Google's Quantum AI team revealed that a future quantum computer could potentially derive a bitcoin private key from its corresponding public key in approximately nine minutes. This revelation sent shockwaves across social media and the markets. But what are the practical implications of this claim? To understand the risk, let's first examine how bitcoin transactions function.
When a bitcoin transaction is made, the wallet uses a private key to sign the transaction, which is a secret number confirming ownership of the coins. This signature also discloses the public key, a shareable address that gets broadcast to the network and waits in the mempool until a miner includes it in a block, a process that typically takes about 10 minutes. The link between the private and public keys is based on a complex mathematical problem known as the elliptic curve discrete logarithm problem, which classical computers cannot solve in a practical timeframe but a sufficiently powerful quantum computer could, using an algorithm like Shor's. The crucial point here is that a quantum computer can be 'primed' in advance by pre-computing parts of the attack that are not specific to any public key.
Once a public key appears in the mempool, the quantum computer would only need about nine minutes to derive the private key, giving it a roughly 41% chance of succeeding before the original transaction is confirmed, assuming bitcoin's average confirmation time of 10 minutes. This scenario is akin to a thief who has spent hours building a universal safe-cracking machine that works for any safe but needs only a few final adjustments once a new safe appears, a process that takes about nine minutes.
This is known as the mempool attack, which, although alarming, requires a quantum computer that does not yet exist. Google estimates such a machine would need fewer than 500,000 physical qubits, far beyond the capabilities of today's largest quantum processors, which have around 1,000 qubits. A more immediate concern, however, is the approximately 6.9 million bitcoin, about one-third of the total supply, that are already in wallets where the public key has been permanently exposed. This includes early bitcoin addresses that used a format called pay-to-public-key, where the public key is visible on the blockchain by default, as well as any wallet that has reused an address, since spending from an address reveals the public key for all remaining funds.
These coins are at risk because an attacker with a sufficiently powerful quantum computer could crack them without any time pressure. The 2021 Taproot upgrade inadvertently expanded the pool of vulnerable wallets by making public keys visible on-chain by default. While the bitcoin network would continue to function, as mining uses a different algorithm (SHA-256) that quantum computers cannot significantly speed up, the ability to derive private keys from public keys would undermine the ownership guarantees that make bitcoin valuable, potentially leading to theft and a collapse of institutional trust in the network's security model.
The solution to this vulnerability is post-quantum cryptography, which involves replacing the current math with algorithms that quantum computers cannot crack. Ethereum has been working towards this migration for eight years, while bitcoin has yet to start.