinePlans to deprecate RSA-2048 and P-256 after 2030 and disallow them after 2035. A precautionary deadline, not a forecast.NIST IR 8547 (draft) ↗our page →
  5. 2030QuantinuumHardware milestoneTargets universal, fully fault-tolerant computing with its Apollo system; some milestones have since moved toward 2029.Quantinuum ↗our page →
  6. 2030EUHardware milestoneThe Quantum Europe Strategy aims for Europe's first full-stack fault-tolerant machine, around 100 logical qubits.European Commission ↗our page →
  7. 2035NSAPolicy deadlineCNSA 2.0 requires national-security systems to be fully quantum-resistant by 2035, phasing in from 2027. A policy hedge.NSA CNSA 2.0 ↗
  8. 2035Mosca / GRIExpert surveyThe Global Risk Institute's 2025 survey of 26 experts, published on 9 March 2026, puts the odds of a quantum computer that breaks RSA-2048 within 24 hours at 28 to 49% within 10 years, by roughly 2035, and 51 to 70% within 15 years; the upper end of the answers gives about 15% within five years. An expert survey of timing probabilities.Global Risk Institute ↗our page →
Chains quantum-safeTracked here0 of 17 trackedNone of the top 100 yet
Web traffic securedCloudflareOver 65%Human traffic, April 2026Cloudflare ↗
Biggest machine todayPhysical qubits4,400+ qubitsD-Wave annealer, May 2025An annealer cannot run Shor's algorithm. The largest gate-model processors are smaller: IBM's Condor at 1,121 superconducting qubits, demonstrated in December 2023, and Atom Computing's 1,180-qubit neutral-atom array. Around 100 describes only the highest-fidelity trapped-ion machines, such as Quantinuum's Helios at 98. Breaking RSA-2048 is estimated to need of the order of a million.D-Wave ↗
Logical qubitsError-correctedUp to 96QuEra and Harvard, 2025Definitions differ, so these counts are not a single league table. The 96 comes from a Harvard-led Nature paper, reported by QuEra in December 2025, running algorithms below threshold on a neutral-atom system. IBM executed 70 logical qubits on 30 July 2026. Quantinuum's Helios holds 48 fully error-corrected logical qubits at a 2:1 encoding rate, announced 5 November 2025, which remains the record for that encoding density.QuEra ↗
Migration backstopPolicy2035US, UK and EU outer dateThe binding American date is earlier and separate: Executive Order 14412 requires federal sensitive systems to move to post-quantum encryption by 31 December 2030.

Who has migrated to quantum-safe cryptography

  • Cloudflare 1.1.1.1Deployed
    Post-quantum DNSSEC validation

    Cloudflare's 1.1.1.1 resolver now validates DNSSEC signatures made with ML-DSA-44, which IANA has assigned DNSSEC algorithm number 18; the signatures run 2,420 bytes against 64 for ECDSA P-256. Announced 10 September 2026 as an early step toward full post-quantum DNS security by 2029.

    Cloudflare ↗
  • Apple iMessageDeployed
    PQ3 protocol

    Apple's PQ3, a hybrid of ML-KEM and elliptic curve with ongoing post-quantum re-keying, began rolling out in iOS 17.4 and reached full deployment across supported devices through 2024.

    Apple Security Research ↗
  • SignalDeployed
    PQXDH key agreement

    Signal shipped PQXDH (X25519 plus Kyber-1024) for the initial handshake in 2023 and has since extended post-quantum protection into the ongoing message ratchet.

    Signal specifications ↗
  • Google ChromeDeployed
    Hybrid X25519MLKEM768 in TLS

    Chrome enabled hybrid post-quantum key exchange by default in Chrome 124 (April 2024) and switched to standardised ML-KEM in Chrome 131 (November 2024).

    Google Online Security Blog ↗
  • Mozilla FirefoxDeployed
    Hybrid X25519MLKEM768 in TLS

    Firefox added the X25519MLKEM768 hybrid group in late 2024 and enabled it by default in early 2025.

