The number came out of nowhere. No code repository attached. No attack simulation. No qubit count. No error-correction overhead. Just a Wall Street strategist opening his mouth and letting a doomsday statistic tumble out: quantum computers will crack 35% of all Bitcoin by 2028.
Tom Lee, the Fundstrat co-founder who has been wrong with conviction more times than I have had cold spreads, suddenly found religion on cryptographic catastrophe. Then Adam Back swatted it down in a rebuttal dripping with cypherpunk-era dismissiveness. One line in, the defense of Bitcoin's cryptography had been delivered, the press cycle moved on, and the market shrugged.
Two grown men, arguing about a technical timeline neither of them has the data to prove. One says 35% by 2028. The other says nonsense. Bitcoin ticks down a hundred bucks. Then it does not matter anymore, because the bull market is busy burning retail money in the next AI-agent launchpad.
I have spent the last decade staring at this exact threat surface. I have read Shor's original paper until the margins blurred. I have audited ECDSA implementations that were one bad nonce away from becoming someone else's retirement fund. So when a number like 35% enters the chat, my terminal starts blinking. Not because the apocalypse is nigh. Because the number itself is a lie โ and worse, it is a lazy lie that will cost real people real money when the real quantum headline eventually lands.
Code does not care about your feelings. It also does not care about Tom Lee's Q4 outlook. Let us audit the claim like a smart contract review: hypothesis, evidence, conclusion.
The Two Priests of the Bitcoin Confessional
First, identify the speakers and their incentives. Tom Lee is a co-founder of Fundstrat Global Advisors, a Wall Street research shop. He has spent the past decade being aggressively, optimistically, repeatedly bullish on Bitcoin. He called for $25,000 BTC when it was at $7,000. He called for $100,000 when it was at $30,000. Some of those calls eventually hit. Most of them arrived late or not at all. But he has a media presence, and in a bull market, media presence is a yield-bearing asset.
The 35% by 2028 claim reeks of a man who has read a summary of a summary of a quantum-computing paper and then extrapolated into a cable-news-friendly soundbite. The original statement, parsed strictly, contains no technical detail whatsoever. No mention of Shor's algorithm. No distinction between elliptic curve cryptography and hash functions. No acknowledgment that Bitcoin addresses exist in two fundamentally different forms โ those that expose the public key and those that do not. Just a flat percentage, delivered with the confidence of a terminal output.
Adam Back, on the other hand, is one of the few humans on Earth whose day job literally involves Bitcoin's cryptographic consensus. He invented Hashcash, the proof-of-work predecessor that Bitcoin's mining system adapts. He runs Blockstream, a company that builds Bitcoin infrastructure. When he says nonsense, he is not being arrogant; he is being accurate in the way a pilot correcting a passenger who thinks the plane is on fire is being accurate.
But here is the problem with the rebuttal: it was too short, too dismissive, and too confident. Because there is a version of this threat that is real. It just is not the version Tom Lee sold. We are not dealing with a technical debate. We are dealing with a narrative collision between two incentive structures. Lee needs attention; Back needs Bitcoin to be sound money. Both are telling you something true. Neither is telling you the whole truth.
That is where I come in. I do not have a media budget or a cypherpunk pedigree. I have a terminal, a Python environment, and a habit of verifying every number that crosses my desk. Let me run the audit.
What Quantum Actually Threatens
There are exactly two algorithms relevant to Bitcoin's security. The first is Shor's algorithm, which in 1994 demonstrated that a quantum computer could factor large integers and solve discrete logarithms in polynomial time. This is the one that matters. ECDSA, the elliptic curve digital signature algorithm that secures Bitcoin's transaction system, relies on the discrete logarithm problem being computationally infeasible. Shor's algorithm breaks that assumption. The second is Grover's algorithm, which provides only a quadratic speedup for brute-force search. Grover threatens SHA-256 by reducing its effective security from 256 bits to 128 bits. That is still computationally infeasible even for a theoretical quantum computer of enormous size. So let us bracket Grover; the hash function is not where the blood flows.
