The Quantum Threat to Bitcoin: How a Powerful Computer Can Steal Your Cryptocurrency in Under 10 Minutes

The first part of this series delved into the physics of quantum computing, explaining how these machines differ fundamentally from regular computers. However, understanding the mechanics of quantum computers doesn't reveal how they can be used to steal bitcoin. To grasp this, it's essential to comprehend what quantum computers are attacking and where the vulnerabilities in bitcoin's security lie. This piece begins with an examination of bitcoin's encryption, leading up to the recently identified nine-minute window it takes for a quantum computer to break it, as outlined in Google's quantum computing paper. Bitcoin utilizes elliptic curve cryptography to verify ownership, with each wallet having a private key and a public key derived from it through a mathematical operation on the 'secp256k1' curve. The process can be thought of as a one-way map, where starting from a known point, taking a certain number of steps defined by the curve's math leads to a public key. Anyone can confirm the endpoint but not the number of steps taken to get there. Technically, this is represented as K = k × G, where k is the private key, and K is the public key, with the 'multiplication' being a geometric operation along the curve. The critical aspect is that moving forward is straightforward, but reversing the process is virtually impossible for classical computers. If you know k and G, calculating K is quick, but if you know K and G and want to find k, you're solving the elliptic curve discrete logarithm problem, which classical algorithms would take longer than the age of the universe to solve for a 256-bit curve. This one-way trapdoor is the foundation of bitcoin's security model. Your private key is proof of ownership, and your public key is safe to share because classical computers can't reverse the math. When sending bitcoin, your wallet uses the private key to create a digital signature, proving you know the secret without revealing it. However, Shor's algorithm, discovered in 1994, breaks this trapdoor by solving the discrete logarithm problem efficiently. It converts finding the private key k, given the public key K and the generator point G, into finding the period of a function that repeats in a cycle. Quantum computers are ideal for this task, as they can put their input register into a superposition, representing all possible values simultaneously, apply the function to all inputs at once, and then use a Fourier transform to cancel out wrong answers and reinforce the correct ones. When the result is measured, the period appears, from which ordinary math can recover k, thus obtaining the private key and control over the coins. The attack utilizes all three quantum properties: superposition evaluates the function on every possible input at once, entanglement links the input and output, and interference filters out noise until only the answer remains. Bitcoin still functions today because running Shor's algorithm requires a quantum computer with a large enough number of stable qubits to maintain coherence throughout the calculation. Google's paper reduced the estimated number of physical qubits needed from millions to fewer than 500,000, a 20-fold reduction. The team designed quantum circuits that implement Shor's algorithm against bitcoin's elliptic curve, using approximately 1,200 and 1,450 logical qubits, respectively. Because qubits constantly lose their quantum state, hundreds of redundant qubits are needed to maintain a single reliable logical qubit, with most of the quantum computer serving as infrastructure to catch and correct its own mistakes. Google's paper introduced a practical attack scenario, where parts of Shor's algorithm that depend on the elliptic curve's fixed parameters can be precomputed, allowing the quantum computer to sit in a primed state, waiting for a target public key to appear. The moment it does, the machine only needs to finish the second half of the calculation, which Google estimates takes about nine minutes. Given that bitcoin's average block confirmation time is 10 minutes, a quantum attacker has roughly nine minutes to derive a private key and submit a competing transaction. This gives the attacker a 41% chance of succeeding before the original transaction confirms. While this 'mempool attack' is alarming, it requires a quantum computer that does not yet exist. A more significant concern is the 6.9 million bitcoin already vulnerable to an 'at-rest' attack, where the public key has been permanently exposed on the blockchain, and a quantum computer running Shor's algorithm can derive the private key without any time constraint.