The Quantum Threat to Bitcoin: How a Powerful Computer Can Steal Your Cryptocurrency in Under 10 Minutes

The first part of this series delved into the physics of quantum computing, explaining how these machines differ fundamentally from regular computers by exploiting the unique rules of physics at the atomic and particle level. However, understanding the mechanics of quantum computers doesn't directly reveal how they can be used to steal bitcoin. To grasp this, one must comprehend what quantum computers are attacking - the security framework of bitcoin - and where its vulnerabilities lie. This piece begins by examining bitcoin's encryption method, known as elliptic curve cryptography, which is used to verify ownership. Each bitcoin wallet has two keys: a private key, which is a secret 256-digit binary number, and a public key derived from the private key through a mathematical operation on the "secp256k1" curve. This process can be thought of as a one-way map, where starting from a known point on the curve, taking a certain number of steps defined by the curve's mathematics leads to a public key. Anyone can verify the public key, but determining the number of steps (the private key) is virtually impossible for classical computers due to the elliptic curve discrete logarithm problem. It's estimated that solving this problem for a 256-bit curve with the best-known classical algorithms would take longer than the age of the universe. This one-way function is the cornerstone of bitcoin's security model, allowing the private key to prove ownership without being revealed. When sending bitcoin, the wallet uses the private key to create a digital signature, proving knowledge of the secret number without exposing it. The breakthrough of Peter Shor in 1994 introduced a quantum algorithm that can efficiently solve the discrete logarithm problem, potentially breaking bitcoin's security. Shor's algorithm works by converting the problem into finding the period of a function related to the elliptic curve, which is a task well-suited for quantum computers. By applying the principles of superposition, entanglement, and interference, a quantum computer can find the period of the function, which then allows for the easy recovery of the private key. Despite Shor's algorithm being known for over 30 years, the reason it hasn't been used to compromise bitcoin is the requirement for a quantum computer with a large number of stable qubits. Recent developments, including a paper by Google's Quantum AI division, have significantly lowered the estimated number of qubits needed, from millions to fewer than 500,000. This reduction makes the threat more tangible. The Google paper also proposed a practical attack scenario where parts of Shor's algorithm can be precomputed, leaving the quantum computer in a state ready to finish the calculation once a target public key is identified. This could potentially give an attacker a nine-minute window to derive a private key and submit a competing transaction, especially if the target public key is exposed in the mempool or has been previously used. The average block confirmation time of 10 minutes means an attacker has a roughly 41% chance of succeeding before the original transaction is confirmed. While this 'mempool attack' is alarming, it requires a quantum computer that does not yet exist. A more pressing concern is the approximately 6.9 million bitcoin (about one-third of the total supply) that are in wallets where the public key has already been exposed on the blockchain, making them vulnerable to an 'at-rest' attack that doesn't race against the clock. For coins transacted since the Taproot upgrade, the public key is visible, and for older addresses, the key is hidden until spent, at which point the nine-minute window begins. The practical implications of these findings, including which 6.9 million bitcoin are exposed and how Taproot affects them, as well as the pace at which quantum hardware is advancing, will be the subject of the next piece in this series.