The blood flows through ECDSA. But here is the critical detail that every 35% of Bitcoin broken headline conveniently omits: Bitcoin transactions do not always expose the public key.
In modern Bitcoin, funds are typically sent to a P2PKH address โ Pay-to-Public-Key-Hash. The output script commits to a RIPEMD-160 hash of the public key, not the public key itself. A transaction spending those funds must reveal the public key in the unlocking script. An attacker with a quantum computer can only break the elliptic curve discrete log problem if they have a public key to attack. If you control a Bitcoin address that has never spent funds โ a pure, untouched public key hash โ the quantum attacker sees only a 160-bit hash. And pre-image resistance on a hash does not yield to Shor's algorithm in any practical sense.
This is the single most widely misunderstood fact in the quantum-Bitcoin debate. Shor's algorithm is not a universal decrypt-everything button. It breaks discrete logs. It breaks factoring. It does not break hash pre-image resistance. SHA-256 is not the vulnerable primitive. ECDSA is. And ECDSA only becomes vulnerable once the public key is disclosed.
Now layer in Bitcoin's address evolution. The earliest coins, mined by Satoshi, were often sent to P2PK addresses โ Pay-to-Public-Key โ where the public key is visible in the output script the moment the coins were mined. No spending event required. The key is simply there, in the open, for anyone to record. A quantum attacker with a sufficiently powerful machine could target those UTXOs immediately and offline, without interacting with the network at all. This is the low-hanging fruit of a quantum scenario, and it is a real, documented exposure.
Then there is the broader ecosystem of addresses that have been spent at least once. A single spend reveals the public key for that UTXO forever. If a user reuses the same address across multiple deposits and spends once, every unspent satoshi at that address is now parked under a disclosed public key. It is exposed. It is quantum-vulnerable the moment a powerful enough machine exists.
The 35% Origin Story โ I Found Where the Number Comes From
So where does 35% come from? I have a rule about numbers that enter my terminal: verify or discard. So I decided to dig. Not through the media coverage, not through the Twitter thread โ through the on-chain literature and the actual data analysis that gets cited in cryptography circles.
What you find is a recurring figure: the proportion of Bitcoin UTXOs held in address types that have already exposed their public keys. Estimates vary depending on methodology, but the consensus across several independent analyses is that anywhere from 30% to 40% of Bitcoin's total supply sits in outputs with exposed public keys at any given time. This includes the legacy P2PK addresses from the Satoshi era. It also includes the massive volume of supply parked at reused addresses in old wallets, exchange cold-storage systems, and early mining operations.
Now look at the number again. 30% to 40%. Midpoint: 35%. There it is.
Tom Lee did not invent that percentage out of thin air. He, or his research team, more likely picked up a widely-cited summary of this UTXO exposure statistic and, in a classic failure of epistemic hygiene, converted the share of Bitcoin supply that would be at risk if a sufficiently powerful quantum computer existed today into a temporal prediction: quantum will crack 35% of Bitcoin by 2028.
The distinction matters. It is the entire ballgame. The number 35% describes a conditional exposure, not a countdown clock. It is a measure of address hygiene, not a prophecy. The difference between that framing and Lee's framing is the difference between a smart contract audit that says this function is vulnerable under these conditions and a press release that says your money will be stolen on March 17. One is engineering. The other is theater.
I have seen this exact pattern play out before. In 2021, I audited a DeFi protocol that claimed to be non-custodial. The whitepaper was beautiful. The marketing site was gorgeous. The smart contract, when I actually read it, had a withdrawal function that could be reentered three times before the state update committed. The vulnerability was real, but it required a very specific attack sequence. Nobody who looked at the front end would have found it. The team was not lying โ they just had not done the work. The gap between the marketing narrative and the code-level reality is always where the risk lives. Lee's 35% number is the same gap, inverted: a real statistic stripped of all its conditions, then weaponized for attention.
The Real Timeline: FTQC Is Not Coming in 2028
Now let me give you some numbers that Tom Lee's soundbite did not include.
