How Quantum Computing Poses a Threat to Bitcoin Security in Under 10 Minutes

Part 1 of this series explored the fundamental principles of quantum computing, distinguishing it from classical computing. However, understanding how quantum computers work is only half the story; the other half involves grasping what they can attack and how. This piece focuses on bitcoin's security, specifically its use of elliptic curve cryptography, and how a quantum algorithm can potentially break this encryption. Bitcoin's security is based on a one-way function, where a private key (a secret number) is used to generate a public key through a mathematical operation on the elliptic curve 'secp256k1'. This process is easy to perform in one direction but virtually impossible to reverse with classical computers, due to the elliptic curve discrete logarithm problem. The security of bitcoin transactions relies on this principle, as only the owner of the private key can create a digital signature to spend the coins. However, in 1994, Peter Shor discovered a quantum algorithm that can efficiently solve the discrete logarithm problem, potentially breaking bitcoin's encryption. This algorithm exploits the properties of quantum mechanics, such as superposition, entanglement, and interference, to find the period of a function related to the elliptic curve. Knowing this period allows for the easy recovery of the private key. The reason bitcoin remains secure for now is that implementing Shor's algorithm requires a quantum computer with a large number of stable qubits. Recent research by Google, in collaboration with the Ethereum Foundation and Stanford University, has significantly reduced the estimated number of qubits needed, from millions to fewer than 500,000. This reduction, and the introduction of a practical attack scenario, changes the perspective on the quantum threat to bitcoin. The scenario involves precomputing parts of Shor's algorithm that depend on the elliptic curve's fixed parameters, allowing a quantum computer to sit in a primed state. Once a target public key is identified, the machine only needs to complete the second half of the calculation, which Google estimates takes about nine minutes. This timeframe is critical because it's just below bitcoin's average block confirmation time of 10 minutes. An attacker has a roughly 41% chance of deriving a private key and submitting a competing transaction before the original transaction confirms. While this 'mempool attack' is alarming, it requires a quantum computer that does not yet exist. A more pressing concern is the approximately 6.9 million bitcoin (about one-third of the total supply) in wallets where the public key has been exposed on the blockchain. These coins are vulnerable to an 'at-rest' attack, where an attacker can take as long as needed to derive the private key. The implications of these findings, especially considering the recent Taproot upgrade and the pace at which quantum hardware is advancing, will be explored in the next part of this series.