    Encryption Consulting ↗
  • CloudflareDeployed
    Hybrid ML-KEM across its network

    In the seven days to 2 October 2026, 71.9% of human HTTPS traffic on Cloudflare's network used post-quantum key agreement (Cloudflare Radar, 2 October 2026), up from over 65% in April 2026. On 8 September 2026 its Automatic Key Exchange began preferring the post-quantum hybrid X25519MLKEM768 for edge-to-origin TLS where the origin supports it: 33% of scanned domains now prefer the hybrid, and Cloudflare counts about 45 billion post-quantum connections a day across its network. On 29 September 2026 Cloudflare announced it is becoming a public certificate authority, with its first production Merkle Tree Certificates, a compact certificate format built for post-quantum signatures, due in the first quarter of 2027 (Cloudflare blog).

    Cloudflare ↗
  • OpenSSHDeployed
    ML-KEM-768 + X25519 hybrid, default

    OpenSSH added the ML-KEM-768 plus X25519 hybrid in 9.9 and made it the default key exchange in OpenSSH 10.0 (April 2025), later warning on connections that are not quantum-safe.

    OpenSSH project ↗
  • Google (internal)Deployed
    Post-quantum ALTS

    Google has protected internal service-to-service traffic with a hybrid post-quantum ALTS since 2022 and has set 2029 as its broader migration target.

    Google Cloud ↗
  • Meta (internal)Deployed
    Hybrid post-quantum TLS

    Meta reported deploying hybrid ML-KEM TLS across most of its internal service-to-service traffic as part of a multi-year migration.

    Engineering at Meta ↗
  • ZoomDeployed
    Post-quantum end-to-end encryption

    In May 2024 Zoom added post-quantum end-to-end encryption to Zoom Meetings, for calls where every participant runs a recent enough client. It uses Kyber 768, the pre-standardisation name for what NIST went on to publish as ML-KEM-768 in FIPS 203.

    Zoom ↗
  • Amazon Web ServicesRolling out
    Hybrid ML-KEM TLS on by default

    AWS turned ML-KEM hybrid TLS on by default across KMS, Secrets Manager, ACM, Payment Cryptography and S3 in April 2026.

    AWS Security ↗
  • Microsoft (Windows)Rolling out
    ML-KEM and ML-DSA in SymCrypt / CNG

    Microsoft brought ML-KEM and ML-DSA to Windows 11 and Windows Server 2025 through SymCrypt and CNG in 2025, extending to hybrid ML-KEM TLS key exchange in 2026.

    Microsoft Security Blog ↗
  • US GovernmentMandated by deadline
    Federal PQC migration mandate

    Executive Order 14412 of 22 June 2026 sets PQC key-establishment deadlines of 31 December 2030 and digital-signature deadlines of 31 December 2031 for non-national-security federal high-value assets and high-impact systems. The broader 2035 goal and national-security rules have separate scopes.

    Executive Order 14412 ↗
  • UK GovernmentRecommended timeline
    National PQC migration roadmap

    NCSC guidance directs organisations, especially critical national infrastructure, to complete discovery by 2028, high-priority migration by 2031 and full migration by 2035.

    UK NCSC ↗
  • European UnionRecommended timeline
    Coordinated PQC roadmap

    The EU roadmap recommends that Member States migrate high-risk use cases to PQC by 2030 and medium-risk systems by 2035.

    European Commission ↗

Is your crypto quantum-safe?

0 quantum-safe · 7 in progress · 10 exposed. No top-100 coin is quantum-safe by default today. Every major chain still signs with quantum-vulnerable ECDSA or Ed25519, and the strongest efforts (Bitcoin BIP-360, Ethereum and Cardano roadmaps, Solana and NEAR opt-ins, Algorand Falcon state proofs) are opt-in, testnet or roadmap only. The only chains quantum-safe by default are small, purpose-built projects such as QRL, outside the top 100.

  1. Bitcoin BTCStatus: In progressSignature scheme: ECDSA / Schnorr (secp256k1)

    Every spend relies on quantum-vulnerable ECDSA or Schnorr over secp256k1, and address reuse leaves many coins with exposed public keys. BIP-360, Pay-to-Merkle-Root, is a Draft soft-fork proposal for a new output type that drops Taproot's key-path spend, so it guards against long-exposure attacks on public keys left on the chain; post-quantum signatures are left to a separate proposal, and no protocol change is live on mainnet. On 26 August 2026 StarkWare mined a first quantum-safe transaction on mainnet in block 964,199, a hash-based lock needing no soft fork, though the format is non-standard, needs a direct path to a miner and protects only coins moved into its special output. source ↗Bitcoin →

