According to Google's Quantum AI team, a future quantum computer could potentially derive a bitcoin private key from a public key in approximately nine minutes. This revelation has sent shockwaves across social media and the markets, but the real question is, what does it mean in practical terms? To understand this, it's essential to grasp how bitcoin transactions work.
When a bitcoin transaction is made, the wallet uses a private key to sign the transaction, which is a secret number that verifies ownership of the coins. This signature also reveals the public key, a shareable address that is broadcast to the network and waits in the mempool until a miner includes it in a block, a process that takes around 10 minutes on average. The link between the private and public keys is based on a complex math problem known as the elliptic curve discrete logarithm problem, which classical computers cannot reverse in a useful timeframe, but a sufficiently powerful future quantum computer could, using an algorithm called Shor's.
The 'nine minutes' comes into play because Google's paper found that a quantum computer could be pre-primed by pre-computing parts of the attack that don't depend on any specific public key. Once a public key appears in the mempool, the machine only needs about nine minutes to derive the private key, giving the attacker a roughly 41% chance of redirecting funds before the original transaction confirms, since bitcoin's average confirmation time is 10 minutes.
This can be likened to a thief building a universal safe-cracking machine that works for any safe but needs only a few final adjustments for each new safe, a process that takes about nine minutes. However, this 'mempool attack' requires a quantum computer that does not yet exist, with Google's paper estimating such a machine would need fewer than 500,000 physical qubits, far beyond today's largest quantum processors which have around 1,000. A more immediate concern is the approximately 6.9 million bitcoin, about one-third of the total supply, that are already in wallets where the public key has been permanently exposed. This includes early bitcoin addresses that used a format called pay-to-public-key and any wallet that has reused an address, as spending from an address reveals the public key for all remaining funds.
These coins are at risk because an attacker with a sufficiently powerful quantum computer could crack them without any time pressure. The 2021 Taproot upgrade inadvertently made this worse by changing how addresses work so that public keys are visible on-chain by default, expanding the pool of wallets vulnerable to a future quantum attack. While the bitcoin network itself would continue to run because mining uses a different algorithm that quantum computers can't speed up, the ability to derive private keys from public keys would break down the ownership guarantees that make bitcoin valuable, putting anyone with exposed keys at risk of theft and undermining institutional trust in the network's security model. The solution to this issue is post-quantum cryptography, which involves replacing the vulnerable math with algorithms that quantum computers cannot crack, a migration that Ethereum has been working towards for eight years but bitcoin has yet to start.