How Close Is Quantum Computing to Being Useful?

A plain-English map of where the technology actually stands, an honest estimate of its pacing, and what it means for cryptography, the financial system, Bitcoin, and the companies racing to build it.

TON618 Capital Research · Prepared under CFA Institute analytical standards · For information purposes only · Download PDF

Executive summary

Quantum computing is simultaneously the most over-hyped and one of the most genuinely important technologies in the market. Both things are true at once, and keeping them apart is the whole job of this note. The substance: after twenty-five years of promises, 2024–25 delivered the first results that actually matter — Google's "Willow" chip showed that adding more physical parts can make a quantum bit more reliable rather than less (crossing the so-called error-correction threshold), and trapped-ion machines from Quantinuum and IonQ now make errors at rates good enough to build on. That is the necessary precondition for everything else, and it is real and peer-reviewed.

The hype: none of this has yet produced a useful answer to a real-world problem. Every "quantum advantage" headline so far has either been on a contrived benchmark with no economic value, or has been matched by an ordinary computer within weeks — sometimes on a laptop. The one application with a proven, world-changing payoff (breaking the encryption that protects the internet) requires a machine roughly a thousand times larger than today's best, and it does not exist. Meanwhile the four listed pure-play quantum companies earn about $193 million between them and are valued near $52 billion.

This note explains, in plain language, what a quantum computer is and is not good at; where the technology actually stands; why "error correction" — not the qubit-count headlines — is the metric that decides everything; our best estimate of the pacing; and what it means for the cryptography that secures banks, governments, corporations, and Bitcoin. It closes with how we think about the investment opportunity and the portfolio risk. It is analysis, not advice, and contains no recommendation regarding any security or digital asset.

1What a quantum computer actually is — in plain English

An ordinary computer stores information in bits, each a definite 0 or 1. A quantum computer uses qubits, which exploit two genuinely strange features of the physics of very small things.

• Superposition. A qubit can be placed in a blend of 0 and 1 at the same time. Put 50 qubits together and the system can, in a sense, hold all 2⁵⁰ (about a quadrillion) combinations at once. This is not simply "trying every answer in parallel" — that is the popular myth — but it does give the machine an exponentially large space to work in.
• Entanglement. Qubits can be linked so that their fates are tied together; measuring one instantly tells you about the other. This lets the machine represent correlations that would be astronomically expensive to track classically.
• Interference. Here is the catch and the craft. When you finally measure the qubits, the superposition collapses to a single ordinary answer. A useful quantum algorithm is a carefully choreographed routine that makes the wrong answers cancel out (like noise-cancelling headphones) and the right answers reinforce, so the one you read out is very likely the one you wanted.

The consequence: a quantum computer is not a faster version of your laptop, and it will never be one. It is a special-purpose instrument that is dramatically faster for a small set of problems with the right hidden mathematical structure, and no better — often worse — at everything else. Email, spreadsheets, video, and the vast majority of business computing will never run on one.

What it is genuinely good at — and what is mostly hype

The single most important fact for a non-specialist: there are really only two problem classes with a proven exponential advantage, and both are narrow. The famous "optimization," "AI," and "finance" use-cases mostly are not real — a point made forcefully by researchers at Microsoft, who showed that a merely quadratic speedup (the best these offer) is usually erased by the machine's enormous overheads and slow data loading.¹

As the complexity theorist Scott Aaronson (UT Austin) puts it, the credible hopes are "(1) simulation of quantum physics and chemistry, (2) breaking a lot of currently deployed cryptography, and (3) eventually, modest benefits for optimization [and] machine learning… but it will probably be a while." Note that even the chemistry prize is daunting: a 2021 estimate to model one important catalyst (the enzyme behind fertilizer production) required ~2.7 million qubits; a 2025 algorithmic breakthrough cut that to ~100,000 — "still far more than today's hardware."²

2Where we actually are: real progress, zero useful output

The state of the art is best understood as a paradox. Hardware is improving rapidly and the foundational science just hit a genuine milestone — yet no quantum computer has produced an economically useful result. Both halves matter.

Start with the headline that everyone sees: qubit counts. They are rising, but the number is far less meaningful than it sounds — and chasing it can even be counterproductive. IBM deliberately moved its flagship down from 1,121 qubits (its "Condor" chip, 2023) to ~120–156 on later chips, trading raw count for quality. Different technologies are not comparable: trapped-ion machines (a few dozen qubits) are far more accurate than superconducting chips (hundreds), and neutral-atom arrays now hold thousands of atoms but cannot yet use most of them reliably.

Gate-based physical qubits by leading system, log scale. The dashed ceiling is what it would take to break the encryption securing the internet — about a thousand times today's best.

Now the substance. The right way to keep score is not "what was claimed" but "did an ordinary computer catch up?" By that test, every supremacy headline so far has an asterisk — until very recently.