  2. Ethereum ETHStatus: In progressSignature scheme: ECDSA secp256k1 (accounts)

    Externally owned accounts still sign with quantum-vulnerable ECDSA. On 7 September 2026 the Ethereum Foundation's Protocol cluster set a dated target: "The EF Protocol cluster is aiming for Ethereum L1 to be quantum-resistant across all three layers (execution, consensus, and data) by December 2029." A minimum viable post-quantum milestone, with a post-quantum consensus heartbeat, leanDA sampling and leanSPHINCS transactions, sits in the J* fork as a contingency, and native account abstraction is planned to let accounts swap signature schemes without a hard fork for each one. The cluster treats the date as fixed at least until January 2027, when it will reassess quantum progress with outside experts. source ↗Ethereum →

  3. Solana SOLStatus: In progressSignature scheme: Ed25519 + opt-in Winternitz vault

    The Solana Foundation’s 27 April 2026 update describes initial Falcon signature implementations by Anza and Firedancer and a conditional plan to migrate new, then existing wallets. Ordinary Solana accounts continue to use Ed25519. The earlier experimental quantum-resistant vault is a separate opt-in design. source ↗Solana →

  4. Cardano ADAStatus: In progressSignature scheme: Ed25519

    Cardano signs with quantum-vulnerable Ed25519. Post-quantum security is a named pillar of the funded Vision 2026 programme, but nothing is deployed on mainnet. source ↗Cardano →

  5. Stellar XLMStatus: In progressSignature scheme: Ed25519

    Stellar accounts use quantum-vulnerable Ed25519. The Stellar Development Foundation has published a dated Quantum Preparedness Plan (Soroban verification in 2026, quantum-safe signers in 2027), but nothing is live yet. source ↗Stellar →

  6. NEAR Protocol NEARStatus: In progressSignature scheme: ML-DSA-65 opt-in; Ed25519 default

    NEAR's July 2026 mainnet upgrade added the NIST-standardised ML-DSA-65 signature, which users can enable with a single transaction. It is a live, in-production opt-in; most accounts still use Ed25519. source ↗NEAR Protocol →

  7. Algorand ALGOStatus: In progressSignature scheme: Falcon state proofs; Ed25519 default

    Algorand's State Proofs have used the lattice-based Falcon scheme on mainnet since 2022, and opt-in Falcon account keys are available. Ordinary accounts and consensus still rely on quantum-vulnerable Ed25519. source ↗

  8. BNB BNBStatus: ExposedSignature scheme: ECDSA secp256k1 (EVM)

    BNB Smart Chain is EVM-compatible and signs with quantum-vulnerable ECDSA secp256k1. No post-quantum option is deployed or announced. source ↗BNB →

  9. XRP XRPStatus: ExposedSignature scheme: ECDSA secp256k1 / Ed25519

    XRP Ledger accounts use secp256k1 by default, with Ed25519 as an option, both quantum-vulnerable. Post-quantum support exists only as XLS standards discussion, not deployed. source ↗XRP →

  10. TRON TRXStatus: ExposedSignature scheme: ECDSA secp256k1

    TRON signs transactions with quantum-vulnerable ECDSA over secp256k1. No post-quantum option is deployed. source ↗TRON →

  11. Hyperliquid HYPEStatus: ExposedSignature scheme: ECDSA secp256k1 (EIP-712)

    Hyperliquid uses Ethereum-style signatures verified through ecrecover, that is ECDSA secp256k1, which is quantum-vulnerable. No post-quantum option was found. source ↗Hyperliquid →

  12. Dogecoin DOGEStatus: ExposedSignature scheme: ECDSA secp256k1

    As a Bitcoin derivative, Dogecoin signs with quantum-vulnerable ECDSA secp256k1. No post-quantum roadmap or option was found. source ↗Dogecoin →

  13. Zcash ZECStatus: ExposedSignature scheme: ECDSA secp256k1; Jubjub (shielded)

    Transparent addresses use ECDSA secp256k1 and shielded spends use Jubjub-based signatures, both quantum-vulnerable. Zcash's own documentation states the protocol is not post-quantum secure today. source ↗Zcash →

