“The most likely outcome is that at some point, secp256k1 or elliptic cryptography in general will fail.”
Back in April,
@reardencode said he doesn't expect quantum to be what breaks it, and explained why bitcoin should add new signature options before there's a real threat.