The Quantum Threat to Bitcoin: How Your Coins Can Be Stolen in Under 10 Minutes

The first part of this series explored the fundamental principles of quantum computing, introducing the concept of a new kind of machine that leverages the unique rules of physics at the atomic and particle level. However, understanding the inner workings of a quantum computer does not directly explain how it can be utilized to steal bitcoin. To grasp this, one must comprehend the target of the attack - how bitcoin's security is structured, why a quantum algorithm can compromise it, and the implications of Google's recent research on the timeline of such an attack. This piece begins by examining bitcoin's encryption, tracing the path to the nine-minute window identified by Google's paper for breaking it. Bitcoin employs elliptic curve cryptography to verify ownership, with each wallet possessing two keys: a private key, which is a secret 256-digit binary number, and a public key derived from the private key through a mathematical operation on the secp256k1 curve. This can be visualized as a one-way map, where starting from a known location (the generator point G), taking a private number of steps leads to a public key. Anyone can confirm the endpoint but not the number of steps taken to get there. Technically, this is represented as K = k × G, where k is the private key and K is the public key, with 'multiplication' being a geometric operation along the curve. The crucial aspect is that moving forward is straightforward, but reversing the process is virtually impossible for classical computers. If one knows k and G, calculating K is effortless, but if one knows K and G and seeks to find k, they face the elliptic curve discrete logarithm problem, which classical algorithms estimate would take longer than the universe's age to solve for a 256-bit curve. This one-way trapdoor is the backbone of bitcoin's security model. Your private key confirms your ownership, and your public key is safe to share since classical computers cannot reverse the math. When sending bitcoin, your wallet uses the private key to create a digital signature, proving knowledge of the secret number without revealing it. However, Shor's algorithm, discovered in 1994, breaks this trapdoor by solving the discrete logarithm problem efficiently. It converts finding the private key k, given the public key K and generator point G, into finding the period of a function. This is where quantum computers excel, as they can put their input register into a superposition, representing all possible values simultaneously, apply the function, and then use the Fourier transform to cancel out wrong answers and reinforce correct ones. The period, and thus the private key, is revealed upon measurement. This process utilizes all three quantum properties: superposition evaluates the function on every input at once, entanglement correlates inputs and outputs, and interference filters out noise. Despite Shor's algorithm being known for over 30 years, bitcoin remains secure because running the algorithm requires a quantum computer with a sufficiently large number of stable qubits. Google's recent paper reduced the estimated number of qubits needed from millions to fewer than 500,000, introducing a practical attack scenario. The parts of Shor's algorithm that depend on the elliptic curve's fixed parameters can be precomputed, allowing the quantum computer to sit in a primed state, waiting for a target public key to appear. Google estimates the second half of the calculation takes about nine minutes, which is significant given bitcoin's average block confirmation time of 10 minutes. This means a quantum attacker has roughly nine minutes to derive a private key and submit a competing transaction. The math gives the attacker about a 41% chance of succeeding before the original transaction confirms. While this 'mempool attack' is alarming, it requires a quantum computer that does not yet exist. A more pressing concern is the 6.9 million bitcoin (about one-third of the total supply) in wallets where the public key has been exposed on the blockchain, making them vulnerable to an 'at-rest' attack that does not race against the clock. A quantum computer running Shor's algorithm can turn a bitcoin public key into the private key controlling the coins. For coins transacted since the Taproot upgrade, the public key is already visible, while for coins in older addresses, the public key is hidden until spent, at which point there's roughly a nine-minute window before an attacker can catch up.