The Quantum Threat to Bitcoin: How a Quantum Computer Can Steal Your Cryptocurrency in Under 10 Minutes

The first part of this series delved into the physics behind quantum computing, explaining how these machines differ from classical computers. However, understanding the inner workings of a quantum computer doesn't provide insight into how it can be used to steal bitcoin. To grasp this, one must comprehend what a quantum computer is attacking, how bitcoin's security is structured, and where the weakness lies. This piece begins with an examination of bitcoin's encryption, walking through the process to the point where it can be broken in approximately nine minutes, as identified by Google's recent quantum computing paper. Bitcoin utilizes a system called elliptic curve cryptography to verify ownership. Each wallet has two keys: a private key, which is a secret number, and a public key derived from the private key through a mathematical operation on the 'secp256k1' curve. This can be thought of as a one-way map, where starting from a known location, taking a certain number of steps defined by the curve's math leads to a public key. Anyone can verify the endpoint but not the number of steps taken. Technically, this is represented as K = k × G, where k is the private key and K is the public key. The 'multiplication' here is a geometric operation, not regular multiplication, where a point is repeatedly added to itself along the curve, landing on a spot that seems random but is uniquely determined by k. The crucial aspect is that moving forward is easy, but reversing the process is virtually impossible for classical computers. If you know k and G, calculating K takes milliseconds, but if you know K and G and want to find k, you're solving the elliptic curve discrete logarithm problem, which is estimated to take longer than the age of the universe for the best-known classical algorithms on a 256-bit curve. This one-way trapdoor is the foundation of bitcoin's security model. Your private key proves ownership, and your public key is safe to share because classical computers can't reverse the math. When sending bitcoin, your wallet uses the private key to create a digital signature, proving you know the secret without revealing it. However, Shor's algorithm, discovered in 1994, breaks this trapdoor by solving the discrete logarithm problem efficiently. It converts finding the private key k, given the public key K and the generator point G, into finding the period of a function. This function takes a number as input and returns a point on the elliptic curve. As you input sequential numbers, the outputs eventually repeat in a cycle, and knowing this cycle's length unravels the discrete logarithm problem. Quantum computers are ideal for finding this period. The algorithm puts its input into a superposition, representing all possible values simultaneously, applies the function to all of them, and then applies the Fourier transform, which cancels out wrong answers and reinforces correct ones. When measured, the period appears, from which ordinary math can recover k, thus obtaining the private key and control over the coins. This attack utilizes all three quantum properties: superposition evaluates the function on every input at once, entanglement correlates the input and output, and interference filters noise until only the answer remains. Despite Shor's algorithm being known for over 30 years, running it requires a quantum computer with enough stable qubits to maintain coherence throughout the calculation. Google's paper reduced the estimated number of required qubits from millions to fewer than 500,000, a 20-fold reduction. The team designed quantum circuits implementing Shor's algorithm against bitcoin's elliptic curve, using approximately 1,200 and 1,450 logical qubits, respectively. Because qubits constantly lose their quantum state, hundreds of redundant qubits are needed to maintain a single reliable logical qubit, reflecting the extensive self-babysitting infrastructure within a quantum computer. Google's paper introduced a practical attack scenario, changing the threat perspective. Parts of Shor's algorithm depending on the elliptic curve's fixed parameters can be precomputed, allowing the quantum computer to sit in a primed state, halfway through the calculation. When a target public key appears, the machine only needs to finish the second half, estimated to take about nine minutes. Given bitcoin's average block confirmation time of 10 minutes, an attacker has roughly nine minutes to derive a private key and submit a competing transaction. This gives the attacker a 41% chance of succeeding before the original transaction confirms. While this 'mempool attack' is alarming, it requires a quantum computer that does not yet exist. A more significant concern is the 6.9 million bitcoin (about one-third of the total supply) in wallets where the public key has been exposed on the blockchain, making them vulnerable to an 'at-rest' attack that doesn't race against the clock. A quantum computer running Shor's algorithm can turn a bitcoin public key into the private key, controlling the coins. For coins transacted since Taproot, the public key is already visible, and for coins in older addresses, the public key is hidden until spent, at which point there's a nine-minute window before an attacker can catch up.