How Quantum Computers Can Compromise Bitcoin Security in Under 10 Minutes

Part 1 of this series delved into the basics of quantum computing, exploring how it differs from classical computing. However, understanding the mechanics of quantum computers doesn't directly reveal how they can be used to steal bitcoin. To grasp this, it's essential to comprehend what quantum computers are attacking, the nature of bitcoin's security, and where its weaknesses lie. This piece begins by examining bitcoin's encryption, leading up to the critical nine-minute window identified by Google's recent quantum computing paper. Bitcoin utilizes elliptic curve cryptography to verify ownership. Each wallet contains two keys: a private key, which is a secret 256-digit binary number, and a public key derived from the private key through a mathematical operation on the secp256k1 curve. This process can be thought of as a one-way map, where starting from a known point (generator point G), taking a series of steps defined by the curve's mathematics leads to a public key (point K). Anyone can verify the public key, but determining the private key is virtually impossible for classical computers. Technically, this is represented as K = k × G, where k is the private key and K is the public key, with the multiplication being a geometric operation along the curve. The crucial aspect is that moving forward is straightforward, but reversing the process is effectively impossible for classical computers. If you know k and G, calculating K is quick, but if you know K and G and want to find k, you're solving the elliptic curve discrete logarithm problem, which classical algorithms estimate would take longer than the universe's age for a 256-bit curve. This one-way trapdoor is the foundation of bitcoin's security model. Your private key proves ownership, and your public key is safe to share because classical computers can't reverse the math. When sending bitcoin, your wallet uses the private key to create a digital signature, proving you know the secret without revealing it. Shor's algorithm, discovered in 1994, breaks this trapdoor by solving the discrete logarithm problem efficiently. It converts finding the private key k, given the public key K and generator point G, into finding the period of a function. This function takes a number and returns a point on the elliptic curve, and as you input sequential numbers, the outputs eventually repeat in a cycle. The length of this cycle is the period, and once known, the discrete logarithm problem's math unravels, and the private key is found almost immediately. Finding this period is what quantum computers are designed for. The algorithm puts its input into a superposition, representing all possible values simultaneously, applies the function to all inputs at once, and then applies a quantum operation called the Fourier transform. This causes incorrect answers to cancel out, reinforcing the correct ones. When measured, the period appears, and from this period, ordinary math recovers k, which is the private key and thus controls the coins. The attack utilizes all three quantum properties: superposition evaluates the function on every possible input, entanglement correlates the input and output, and interference filters noise until only the answer remains. Despite Shor's algorithm being known for over 30 years, running it requires a quantum computer with enough stable qubits to maintain coherence throughout the calculation. Google's paper significantly reduced the estimated number of qubits needed, from millions to fewer than 500,000, a roughly 20-fold reduction. The team designed quantum circuits implementing Shor's algorithm against bitcoin's specific elliptic curve, one using approximately 1,200 logical qubits and 90 million Toffoli gates, the other using 1,450 logical qubits and 70 million Toffoli gates. Because qubits constantly lose their quantum state, hundreds of redundant qubits are needed to maintain a single reliable logical qubit, reflecting the machine's self-babysitting infrastructure. Google's paper introduced a practical attack scenario, where parts of Shor's algorithm depending on the elliptic curve's fixed parameters can be precomputed, leaving the quantum computer in a primed state. Upon a target public key appearing, the machine only needs to finish the second half of the calculation, estimated to take about nine minutes. Given bitcoin's average block confirmation time of 10 minutes, a quantum attacker has roughly nine minutes to derive a private key and submit a competing transaction, with a 41% chance of succeeding before the original transaction confirms. This mempool attack requires a quantum computer that does not yet exist. However, a more significant concern is the 6.9 million bitcoin in wallets where the public key has been permanently exposed on the blockchain, making them vulnerable to an at-rest attack that doesn't require racing against the clock. A quantum computer running Shor's algorithm can turn a bitcoin public key into the controlling private key. For coins transacted since Taproot, the public key is visible, and for coins in older addresses, the public key is hidden until spent, at which point there's a nine-minute window before an attacker can catch up.