The Quantum Threat to Bitcoin: How Your Coins Can Be Stolen in Under 10 Minutes

The first part of this series delved into the physics behind quantum computing, explaining how these machines differ from regular computers. However, understanding the mechanics of quantum computers doesn't necessarily reveal how they can be used to steal bitcoin. To grasp this, it's essential to comprehend what quantum computers are attacking and where the weaknesses in bitcoin's security lie. This piece begins by examining bitcoin's encryption, leading up to the nine-minute window identified by Google's recent quantum computing paper, during which a quantum computer can potentially break bitcoin's encryption. Bitcoin utilizes a system called elliptic curve cryptography to verify ownership. Each wallet has two keys: a private key, which is a secret 256-digit binary number, and a public key derived from the private key through a mathematical operation on the 'secp256k1' curve. This process can be thought of as a one-way map, where starting from a known location on the curve, taking a certain number of steps defined by the curve's math leads to a public key. Anyone can verify the endpoint but not the number of steps taken to get there. Technically, this is represented as K = k × G, where k is the private key, and K is the public key. The 'multiplication' here is a geometric operation, not regular multiplication, where a point is repeatedly added to itself along the curve, resulting in a seemingly random spot that only the specific private key number k could produce. The critical property of this system is that moving forward is easy, but reversing the process is virtually impossible for classical computers. If you know k and G, calculating K takes milliseconds, but if you know K and G and want to find k, you're solving the elliptic curve discrete logarithm problem, which is estimated to take longer than the age of the universe for the best-known classical algorithms on a 256-bit curve. This one-way trapdoor is the foundation of bitcoin's security model. Your private key proves ownership of your coins, and your public key is safe to share because no classical computer can reverse the math. When sending bitcoin, your wallet uses the private key to create a digital signature, a mathematical proof that you know the secret number without revealing it. However, in 1994, mathematician Peter Shor discovered a quantum algorithm that can break this trapdoor. Shor's algorithm efficiently solves the discrete logarithm problem, handling in polynomial time what would take a classical computer an impractically long time. The intuition behind how it works relates to the three quantum properties discussed earlier: superposition, entanglement, and interference. The algorithm converts finding the private key k, given the public key K and the generator point G, into a problem of finding the period of a function. This function takes a number as input and returns a point on the elliptic curve. As you input sequential numbers, the outputs eventually repeat in a cycle, and the length of this cycle is the period. Once you know the period, the math of the discrete logarithm problem unravels, and the private key is almost immediately found. Finding this period is exactly what quantum computers are designed for. The algorithm puts its input register into a superposition, representing all possible values simultaneously, applies the function to all of them at once, and then applies a quantum operation called the Fourier transform, which causes the wrong answers to cancel out while reinforcing the correct ones. When you measure the result, the period appears, and from this period, ordinary math can recover k, which is your private key and thus controls your coins. The attack utilizes all three quantum tricks: superposition evaluates the function on every possible input at once, entanglement links the input and output so the results stay correlated, and interference filters the noise until only the answer remains. Despite Shor's algorithm being known for over 30 years, the reason bitcoin still works is that running the algorithm requires a quantum computer with a sufficiently large number of stable qubits to maintain coherence throughout the calculation. Building such a machine has been out of reach, but the question has always been how large is 'large enough.' Previous estimates suggested millions of physical qubits were needed, but a recent paper by Google's Quantum AI division, with contributions from Ethereum Foundation researcher Justin Drake and Stanford cryptographer Dan Boneh, reduced this number to fewer than 500,000, a roughly 20-fold reduction from prior estimates. The team designed two quantum circuits that implement Shor's algorithm against bitcoin's specific elliptic curve, one using approximately 1,200 logical qubits and 90 million Toffoli gates, and the other using about 1,450 logical qubits and 70 million Toffoli gates. A Toffoli gate is a type of gate that acts on three qubits, with two control qubits affecting the state of a third target qubit. Because qubits constantly lose their quantum state, hundreds of redundant qubits are needed to maintain a single reliable logical qubit, with most of a quantum computer existing to catch its own mistakes. The roughly 400-to-1 ratio between physical and logical qubits reflects the amount of the machine dedicated to self-babysitting infrastructure. Google's paper introduced a practical attack scenario that changes how we think about the threat. The parts of Shor's algorithm that depend only on the elliptic curve's fixed parameters, which are publicly known and identical for every bitcoin wallet, can be precomputed. The quantum computer can sit in a primed state, already halfway through the calculation, waiting for a target public key to appear. The moment a target public key is visible, whether broadcast in a transaction to the network's mempool or already exposed on the blockchain, the machine only needs to finish the second half of the calculation. Google estimates this second half takes about nine minutes. Since bitcoin's average block confirmation time is 10 minutes, a quantum attacker has roughly nine minutes to derive a private key and submit a competing transaction that redirects funds, giving them a roughly 41% chance of succeeding before the original transaction confirms. This is known as the mempool attack, which, although alarming, requires a quantum computer that does not yet exist. A more significant concern is the 6.9 million bitcoin, roughly one-third of the total supply, sitting in wallets where the public key has already been permanently exposed on the blockchain. These coins are vulnerable to an 'at-rest' attack that requires no race against the clock, as the attacker can take as long as needed. A quantum computer running Shor's algorithm can turn a bitcoin public key into the private key that controls the coins. For coins transacted since Taproot, a privacy upgrade on Bitcoin that went live in November 2021, the public key is already visible. For coins in older addresses, the public key is hidden until spent, at which point there's roughly a nine-minute window before the attacker can catch up. The practical implications of this, including which 6.9 million bitcoin are already exposed, what Taproot changed, and how fast the hardware is closing the gap, will be discussed in the next piece of this series.