  14. Monero XMRStatus: ExposedSignature scheme: Ed25519 (ring signatures)

    Monero's ring signatures and stealth addresses are built on quantum-vulnerable Ed25519, which would threaten both spend authority and historic privacy. No post-quantum option is deployed. source ↗Monero →

  15. Chainlink LINKStatus: ExposedSignature scheme: ECDSA secp256k1 (ERC-20)

    LINK is an ERC-20 token on Ethereum and its oracle reporting uses quantum-vulnerable ECDSA secp256k1. No post-quantum option is deployed. source ↗Chainlink →

  16. Bitcoin Cash BCHStatus: ExposedSignature scheme: ECDSA secp256k1

    As a Bitcoin fork, Bitcoin Cash signs with quantum-vulnerable ECDSA over secp256k1. No post-quantum roadmap or option was found. source ↗Bitcoin Cash →

  17. Toncoin TONStatus: ExposedSignature scheme: Ed25519

    TON wallets sign with quantum-vulnerable Ed25519. No post-quantum option is deployed. source ↗

"In progress" means a live opt-in, testnet or funded roadmap, not a default. Not financial advice.

Milestone log

Standards, policy deadlines and hardware records on the road to Q-Day, newest first. Each milestone opens its own record page, with the detail and the source.

  1. PolicyNATO publishes a dated quantum technology roadmapNATO ↗
  2. MilestoneQuantum-safe Bitcoin transactions get 79% cheaper to buildStarkWare ↗
  3. StandardNIST will adopt the strengthened HQC parameters in the FIPS 207 draftNIST pqc-forum ↗
  4. HardwareIonQ publishes a compiled blueprint for breaking 256-bit elliptic curve signaturesIonQ ↗
  5. StandardIESG approves standalone ML-KEM key agreement for TLS 1.3IETF Datatracker ↗
  6. HardwareIBM Nighthawk r2 raises circuit throughput about 25 timesIBM Quantum ↗
  7. StandardRFC 10042 standardises hybrid ML-KEM key exchange for SSHRFC Editor ↗
  8. HardwareRigetti reports wafer-scale frequency targeting on a 36-qubit processorarXiv:2608.27789 ↗
  9. HardwareIBM completes its acquisition of HRL LaboratoriesIBM Newsroom ↗
  10. MilestoneFirst quantum-safe Bitcoin transaction mined on mainnetStarkWare ↗
  11. PolicyUS Treasury launches a Quantum-Readiness Task ForceUS Treasury ↗
  12. StandardRFC 10024 standardises hybrid ML-KEM key agreement for TLS 1.3RFC Editor ↗
  13. StandardHAWK withdrawn from NIST's additional-signature processNIST pqc-forum ↗
  14. HardwareMicrosoft unveils Majorana 2 with 20-second qubit lifetimesMicrosoft Source ↗our page →
  15. HardwareReality check: hardware is still far from breaking RSAQuEra ↗our page →
  16. HardwareQuantinuum Helios reaches 48 logical qubitsQuantinuum ↗our page →
  17. HardwareIonQ crosses 99.99% two-qubit gate fidelityIonQ ↗our page →
  18. StandardNIST advances FN-DSA (FALCON) toward draft FIPS 206DigiCert (on NIST) ↗
  19. PolicyEU publishes a coordinated PQC roadmapEuropean Commission ↗
  20. HardwareIBM sets a path to a fault-tolerant machine by 2029IBM Quantum ↗our page →
  21. PolicyUK NCSC publishes its PQC migration timelineUK NCSC ↗
  22. StandardNIST selects HQC as a backup KEMNIST ↗
  23. HardwareMicrosoft unveils Majorana 1, a topological processorMicrosoft Azure Quantum ↗our page →
  24. HardwareGoogle Willow shows below-threshold error correctionGoogle Quantum AI ↗our page →
  25. StandardNIST finalises FIPS 203, 204 and 205NIST CSRC ↗
  26. PolicyNSA publishes the CNSA 2.0 timelineNSA CNSA 2.0 ↗

Download the milestone data: CSV ·JSON ·RSS · CC BY 4.0 with attribution to YFarmX.

Q-Day figures are expert estimates and probabilities, not established facts, and they shift with each result. Sensational "encryption is broken" claims are logged only with their status.Last update · 13 Oct 2026