Everything inside blockquotes was generated by Gemini. I do not particularly like articles containing large amounts of AI-generated content either, but many technical terms and figures depend on data provided by AI. I will therefore treat this mainly as sharing and organizing information.
To outsiders like us, ChatGPT 3.5 seemed to appear overnight. It burst onto the scene in 2023 and suddenly reached the point of being able to pass the Turing test. In reality, GPT had published breakthrough papers continuously for years, allowing GPT models to keep evolving:
- 2018 (GPT-1): The paper Improving Language Understanding by Generative Pre-Training was published, formally proposing the concept of “generative pre-training.”
- 2019 (GPT-2): The paper Language Models are Unsupervised Multitask Learners was published, demonstrating that large web-trained models could perform many different tasks without fine-tuning.
- 2020 (GPT-3): The landmark paper Language Models are Few-Shot Learners was published. The model had reached 175 billion parameters, and people suddenly discovered that brute force could produce miracles: the model began to display astonishing comprehension.
- March 2022: OpenAI published an extremely important paper, Training Language Models to Follow Instructions with Human Feedback. In this paper, it introduced RLHF—reinforcement learning from human feedback—and trained InstructGPT.
- November 2022: ChatGPT, based on the GPT-3.5 architecture, was born. It was effectively a “sibling” or direct derivative of InstructGPT. OpenAI placed this model that could “understand instructions” inside the chat-box interface most natural to humans and released it for free as a research preview at the end of November 2022.
Concerns about quantum computing are therefore not groundless. Industries we have not paid attention to may be undergoing earth-shaking changes.
If previous quantum computers were like the “wild geniuses” before GPT-3, possessing enormous computing potential but remaining extremely unstable, the entire industry in 2026 is working to reach quantum computing’s “InstructGPT moment”—quantum error correction (QEC).
The industry currently shows several core advances:
- From “physical qubits” to “logical qubits”
- Previous media stories such as “IBM reaches 1,000 qubits” or “Google achieves quantum supremacy” referred to physical qubits. They are like extremely fragile soap bubbles. A slight change in temperature, a Wi-Fi signal, or even air movement can cause decoherence, making the computation collapse. The industry consensus today is that quantity is no longer the only standard; quality—error-correction ability—is what matters. Google’s Willow chip and the latest roadmaps from Microsoft and IBM all demonstrate the same thing: dozens or even hundreds of fragile physical qubits can be bound together to form one fault-tolerant logical qubit.
- A “warlord melee” among multiple technical approaches
Unlike large models, which have almost universally adopted the Transformer architecture, quantum computing still has no unified hardware standard:
- Superconducting approach (IBM and Google): Runs fastest, but requires refrigerators near absolute zero—0.015 Kelvin—and has extremely high engineering costs.
- Topological quantum computing (Microsoft Majorana 1): Pursues a fundamental breakthrough in physics, using new topological materials with intrinsic noise resistance. If successful, it could fit one million qubits on a single chip.
- Trapped-ion/photonics approaches (Quantinuum and Xanadu): Perform better at room temperature or higher temperatures and have long coherence times.
For today’s global cryptographic systems—such as the RSA, ECC, and DH asymmetric algorithms used by banks, government communications, and blockchains—the computing-power gulf that classical computers and future quantum computers must cross exists on completely different scales.
- Classical computers: “universe-destroying” computing power required
The foundation of internet security today, such as RSA-2048, is based on factoring large integers. Multiplying two large prime numbers is easy, but reversing their product to recover those two primes is extremely difficult.
How much computing power would existing supercomputers need to brute-force an RSA-2048 key?
- Computing requirement: Approximately 2^112 operations.
- Time cost: Even if every supercomputer humanity currently possesses—including the most advanced clusters—worked together without stopping, it would take tens or hundreds of millions of years.
- Energy cost: Decrypting one key might consume the energy resources of several Earths. Under the framework of classical computing, mainstream cryptographic systems are therefore physically absolutely secure.
- Quantum computers: a dimensionality-reduction strike requiring only “several thousand logical qubits”
Quantum computers are terrifying because they possess a specialized mathematical weapon—Shor’s algorithm.
When factoring large integers, Shor’s algorithm reduces computational complexity from exponential to polynomial.