To break a 256-bit elliptic curve key with Shor's algorithm, you need a fault-tolerant quantum computer with roughly 2,500 logical qubits and a circuit depth on the order of billions of gate operations. The engineering literature estimates that, once error correction overhead is factored in, this requires on the order of 100 million to 1 billion physical qubits. Let me repeat that: not 1,000 qubits, not 100,000 qubits. On the order of 100 million physical qubits when you account for surface codes and magic state distillation.
The most advanced quantum processors demonstrated to date โ by IBM, Google, Quantinuum, and others โ operate at the scale of hundreds to a few thousand physical qubits. That is not zero. It is also four to six orders of magnitude away from a Bitcoin-breaking machine. The best recent demonstrations of fault tolerance have shown logical qubits at the scale of tens, not thousands. The gap between scientifically interesting and cryptographically apocalyptic is not a step; it is a cliff.
The broader industry consensus, even among optimists, is that fault-tolerant quantum computing at a useful scale is not commercially viable before the early 2030s at the earliest. The consensus among cautious cryptographers is closer to the 2040s, or later. There is a non-trivial probability it never becomes viable at the scale required, because the engineering challenges of maintaining coherence across a million physical qubits are not incremental โ they are existential.
And even if a machine capable of breaking ECDSA arrived in 2030 or 2032, Bitcoin is not a static target. It has a migration path. The network can deploy quantum-resistant address formats. This is the part the doom-mongers miss: the upgrade path already partially exists. Taproot, activated in November 2021, introduced Schnorr signatures. Schnorr signatures are linear, which enables more efficient multi-signature protocols and, more importantly, creates a foundation for layering quantum-resistant schemes like hash-based signatures later. The infrastructure for migration is not hypothetical. It is coded, deployed, and sitting on the mainnet.
So let me state the audit conclusion clearly: Shor's algorithm is real. ECDSA is vulnerable to it in principle. But there are two enormous filters between in principle and 35% of Bitcoin is gone. One is the physical reality of quantum hardware, which is nowhere near the required scale. Two is the fact that much of that 35% of supply sits behind public-key hashes that have not been exposed โ and the exposed portion sits behind a network that can upgrade its cryptographic primitives before the quantum machine materializes.
The Second-Order Risk No One Is Pricing
Now here is the contrarian angle, and it is the one that matters for you as a market participant. The danger of Tom Lee's 35% claim is not that quantum computing will break Bitcoin. The danger is that people will believe it, sell, and create the exact conditions that make a catastrophic outcome possible.
Panic sells, liquidity buys. This is not a slogan; it is a mechanical fact of how markets clear. If a credible โ or even semi-credible โ quantum breakthrough is announced, you will see a cascading sell-off in Bitcoin that has nothing to do with whether the breakthrough can actually break ECDSA. The market does not trade on cryptographic reality. It trades on narratives about cryptographic reality. When a story spreads that quantum is here and 35% of Bitcoin is compromised, the smart money โ the funds that have already stress-tested this scenario โ will not be selling. They will be buying the panic, the way they bought the COVID crash, the way they bought the FTX collapse, the way they bought every liquidity vacuum in the last decade. And retail, as always, will be the exit liquidity.
I lived this pattern in November 2022. The narrative was all centralized exchanges are insolvent. Some were. Most were not. But the market sold everything, including self-custodied coins that had no counterparty risk whatsoever. The people who survived were the ones who had prepared for chaos, not the ones who had merely predicted it. I moved two and a half million dollars to hardware wallets in forty-eight hours. I shorted the stablecoin depeg. I did not do it because I believed the narrative. I did it because I knew the market would believe the narrative, and I positioned accordingly. The same playbook applies to quantum FUD. The first real quantum announcement will not be a technological event. It will be a liquidity event. And liquidity events are tradeable.
There is also a subtler second-order effect: the regulatory tail. If a credible quantum timeline enters mainstream discourse, lawmakers will start asking questions. Questions about address recovery. Questions about frozen coins. Questions about mandatory migration windows. That regulatory uncertainty will hit the market before any quantum computer does. The debate you are watching today is the seed of tomorrow's policy paper.
