The Quantum Threat to Bitcoin: How Your Cryptocurrency Could Be Stolen in Under 10 Minutes

The first part of this series explored the fundamental principles of quantum computing. However, understanding the inner workings of a quantum computer does not directly reveal how it could be utilized to steal bitcoin. To grasp this, one must comprehend the target of the attack: the security framework of bitcoin, why quantum algorithms can breach it, and the implications of Google's recent research on the timeline. This piece begins by examining bitcoin's encryption method and proceeds to explain the nine-minute window required to break it, as outlined in Google's quantum computing paper. Bitcoin employs elliptic curve cryptography to verify ownership. Each wallet has a pair of keys: a private key, which is a secret 256-digit binary number, and a public key derived from the private key through a mathematical operation on the secp256k1 curve. This can be visualized as a one-way map, where starting from a known point on the curve, taking a certain number of steps defined by the curve's mathematics leads to the public key. Anyone can verify the endpoint, but determining the number of steps taken (the private key) is virtually impossible for classical computers. This one-way function is the backbone of bitcoin's security model. Your private key proves ownership, and your public key is safe to share because classical computers cannot reverse the mathematics. When sending bitcoin, your wallet uses the private key to create a digital signature, proving knowledge of the secret number without revealing it. However, Shor's algorithm, discovered in 1994, opens this one-way door both ways. It efficiently solves the discrete logarithm problem, which classical computers cannot. The intuition behind Shor's algorithm relies on the properties of quantum mechanics: superposition, entanglement, and interference. By converting the problem into finding the period of a function and utilizing quantum operations like the Fourier transform, the algorithm can find the private key. The reason bitcoin remains secure is that running Shor's algorithm requires a quantum computer with a sufficient number of stable qubits. Recent estimates by Google, in collaboration with the Ethereum Foundation and Stanford cryptographers, have significantly reduced the number of qubits needed, from millions to fewer than 500,000. They designed quantum circuits that implement Shor's algorithm against bitcoin's elliptic curve, requiring approximately 1,200 to 1,450 logical qubits. Because qubits lose their quantum state, redundant qubits are needed to maintain a single reliable logical qubit, reflecting the extensive self-babysitting infrastructure within a quantum computer. Google's paper introduced a practical attack scenario, where parts of Shor's algorithm can be precomputed, leaving the quantum computer in a primed state, waiting for a target public key. Upon encountering a public key, the machine only needs to complete the second half of the calculation, estimated to take about nine minutes. Given bitcoin's average block confirmation time of 10 minutes, an attacker has roughly nine minutes to derive a private key and submit a competing transaction. This presents a 41% chance of succeeding before the original transaction confirms. While this 'mempool attack' is alarming, it requires a quantum computer that does not yet exist. A more significant concern is the 6.9 million bitcoin (about one-third of the total supply) in wallets where the public key has been permanently exposed on the blockchain, making them vulnerable to an 'at-rest' attack with no time constraint. A quantum computer running Shor's algorithm can turn a public key into a private key, controlling the coins. For coins transacted since the Taproot upgrade, the public key is visible, while for older addresses, the public key is hidden until spent, leaving a nine-minute window before an attacker can catch up.