YFarmXIntelligence for an accelerating world

Security Desk · Tool

Quantum Threat Tracker

The day a quantum computer can break today's encryption is called Q-Day. No machine can do it yet, and no one can name the year one will. This board tracks the honest state of it: the expert estimate, the standards, who has actually migrated to quantum-safe cryptography, which blockchains are ready, and the hardware milestones. Every figure is sourced. Maintained by the Security Desk.

The road to Q-Day

Countdown to the soonest milestone

2yrs161days03hrs52min10sec

to the first large fault-tolerant quantum computer, which Google, IBM and Microsoft target for 2029. That is a hardware milestone, not Q-Day: it would still be far from breaking RSA-2048.

No major lab forecasts a year for breaking RSA. The soonest dated targets, from Google, IBM and Microsoft, are for a large fault-tolerant machine around 2029, which would still be far short of breaking RSA-2048. The only real code-breaking estimate, an expert survey, puts the odds in single digits before the mid-2030s. Q-Day is a forecast, not a fact.

Who forecasts what

  1. 2029GoogleHardware milestoneRoadmap target for a useful, error-corrected machine scaling toward a million qubits. It is not a claim to break RSA.Google Quantum AI roadmap ↗
  2. 2029IBMHardware milestoneStarling: a fault-tolerant machine of about 200 logical qubits, far short of what breaking RSA-2048 would need.IBM Quantum ↗
  3. 2029MicrosoftHardware milestoneAfter its Majorana 1 chip, Microsoft says useful, fault-tolerant quantum computing is years, not decades, away.Microsoft Azure Quantum ↗
  4. 2030NISTPolicy deadlinePlans to deprecate RSA-2048 and P-256 after 2030 and disallow them after 2035. A precautionary deadline, not a forecast.NIST IR 8547 (draft) ↗
  5. 2030QuantinuumHardware milestoneTargets universal, fully fault-tolerant computing with its Apollo system; some milestones have since moved toward 2029.Quantinuum ↗
  6. 2030EUHardware milestoneThe Quantum Europe Strategy aims for Europe's first full-stack fault-tolerant machine, around 100 logical qubits.European Commission ↗
  7. 2035NSAPolicy deadlineCNSA 2.0 requires national-security systems to be fully quantum-resistant by 2035, phasing in from 2027. A policy hedge.NSA CNSA 2.0 ↗
  8. 2035Mosca / GRIExpert surveyA 32-expert survey put the odds of a code-breaker within 5 years at 5 to 14%, rising toward even by the mid-2030s. The only real threat estimate.Global Risk Institute ↗
Top coins quantum-safe0 of 17none of the top 100 yet
Web traffic securedover 50%now post-quantum (Cloudflare)
Biggest machine today~100 qubitsof ~1,000,000 to break RSA
Migration deadline2035set by the US, UK and EU

Who has migrated to quantum-safe crypto

The systems that have deployed, or been ordered to deploy, post-quantum cryptography.

  • Apple iMessageDeployed
    PQ3 protocol

    Apple's PQ3, a hybrid of ML-KEM and elliptic curve with ongoing post-quantum re-keying, began rolling out in iOS 17.4 and reached full deployment across supported devices through 2024.

    Apple Security Research ↗
  • SignalDeployed
    PQXDH key agreement

    Signal shipped PQXDH (X25519 plus Kyber-1024) for the initial handshake in 2023 and has since extended post-quantum protection into the ongoing message ratchet.

    Signal specifications ↗
  • Google ChromeDeployed
    Hybrid X25519MLKEM768 in TLS

    Chrome enabled hybrid post-quantum key exchange by default in Chrome 124 (April 2024) and switched to standardised ML-KEM in Chrome 131 (November 2024).

    The Hacker News ↗
  • Mozilla FirefoxDeployed
    Hybrid X25519MLKEM768 in TLS

    Firefox added the X25519MLKEM768 hybrid group in late 2024 and enabled it by default in early 2025.

    Encryption Consulting ↗
  • CloudflareDeployed
    Hybrid ML-KEM across its network

    By October 2025 over half of human web traffic across Cloudflare's network was protected by post-quantum key exchange, though origin-server support still lagged at around 4%.

    Cloudflare ↗
  • OpenSSHDeployed
    ML-KEM-768 + X25519 hybrid, default

    OpenSSH added the ML-KEM-768 plus X25519 hybrid in 9.9 and made it the default key exchange in OpenSSH 10.0 (April 2025), later warning on connections that are not quantum-safe.

    OpenSSH project ↗
  • Google (internal)Deployed
    Post-quantum ALTS

    Google has protected internal service-to-service traffic with a hybrid post-quantum ALTS since 2022 and has set 2029 as its broader migration target.

    Google Cloud ↗
  • Meta (internal)Deployed
    Hybrid post-quantum TLS

    Meta reported deploying hybrid ML-KEM TLS across most of its internal service-to-service traffic as part of a multi-year migration.