The Real Vulnerability Is Your Address Hygiene
But the deeper truth beneath the quantum debate is more uncomfortable than the debate itself. The reason 35% of Bitcoin is exposed is not because quantum computers are coming. It is because the Bitcoin ecosystem has been catastrophically sloppy about address hygiene for sixteen years. Exposed public keys are not a quantum problem. They are a key-management problem that quantum merely illuminates.
If you are holding Bitcoin right now, you should audit your own UTXO hygiene. Do you reuse addresses? Most modern Bitcoin wallets generate fresh addresses for each transaction, but exchange withdrawals, custody solutions, and older wallets frequently reuse. If your cold storage address has ever sent a transaction, that public key is already public. The quantum threat does not need to materialize in 2028 to make this a problem; the compromised public key is already out in the open. Every year that passes before quantum arrives is a year in which that exposure silently waits.
Address reuse is not just poor hygiene; it is a ticking audit finding. When the first genuine quantum-threat timeline is published โ and it will be โ the market reaction will be swift, and it will be proportionate not to the actual vulnerability count but to the perceived one. If you are a sophisticated operator, you should already be consolidating your UTXOs into Taproot-based addresses, which puts you on the migration path. The cost of migrating is a few transactions and some fee spend. The cost of waiting is exposure to the next panic cascade with no prepared position.
What Smart Money Is Actually Doing
Let me be concrete about my own playbook, because abstractions do not pay the bills. I have already started migrating long-held UTXOs that date back to the 2017 era. Not because I expect a quantum computer in 2028. Because expect is not a risk management strategy. I run a set of scripts that monitor address exposure, UTXO consolidation stats, and fee timing. The migration is slow, limited by block space and fee spikes, but it is mechanical, and it costs me a few basis points of my position. What it buys me is the ability to be rational when everyone else is screaming.
This is the pattern of every market inefficiency I have captured in my career. The 0x protocol audit in 2017 taught me that vulnerabilities hide in plain sight, buried in assumptions. The 2020 Uniswap V2 liquidity mining sprint taught me that yield is a function of active participation, not passive belief. The 2024 ETF arbitrage taught me that institutional money reprices assets faster than retail understands them. The 2025 AI-agent integration taught me that automation reduces emotional error โ but only if you enforce human oversight on the unusual event. And a quantum breakthrough would be exactly that: the unusual event where the automated systems flash red and the human has to decide, fast, whether the narrative is ahead of the physics.
Stop Fearing the Machine, Start Fixing the Hygiene
So where does this leave you? Let me simplify it into executable levels.
For the price: This is not a sell signal. It is not a buy signal either. The short-term market impact of quantum FUD is noise. The structural impact of real quantum progress, when it arrives, will be a buying opportunity for those who are prepared and a catastrophic liquidity event for those who are not. The proper response is not to dump Bitcoin. The proper response is to move it into a position that survives the panic: Taproot-based addresses, non-reused keys, self-custody with hardware isolation. That is the hedge.
For the narrative: Stop taking directional calls from people who say 35% by 2028 without showing the code, the qubit count, the error-correction overhead, or the UTXO breakdown. Every number that enters your terminal should be verifiable, or it should be ignored. This entire debate contained no data sources, no technical specifics, no market projection, no project background. It was all narrative. And narrative is a yield-bearing asset โ but only for the people who identify it as such, not for the people who buy it.
For the industry: The next real milestone will not be a quantum computer cracking ECDSA. It will be a credible engineering announcement โ a demonstration of, say, ten thousand logical qubits โ that finally forces the market to price migration costs. That is the event to watch. That is the moment when the 35% of Bitcoin is exposed statistic moves from academic footnote to market driver. The funds that have been quietly consolidating UTXOs and migrating to quantum-resistant formats will be the counterparties on the other side of your panic. And you will be fighting them for exit liquidity.
Code does not care about your feelings. Panic sells, liquidity buys. Yield is the bait, rug is the hook. But the real variable in the quantum debate is not the machine. It is your address hygiene. Fix that, and 2028 becomes just another year in the bull market. Ignore it, and the first real quantum headline will find you exactly where you are standing: exposed.
The question, as always, is not whether the threat is real. It is whether you will be on the right side of the liquidity event when the market finally wakes up to it.