According to Google's Quantum AI team, a future quantum computer could potentially derive a bitcoin private key from a public key in approximately nine minutes. This revelation sent shockwaves across social media and financial markets. To understand the practical implications, it's essential to grasp how bitcoin transactions work.
When a bitcoin transaction is made, the wallet uses a private key to sign the transaction, which is then linked to a public key. This public key is shared with the network and is temporarily stored in the mempool before being included in a block by a miner, a process that typically takes around 10 minutes.
The connection between the private and public keys is based on a complex mathematical problem known as the elliptic curve discrete logarithm problem, which classical computers cannot solve in a reasonable timeframe. However, a sufficiently powerful quantum computer utilizing an algorithm known as Shor's could potentially solve this problem. The recent paper by Google found that a quantum computer can be 'primed' in advance by pre-computing parts of the attack that are not dependent on a specific public key. Once a public key appears in the mempool, the quantum computer would only need about nine minutes to derive the private key.
Given that bitcoin's average confirmation time is 10 minutes, this gives the attacker a roughly 41% chance of successfully deriving the key and redirecting the funds before the transaction is confirmed. This scenario can be likened to a thief who spends hours building a universal safe-cracking machine. Although the machine can crack any safe, it requires a few final adjustments for each new safe, a process that takes about nine minutes.
This is known as the mempool attack, which, although alarming, requires a quantum computer that does not yet exist. Google estimates that such a machine would need fewer than 500,000 physical qubits, whereas today's largest quantum processors have around 1,000. A more immediate concern is the 6.9 million bitcoin, approximately one-third of the total supply, that are already stored in wallets where the public key has been permanently exposed. This includes early bitcoin addresses that used a format called pay-to-public-key, where the public key is visible on the blockchain by default, as well as any wallet that has reused an address, since spending from an address reveals the public key for all remaining funds.
These coins are particularly vulnerable because they do not require the nine-minute race. An attacker with a sufficiently powerful quantum computer could crack them at leisure, working through exposed keys one by one without any time pressure. The 2021 Taproot upgrade inadvertently expanded the pool of wallets that would be vulnerable to a future quantum attack by making public keys visible on-chain by default. Although the bitcoin network itself would continue to function, as mining uses a different algorithm called SHA-256 that quantum computers cannot speed up with current approaches, the ability to derive private keys from public keys would undermine the ownership guarantees that make bitcoin valuable.
This could lead to theft and a collapse of institutional trust in the network's security model. The solution lies in post-quantum cryptography, which replaces the vulnerable math with algorithms that quantum computers cannot crack. Ethereum has been working towards this migration for eight years, but bitcoin has yet to start.