Google's Quantum AI team revealed that a potential future quantum computer could potentially derive a bitcoin private key from its corresponding public key in approximately nine minutes. This revelation sent shockwaves across social media and had a significant impact on the markets. But what does this actually mean in practical terms?
To understand this, let's examine how bitcoin transactions work. When a bitcoin transaction is made, the wallet uses a private key - a secret number proving ownership of the coins - to sign the transaction. This signature also reveals the public key, a shareable address that gets broadcast to the network and waits in the mempool until a miner includes it in a block, a process that takes around 10 minutes on average.
The private and public keys are connected through a complex math problem known as the elliptic curve discrete logarithm problem, which classical computers cannot reverse within a useful timeframe. However, a sufficiently powerful future quantum computer running an algorithm known as Shor's could potentially do so.
The nine-minute aspect comes into play as Google's paper discovered that a quantum computer could be 'primed' in advance by pre-computing parts of the attack that are not specific to any public key. Once a public key appears in the mempool, the machine only needs about nine minutes to complete the task and derive the private key.
Given bitcoin's average confirmation time of 10 minutes, this gives the attacker roughly a 41% chance of deriving the key and redirecting the funds before the original transaction is confirmed. It's akin to a thief spending hours building a universal safe-cracking machine that works for any safe but requires only a few final adjustments for each new safe, a process that takes about nine minutes.
This is known as the mempool attack, which, although alarming, requires a quantum computer that does not yet exist. Google estimates such a machine would need fewer than 500,000 physical qubits, while today's largest quantum processors have around 1,000.
A more immediate concern is the 6.9 million bitcoin, roughly one-third of the total supply, that are already in wallets where the public key has been permanently exposed. This includes early bitcoin addresses that used a format called pay-to-public-key, where the public key is visible on the blockchain by default, and any wallet that has reused an address, since spending from an address reveals the public key for all remaining funds. These coins do not need the nine-minute race, as an attacker with a sufficiently powerful quantum computer could crack them at leisure without any time pressure.
The 2021 Taproot upgrade inadvertently made this worse by changing how addresses work so that public keys are visible on-chain by default, expanding the pool of wallets vulnerable to a future quantum attack. Although the bitcoin network itself would continue to function, as mining uses a different algorithm called SHA-256 that quantum computers cannot significantly speed up with current approaches, the ability to derive private keys from public keys would undermine the ownership guarantees that make bitcoin valuable. Anyone with exposed keys would be at risk of theft, and institutional trust in the network's security model would collapse. The solution lies in post-quantum cryptography, which replaces the vulnerable math with algorithms that quantum computers cannot crack.
While Ethereum has spent eight years working towards this migration, bitcoin has yet to start.