So the honest summary of mid-2026: the science is finally real, the engineering is accelerating, and the commercial payoff has still not arrived. Aaronson's warning is worth keeping in mind — "qombies roam the earth: undead narratives of 'quantum advantage for important business problems' detached from any serious underlying truth-claim." (One 2025 bank "trading advantage" claim turned out to come entirely from hardware noise; the clean simulation showed no benefit at all.)³

3The metric that actually matters: error correction

If you remember one idea from this note, make it this one. Qubits are exquisitely fragile — a stray vibration, a photon, a flicker of heat, and the delicate superposition collapses and the calculation is ruined. Today's qubits make an error roughly every few hundred to few thousand operations. A useful algorithm needs billions. That gap — not the qubit count — is the whole game.

The solution is quantum error correction: spread the information of one reliable "logical" qubit across many noisy physical qubits, so that errors can be detected and fixed faster than they accumulate. The catch is a chicken-and-egg threshold. The famous threshold theorem says error correction only helps if your physical parts are already below a critical error rate (about 1% for the leading scheme). Above it, adding qubits makes things worse; below it, adding qubits makes the logical qubit exponentially better. Crossing that line is the gate everything else passes through — and it was finally, convincingly crossed in 2024–25.

Best two-qubit gate error rate by technology, over time (lower is better, log scale). Both leading approaches are now below the ~1% line — the necessary condition for scalable error correction.

Google's Willow (December 2024) was the watershed: as they made the error-correcting code larger, the logical error rate fell by about half at each step — the signature of being below threshold. The peer-reviewed result, not the "ten septillion years" press headline, is what mattered. Quantinuum's "Helios" (November 2025) then ran 48 fully error-corrected logical qubits, and academic groups at Harvard/MIT/QuEra have built integrated systems on hundreds of atoms.

But here is the sobering arithmetic. Each logical qubit can require anywhere from ~100 to ~1,000+ physical qubits. Today the entire field can muster a few dozen logical qubits. Useful work needs hundreds to thousands of them. That is the real distance left to travel — and it is best seen not as a single gap but as a set of targets that are themselves moving toward us as algorithms improve.

Physical qubits needed for each milestone vs. the largest machine today (log scale). Red targets have fallen sharply as the algorithms improved — the goalposts are moving toward the hardware.

The most striking case: in 2019, breaking RSA-2048 encryption was estimated to need 20 million physical qubits. In May 2025 the same researcher (Google's Craig Gidney) revised that to under 1 million — a 20× reduction with no change in hardware, purely from cleverer algorithms. The machine still doesn't exist. But the bar for building it keeps dropping.

4Our pacing estimate: three clocks, not one

"When will quantum computing be useful?" has no single answer because "useful" is three different milestones. Here is our read of the credible range, separating the vendors' (optimistic, historically slip-prone) roadmaps from independent and expert consensus.

Gold bars = vendor / optimistic targets; grey = independent and expert-survey consensus. Dashed verticals mark government deadlines to retire today's encryption (§5).

Where the disagreement is. The hardware builders cluster around 2029–2030 for their first fault-tolerant machines — IBM ("Starling," 200 logical qubits, 2029), Google (~2030), Quantinuum ("Apollo," 2029), IonQ (2030), and the most aggressive, PsiQuantum (~2027–28). But these are marketing roadmaps with a long, documented history of slipping — and indeed several 2025–26 targets already have. Independent voices are more cautious: the consulting firm BCG puts full-scale fault tolerance only after 2040, with a window of broad advantage opening 2030–2040. Our own view splits the difference: genuine, narrow scientific value this decade; broad commercial value in the 2030s; and a meaningful, plan-for-it-now probability of code-breaking capability within ten to fifteen years.

5The cryptography reckoning — banks, governments, and corporations first

This is where a still-nonexistent machine already changes decisions today. Almost everything that keeps digital life secure — web traffic (the padlock in your browser), VPNs, software updates, secure email, the certificates banks and governments trust, and the messaging that moves money between banks — rests on public-key cryptography, specifically RSA and elliptic-curve cryptography (ECC). Their security rests on math problems (factoring huge numbers; elliptic-curve discrete logs) that are hopelessly hard for classical computers.

In 1994, Peter Shor proved a quantum computer could solve exactly those problems efficiently. So a large enough quantum computer doesn't weaken this encryption — it breaks it outright. Crucially, the damage is asymmetric, and this asymmetry shapes the entire global response:

Why the split? Shor exploits deep algebraic structure unique to public-key math, yielding an exponential break. Grover, against the "unstructured" symmetric ciphers, offers only a square-root speedup — so simply doubling the key length (to AES-256) fully restores safety. The world's entire migration effort therefore targets public-key crypto specifically.

Why the threat is already here: "harvest now, decrypt later"

You do not need to wait for the quantum computer for the damage to begin. Adversaries can record encrypted data today and simply store it until a machine exists to decrypt it. Anything that must stay secret for a decade or more — state and military secrets, health and biometric records (which can never be "changed"), financial records, long-term contracts, trade secrets — is already exposed to a computer that won't be built for years. Security professionals capture this with Mosca's inequality: if the years your data must stay secret, plus the years it takes you to migrate, exceeds the years until Q-Day, you are already too late to start.

Probability that a cryptographically-relevant quantum computer exists by a given year. Band = range of expert opinion. Dashed verticals = government deadlines to retire RSA/ECC.