    Engineering at Meta ↗
  • ZoomDeployed
    Post-quantum end-to-end encryption

    In May 2024 Zoom added post-quantum end-to-end encryption for meetings where all participants run a recent enough client.

    Zoom ↗
  • Amazon Web ServicesRolling out
    Hybrid ML-KEM TLS on by default

    AWS turned ML-KEM hybrid TLS on by default across KMS, Secrets Manager, ACM, Payment Cryptography and S3 in April 2026.

    AWS Security ↗
  • Microsoft (Windows)Rolling out
    ML-KEM and ML-DSA in SymCrypt / CNG

    Microsoft brought ML-KEM and ML-DSA to Windows 11 and Windows Server 2025 through SymCrypt and CNG in 2025, extending to hybrid ML-KEM TLS key exchange in 2026.

    Microsoft Security Blog ↗
  • US GovernmentMandated by deadline
    Federal PQC migration mandate

    NSM-10 and OMB M-23-02 require agencies to inventory cryptography and migrate to NIST PQC, with a government-wide goal of mitigating quantum risk by 2035.

    White House OMB ↗
  • UK GovernmentMandated by deadline
    National PQC migration roadmap

    NCSC guidance directs organisations, especially critical national infrastructure, to complete discovery by 2028, high-priority migration by 2031 and full migration by 2035.

    UK NCSC ↗
  • European UnionMandated by deadline
    Coordinated PQC roadmap

    The EU roadmap requires Member States to migrate high-risk use cases to PQC by 2030 and medium-risk systems by 2035.

    European Commission ↗

Is your crypto quantum-safe?

0 quantum-safe · 7 in progress · 10 exposed. No top-100 coin is quantum-safe by default today. Every major chain still signs with quantum-vulnerable ECDSA or Ed25519, and the strongest efforts (Bitcoin BIP-360, Ethereum and Cardano roadmaps, Solana and NEAR opt-ins, Algorand Falcon state proofs) are opt-in, testnet or roadmap only. The only chains quantum-safe by default are small, purpose-built projects such as QRL, outside the top 100.

  1. Bitcoin BTCEvery spend relies on quantum-vulnerable ECDSA or Schnorr over secp256k1, and address reuse leaves many coins with exposed public keys. BIP-360, which adds post-quantum outputs, was merged as a proposal in early 2026 and has a testnet, but nothing is live on mainnet. source ↗In progressECDSA / Schnorr (secp256k1)
  2. Ethereum ETHExternally owned accounts still sign with quantum-vulnerable ECDSA. A concrete core-dev roadmap (Vitalik Buterin's 2026 plan, an Ethereum Foundation post-quantum hub, and account abstraction to let accounts opt into PQC) is under way, but nothing is deployed on mainnet. source ↗In progressECDSA secp256k1 (accounts)
  3. Solana SOLStandard accounts use quantum-vulnerable Ed25519. An opt-in, hash-based Winternitz Vault (2025) lets users store funds under quantum-resistant one-time signatures, but it is experimental and used by very few accounts. source ↗In progressEd25519 + opt-in Winternitz vault
  4. Cardano ADACardano signs with quantum-vulnerable Ed25519. Post-quantum security is a named pillar of the funded Vision 2026 programme, but nothing is deployed on mainnet. source ↗In progressEd25519
  5. Stellar XLMStellar accounts use quantum-vulnerable Ed25519. The Stellar Development Foundation has published a dated Quantum Preparedness Plan (Soroban verification in 2026, quantum-safe signers in 2027), but nothing is live yet. source ↗In progressEd25519
  6. NEAR Protocol NEARNEAR's July 2026 mainnet upgrade added the NIST-standardised ML-DSA-65 signature, which users can enable with a single transaction. It is a live, in-production opt-in; most accounts still use Ed25519. source ↗In progressML-DSA-65 opt-in; Ed25519 default
  7. Algorand ALGOAlgorand's State Proofs have used the lattice-based Falcon scheme on mainnet since 2022, and opt-in Falcon account keys are available. Ordinary accounts and consensus still rely on quantum-vulnerable Ed25519. source ↗In progressFalcon state proofs; Ed25519 default
  8. BNB BNBBNB Smart Chain is EVM-compatible and signs with quantum-vulnerable ECDSA secp256k1. No post-quantum option is deployed or announced. source ↗ExposedECDSA secp256k1 (EVM)
  9. XRP XRPXRP Ledger accounts use secp256k1 by default, with Ed25519 as an option, both quantum-vulnerable. Post-quantum support exists only as XLS standards discussion, not deployed. source ↗ExposedECDSA secp256k1 / Ed25519
  10. TRON TRXTRON signs transactions with quantum-vulnerable ECDSA over secp256k1. No post-quantum option is deployed. source ↗ExposedECDSA secp256k1
  11. Hyperliquid HYPEHyperliquid uses Ethereum-style signatures verified through ecrecover, that is ECDSA secp256k1, which is quantum-vulnerable. No post-quantum option was found. source ↗ExposedECDSA secp256k1 (EIP-712)
  12. Dogecoin DOGEAs a Bitcoin derivative, Dogecoin signs with quantum-vulnerable ECDSA secp256k1. No post-quantum roadmap or option was found. source ↗ExposedECDSA secp256k1
  13. Zcash ZECTransparent addresses use ECDSA secp256k1 and shielded spends use Jubjub-based signatures, both quantum-vulnerable. Zcash's own documentation states the protocol is not post-quantum secure today. source ↗ExposedECDSA secp256k1; Jubjub (shielded)
  14. Monero XMRMonero's ring signatures and stealth addresses are built on quantum-vulnerable Ed25519, which would threaten both spend authority and historic privacy. No post-quantum option is deployed. source ↗ExposedEd25519 (ring signatures)
  15. Chainlink LINKLINK is an ERC-20 token on Ethereum and its oracle reporting uses quantum-vulnerable ECDSA secp256k1. No post-quantum option is deployed. source ↗ExposedECDSA secp256k1 (ERC-20)
  16. Bitcoin Cash BCHAs a Bitcoin fork, Bitcoin Cash signs with quantum-vulnerable ECDSA over secp256k1. No post-quantum roadmap or option was found. source ↗ExposedECDSA secp256k1
  17. Toncoin TONTON wallets sign with quantum-vulnerable Ed25519. No post-quantum option is deployed. source ↗ExposedEd25519