In quantum computing, computing power is no longer measured in operations per second, or FLOPS, but by the number of fault-tolerant logical qubits.
According to current theoretical and engineering estimates, a quantum computer capable of breaking RSA-2048 overnight would need the following:
Metric Theoretical Requirement Why Is It Impossible Today? Logical qubits About 4,000 perfect, high-quality, fault-tolerant logical qubits Even the world’s leading laboratories can barely produce dozens of logical qubits today. Physical qubits About 20 million physical qubits Because quantum systems are extremely susceptible to interference, thousands of fragile physical qubits are generally needed to correct errors and form one logical qubit. Breaking time About several hours to several days Once the hardware meets the requirement, a quantum computer could solve in the time needed to drink a cup of coffee or sleep overnight what a classical computer would need hundreds of millions of years to solve.
Bitcoin uses the secp256k1 elliptic curve. Compared with RSA, elliptic curves are more fragile in the face of quantum attacks.
- Breaking a Bitcoin public-private key pair theoretically requires only 2,000 to 3,000 logical qubits.
- If a quantum computer has enough qubits, it could derive a private key directly from a public key within ten minutes—before Bitcoin’s next block is mined—and instantly transfer all assets in any wallet.
If only 4,000 logical qubits are needed to paralyze the world, how far away is that day?
The world’s leading quantum organizations—IBM, Google, Microsoft, Quantinuum, and others—are currently moving from hundreds of physical qubits toward hundreds of thousands. Based on current engineering progress:
- 2026–2030 (safe period): Quantum computers are expected to exceed one hundred logical qubits and can be used to simulate new materials and medicines, but they will still be unable to threaten RSA-2048.
- 2030–2035 (high-risk period): If quantum error correction achieves a breakthrough and the conversion ratio from physical to logical qubits improves significantly, quantum computers with tens of millions of physical qubits may appear. Existing cryptographic systems would then enter a real countdown.
Discussion of quantum computing in the Bitcoin community—especially among core developers and research organizations such as Blockstream—has recently intensified sharply. It can even be described as one of the most heated debates in recent years.
The direct trigger was a major paper jointly published at the end of March 2026 by Google, the Ethereum Foundation, and Stanford University. The paper stated that the number of physical qubits required to break Bitcoin’s underlying cryptographic algorithm, ECDSA, was twenty times lower than previously estimated—fewer than roughly 500,000 physical qubits—and that under extreme computing conditions a private key could be derived in as little as nine minutes. Because Bitcoin’s block interval is ten minutes, this means that a quantum computer could potentially intercept and steal funds during the brief period after a transaction is broadcast but before it is included in a block.
Faced with this sharply compressed timeline, the Bitcoin community is currently focusing on three things:
- Advancing the first quantum-resistant proposal: BIP-360, P2MR. This is the first quantum-resistant improvement proposal formally placed on Bitcoin’s roadmap.
- Fiercely debating whether to “adopt the U.S. standard directly” or “use hash-based signatures.” NIST recommends lattice-based quantum-resistant algorithms such as Dilithium and Falcon. Bitcoin Core developers have found, however, that adopting them directly would be disastrous for Bitcoin.
- Identifying “sleeping wallets” and discussing soft forks and “legacy freezing” policies. The Bitcoin assets under the most immediate quantum threat are actually old addresses whose public keys have already been exposed.
Let us clarify exactly which cryptographic algorithms would be threatened by quantum computers and which would not:
Core conclusion:
- Asymmetric cryptography (RSA/ECC) relies on an “elaborate mathematical structure.” Quantum computers already have the blueprint for dismantling it—Shor’s algorithm—so it collapses once attacked.
- One-way hashes (SHA/Keccak rely on an “unordered chaotic black box.”
I realized that continuing this way was not very good: the article was becoming nothing but copied-and-pasted AI-generated text. I therefore decided simply to provide a list of follow-up questions that can continue the topic. Copy any of these questions into any AI, and you will receive a fairly good answer:
This list of questions reflects another interesting point. My earlier view and conclusion was that in the AI era, the ability to answer questions is no longer important; the ability to ask questions is more important. This question list demonstrates exactly that. The answers are not important—any top-tier AI model can provide them. The process and thinking used to ask the questions are what matter.