The defense is already being deployed

The response — post-quantum cryptography (PQC), new algorithms believed safe against both classical and quantum attack — is further along than most people realize. In August 2024 the U.S. standards body NIST finalized the first three PQC standards (built on "lattice" math that even a quantum computer struggles with). Governments have set hard deadlines, and the migration is quietly happening on the live internet right now.

The takeaway for a non-specialist: the institutions with the most to lose — central banks, intelligence agencies, the companies that run the internet's plumbing — are not waiting for Q-Day. They have read Mosca's inequality, and they are migrating now. This is the clearest signal that the threat, while years away, is treated as real.

6The Bitcoin angle

Because TON618 is a Bitcoin-benchmarked manager, we address Bitcoin's specific exposure directly — and put it in proportion. Bitcoin uses two kinds of cryptography with very different quantum exposure:

• Digital signatures (ECDSA, the secp256k1 curve) — vulnerable to Shor. This is what proves you own your coins. A large quantum computer could, in principle, derive a private key from a publicly visible public key.
• Mining and address hashing (SHA-256, RIPEMD-160) — only weakened by Grover. This is far more resilient. Bitcoin's mining and the basic address scheme do not face an existential quantum threat.

The practical risk centers on exposed public keys. A modern, never-reused Bitcoin address keeps its public key hidden behind a hash and is not directly Shor-exposed. But two categories are: the earliest coins (stored as raw public keys, including Satoshi's ~1.1 million BTC) and any address that has been reused after spending. Estimates put the share of supply in quantum-vulnerable addresses at roughly 25–33% (~4–6.9 million BTC). A separate, harder attack targets the brief window when a transaction is broadcast but not yet confirmed; a recent Google analysis suggested a fast future machine might derive a key in ~9 minutes — but that requires a far more capable machine than the "at-rest" threat, and the ~10-minute block window is a tight race.

Our assessment: the quantum threat to Bitcoin is real, specific, and manageable on the same ~10–15-year clock as the threat to banks and governments — and Bitcoin, unlike a paper contract sitting in an archive, can upgrade. We treat it as a monitorable tail risk, not a thesis-breaker (see §7). Notably, BlackRock added a quantum-risk disclosure to its Bitcoin ETF filing in 2025 — a sign the risk is now mainstream, not that it is imminent.

7Investment relevance & the TON618 read

Quantum computing presents an investor with a classic shape: a genuinely large prize, an honest decade-plus of uncertainty on timing, and a set of securities that have already run far ahead of the fundamentals. We separate the opportunity from the portfolio risk.

The opportunity — a barbell, not a basket

The listed pure-plays have delivered spectacular returns and now price in a great deal of success. Combined, they earn ~$193M of revenue against ~$52B of market value — about 268× sales — and none is profitable (combined losses ~$1.3B). The entire global quantum industry booked roughly $1B of revenue in 2025. This is a field being valued on a 2035 outcome.

Market capitalization vs. trailing revenue (log scale). The revenue bars are the thin dark stubs. Prices as of 24 June 2026.

How we frame it. The cleanest way to own the theme is a barbell: the prize is overwhelmingly likely to be captured inside trillion-dollar platforms (Google, IBM, Microsoft) and their suppliers (Nvidia, control-electronics and cryogenics vendors), where quantum is cheap, diversified, profitable optionality you are barely paying for — paired, if at all, with small, deliberately-sized positions in the pure-plays as high-beta lottery tickets, sized for the real risks of dilution (these firms fund losses by issuing stock) and roadmap slippage. We would be wary of the pure-play basket as a core holding at 268× sales; the more durable trade may be the defensive side — the post-quantum-security vendors and the consultancies running the migration, whose revenue is driven by deadlines (2030–2035) that are far more certain than Q-Day itself.

The portfolio risk — and why we are not losing sleep

• To the fund's Bitcoin mandate, quantum is a genuine but distant tail risk (§6), on the same ~10–15-year clock as the threat to the entire banking and government system — and Bitcoin can upgrade its cryptography, which a paper record in an archive cannot. We monitor it: the live signals are the BIP-360/361 process, the share of supply in vulnerable addresses, and any sharp jump in logical-qubit counts (not the physical-qubit headlines).
• The asymmetry cuts the right way for us. A credible acceleration of the threat timeline would damage every incumbent financial and technology asset that relies on RSA/ECC — arguably more than it damages a Bitcoin network that is actively building its own fix.
• What would change our mind: a sustained jump in logical-qubit counts (from dozens toward hundreds with low error), a fault-tolerant machine shipping ahead of the 2029 vendor targets, or a credible public demonstration of Shor's algorithm breaking a non-trivial key. Project Eleven's "Q-Day Prize" — awarded in April 2026 for breaking a 15-bit key — is a useful tripwire, but 15 bits is a universe away from Bitcoin's 256.

This note expresses no price target on any security or on Bitcoin. It is a thematic assessment intended as one input to the fund's understanding of a long-horizon technology and the risks and opportunities around it, consistent with our mandate to outperform spot BTC over multi-year horizons.