Tap a chain for the detail and source. "In progress" means a live opt-in, testnet or funded roadmap, not a default. Not financial advice.

Milestone log

Standards, policy deadlines and hardware records on the road to Q-Day, newest first.

  1. HardwareReality check: hardware is still far from breaking RSAAs of 2026 the largest machines hold on the order of 100 physical qubits and tens of logical qubits, whereas even the most optimistic recent estimates require hundreds of thousands to a million physical qubits to factor RSA-2048.The Quantum Insider ↗
  2. HardwareQuantinuum Helios reaches 48 logical qubitsQuantinuum launched Helios, a trapped-ion system with 98 physical qubits, up to 48 error-corrected logical qubits, and two-qubit gate fidelity of 99.921%.Quantinuum ↗
  3. HardwareIonQ crosses 99.99% two-qubit gate fidelityIonQ reported the first four-nines (99.99%) two-qubit gate fidelity on its Tempo system, part of a roadmap targeting roughly 20,000 physical qubits by 2028.IonQ ↗
  4. StandardNIST advances FN-DSA (FALCON) toward draft FIPS 206NIST moved the draft of FN-DSA, the FALCON-based signature scheme set to become FIPS 206, toward public review, with a final standard not expected until late 2026 or 2027.DigiCert (on NIST) ↗
  5. PolicyEU publishes a coordinated PQC roadmapThe EU roadmap directs Member States to begin transition and inventories by 2026, complete PQC migration for all high-risk use cases by 2030, and address medium-risk systems by 2035.European Commission ↗
  6. HardwareIBM sets a path to a fault-tolerant machine by 2029IBM laid out a route from its 156-qubit Heron and 120-qubit Nighthawk processors to Starling, a targeted fault-tolerant machine of around 200 logical qubits running 100 million gates by 2029.IBM Quantum ↗
  7. PolicyUK NCSC publishes its PQC migration timelineThe NCSC set a three-phase national roadmap: discovery and planning by 2028, highest-priority migration by 2031, and full migration to PQC by 2035.UK NCSC ↗
  8. StandardNIST selects HQC as a backup KEMNIST chose the code-based algorithm HQC as a fifth standard and a mathematically independent backup to ML-KEM, with a draft standard expected around 2026 and a final version around 2027.Help Net Security (on NIST) ↗
  9. HardwareMicrosoft unveils Majorana 1, a topological processorMicrosoft presented Majorana 1, an eight-qubit topological processor it says is a step toward a million-qubit chip, though several physicists said the accompanying paper did not yet demonstrate a working topological qubit.Microsoft Azure Quantum ↗
  10. HardwareGoogle Willow shows below-threshold error correctionGoogle's 105-qubit Willow chip was the first to show below-threshold error correction, with the logical error rate roughly halving each time the surface-code array was scaled up from 3x3 to 5x5 to 7x7 physical qubits.Google Quantum AI ↗
  11. StandardNIST finalises FIPS 203, 204 and 205NIST published its first three finalised post-quantum standards: FIPS 203 (ML-KEM, from CRYSTALS-Kyber), FIPS 204 (ML-DSA, from CRYSTALS-Dilithium) and FIPS 205 (SLH-DSA, from SPHINCS+).NIST CSRC ↗
  12. PolicyNSA publishes the CNSA 2.0 timelineNSA's Commercial National Security Algorithm Suite 2.0 mandates ML-KEM-1024 and ML-DSA-87 for national-security systems, phasing in from 2025 toward exclusive use of quantum-resistant algorithms across most such systems by 2033.NSA CNSA 2.0 ↗

Q-Day figures are expert estimates and probabilities, not established facts, and they shift with each result. Sensational "encryption is broken" claims are logged only with their status. Updated 23 Jul 2026.