The Quantum Threat to Bitcoin: How a Powerful Computer Can Steal Your Cryptocurrency in Under 10 Minutes

The first part of this series delved into the physics behind quantum computing, explaining how these machines differ fundamentally from classical computers. However, understanding the inner workings of a quantum computer doesn't reveal how it can be exploited to steal bitcoin. To grasp this, one must comprehend the target: the encryption mechanism used by bitcoin and how a quantum algorithm can compromise it. This piece will explore bitcoin's encryption, why a quantum algorithm can break it, and the implications of Google's recent paper on the timeline of this threat. Bitcoin utilizes elliptic curve cryptography to verify ownership. Each wallet has a private key, a secret 256-digit binary number, and a public key derived from the private key through a mathematical operation on the secp256k1 curve. This process can be thought of as a one-way map, where starting from a known point (the generator point G), taking a certain number of steps defined by the curve's mathematics leads to a public key. Anyone can confirm the public key's location on the curve but cannot determine the number of steps (the private key) taken to get there. Technically, this is represented as K = k × G, where k is the private key and K is the public key. The 'multiplication' here is a geometric operation, not regular multiplication, where a point is repeatedly added to itself along the curve, resulting in a seemingly random spot on the curve that corresponds to the specific private key k. The crucial aspect of this system is that while moving forward (from private to public key) is straightforward, reversing the process (from public to private key) is virtually impossible for classical computers. This is known as the elliptic curve discrete logarithm problem. It's estimated that the best classical algorithms for solving this problem on a 256-bit curve would take longer than the age of the universe. This one-way trapdoor is the foundation of bitcoin's security model. Your private key proves ownership, and your public key can be safely shared because no classical computer can reverse the math. When sending bitcoin, your wallet uses the private key to create a digital signature, a mathematical proof that you know the secret number without revealing it. However, in 1994, mathematician Peter Shor discovered a quantum algorithm that can break this trapdoor. Shor's algorithm solves the discrete logarithm problem efficiently, handling in polynomial time what would take a classical computer an impractically long time. The intuition behind Shor's algorithm relates to the three quantum properties discussed earlier: superposition, entanglement, and interference. The algorithm converts the problem of finding the private key k, given the public key K and the generator point G, into finding the period of a function. This function takes a number as input and returns a point on the elliptic curve. By feeding it sequential numbers, the outputs eventually repeat in a cycle, and the length of this cycle (the period) allows the math of the discrete logarithm problem to be unraveled in a single step, revealing the private key. Finding this period is exactly what quantum computers are designed for. They put their input register into a superposition, representing all possible values simultaneously, apply the function to all of them at once, and then apply a quantum operation called the Fourier transform. This causes the wrong answers to cancel out while the correct answers are reinforced. When the result is measured, the period appears, from which ordinary math can recover k, the private key, and thus control over the bitcoin. This attack uses all three quantum properties: superposition to evaluate the function on every possible input at once, entanglement to link the input and output so results stay correlated, and interference to filter out noise until only the answer remains. Despite Shor's algorithm being known for over 30 years, bitcoin remains secure because running the algorithm requires a quantum computer with a large enough number of stable qubits to maintain coherence throughout the calculation. The question has always been how large is 'large enough.' Previous estimates suggested millions of physical qubits, but a recent paper by Google's Quantum AI division reduced this number to fewer than 500,000, a roughly 20-fold reduction. The team designed two quantum circuits that implement Shor's algorithm against bitcoin's specific elliptic curve, one using approximately 1,200 logical qubits and 90 million Toffoli gates, and the other using about 1,450 logical qubits and 70 million Toffoli gates. A Toffoli gate acts on three qubits, with two control qubits affecting the state of a third target qubit. Due to qubits constantly losing their quantum state, hundreds of redundant qubits are needed to maintain a single reliable logical qubit, explaining the high ratio of physical to logical qubits. Google's paper introduced a practical attack scenario that changes the perspective on the threat. Parts of Shor's algorithm that depend only on the elliptic curve's fixed parameters can be precomputed, allowing the quantum computer to sit in a primed state, halfway through the calculation, waiting for a target public key to appear. Once a public key is broadcast or exposed on the blockchain, the machine only needs to finish the second half of the calculation, which Google estimates takes about nine minutes. Since bitcoin's average block confirmation time is 10 minutes, an attacker has roughly nine minutes to derive a private key and submit a competing transaction. This gives the attacker a 41% chance of succeeding before the original transaction confirms. Although this 'mempool attack' is alarming, it requires a quantum computer that does not yet exist. A more significant concern is the 6.9 million bitcoin (about one-third of the total supply) in wallets where the public key has already been permanently exposed on the blockchain, making them vulnerable to an 'at-rest' attack that can be conducted without time pressure. A quantum computer running Shor's algorithm can turn a bitcoin public key into the controlling private key. For coins transacted since the Taproot upgrade, the public key is already visible, while for coins in older addresses, the public key is hidden until spent, at which point the owner has roughly nine minutes before an attacker can catch up.