The Quantum Threat to Bitcoin: How Your Coins Can Be Stolen in Under 10 Minutes

The first part of this series delved into the principles of quantum computing, but understanding how it works is not enough to grasp the risks it poses to bitcoin. To comprehend the threat, it's essential to know how bitcoin's security is designed and where its weaknesses lie. This article starts by examining bitcoin's encryption system, which relies on elliptic curve cryptography to verify ownership. Each wallet has a private key, a 256-digit binary number, and a public key derived from it using a mathematical operation on the 'secp256k1' curve. The relationship between the private and public keys is a one-way function, making it easy to generate a public key from a private key but virtually impossible for classical computers to do the reverse. This one-way function is the foundation of bitcoin's security model, as it allows users to prove ownership without revealing their private key. However, the discovery of Shor's algorithm by mathematician Peter Shor in 1994 introduced a quantum approach that can efficiently break this one-way function. Shor's algorithm exploits the properties of quantum mechanics, such as superposition, entanglement, and interference, to solve the discrete logarithm problem that underlies bitcoin's encryption. By converting the problem into finding the period of a function, the algorithm can use quantum parallelism to evaluate the function for all possible inputs simultaneously and then apply a Fourier transform to find the correct period. This process allows the algorithm to derive the private key from the public key, effectively breaking the encryption. The reason bitcoin remains secure for now is that running Shor's algorithm requires a quantum computer with a large number of stable qubits. Recent research by Google has significantly reduced the estimated number of qubits needed, from millions to fewer than 500,000. The study designed two quantum circuits that implement Shor's algorithm against bitcoin's specific elliptic curve, one using approximately 1,200 logical qubits and the other using about 1,450 logical qubits. The introduction of a practical attack scenario by Google's paper changes the perspective on the threat. Parts of Shor's algorithm can be precomputed, allowing the quantum computer to sit in a primed state, waiting for a target public key to appear. Once a public key is exposed, the machine only needs to finish the second half of the calculation, which Google estimates takes about nine minutes. This creates a 'nine-minute window' during which a quantum attacker could derive a private key and submit a competing transaction to redirect funds. The average block confirmation time in bitcoin is 10 minutes, giving the attacker a roughly 41% chance of succeeding. While this 'mempool attack' is alarming, it requires a quantum computer that does not yet exist. A more significant concern is the approximately 6.9 million bitcoin (about one-third of the total supply) that are vulnerable to an 'at-rest' attack because their public keys have already been exposed on the blockchain. These coins can be targeted without any time constraint, as the attacker can take as long as needed to derive the private key. The implications of this vulnerability and the rapid progress in quantum computing hardware will be explored in the final piece of this series.