The Quantum Threat to Bitcoin: How Your Cryptocurrency Could Be Stolen in Under 10 Minutes

The first part of this series explored the principles of quantum computing, introducing the concept of a fundamentally different kind of machine that leverages the unique rules of physics at the atomic and particle level. However, understanding how quantum computers work doesn't directly reveal how they can be used to steal bitcoin. To grasp this, it's essential to understand what a quantum computer attacks and how the security of bitcoin is constructed, including the specific vulnerabilities it may have. This piece begins by examining bitcoin's encryption, walking through the process to the point where it can be broken, as highlighted by Google's recent quantum computing research, within a nine-minute window. Bitcoin utilizes a system called elliptic curve cryptography to verify ownership. Each wallet has two keys: a private key, which is a secret 256-digit binary number, and a public key derived from the private key through a mathematical operation on the 'secp256k1' curve. This can be thought of as a one-way map where starting from a known point on the curve, taking a certain number of steps defined by the curve's mathematics leads to a public key. Anyone can verify the endpoint but not the number of steps taken to get there. Technically, this is expressed as K = k * G, where k is the private key, and K is the public key, with the multiplication being a geometric operation along the curve. The result is a seemingly random spot that only the specific number k could produce. A critical property of this system is that moving forward is easy, but reversing the process, for classical computers, is effectively impossible. If you know k and G, calculating K takes milliseconds, but if you know K and G and want to find k, you're solving the elliptic curve discrete logarithm problem, which is estimated to take longer than the age of the universe for the best-known classical algorithms on a 256-bit curve. This one-way trapdoor is the foundation of bitcoin's security model. Your private key proves ownership of your coins, and your public key is safe to share because no classical computer can reverse the math. When sending bitcoin, your wallet uses the private key to create a digital signature, a mathematical proof that you know the secret number without revealing it. However, Shor's algorithm, discovered in 1994, breaks this trapdoor by solving the discrete logarithm problem efficiently. The algorithm converts finding the private key k, given the public key K and the generator point G, into a problem of finding the period of a function that takes a number as input and returns a point on the elliptic curve. As you input sequential numbers, the outputs eventually repeat in a cycle, and knowing this cycle's length unravels the discrete logarithm problem. Finding this period is exactly what quantum computers are designed for. They put their input register into a superposition, representing all possible values simultaneously, apply the function to all of them at once, and then apply a quantum operation called the Fourier transform, which cancels out wrong answers and reinforces correct ones. When you measure the result, the period appears, from which ordinary math can recover k, the private key, and thus control of the coins. The attack utilizes all three quantum properties: superposition evaluates the function on every possible input at once, entanglement links the input and output, and interference filters the noise until only the answer remains. Despite Shor's algorithm being known for over 30 years, running it has required a quantum computer with a large enough number of stable qubits to maintain coherence throughout the calculation, which has been beyond reach. However, Google's paper reduced the estimated number of qubits needed from millions to fewer than 500,000, a roughly 20-fold reduction. The team designed quantum circuits that implement Shor's algorithm against bitcoin's specific elliptic curve, using approximately 1,200 and 1,450 logical qubits, respectively. Because qubits constantly lose their quantum state, hundreds of redundant qubits are needed to maintain a single reliable logical qubit, with most of the quantum computer serving as self-babysitting infrastructure. Google's paper introduced a practical attack scenario, changing how to think about the threat. Parts of Shor's algorithm that depend on the elliptic curve's fixed parameters can be precomputed, allowing the quantum computer to sit in a primed state, halfway through the calculation. When a target public key appears, the machine only needs to finish the second half, which Google estimates takes about nine minutes. Given that bitcoin's average block confirmation time is 10 minutes, an attacker has roughly nine minutes to derive a private key and submit a competing transaction, with a 41% chance of succeeding. This 'mempool attack' is alarming but requires a quantum computer that does not yet exist. A more significant concern is the 6.9 million bitcoin (about one-third of the total supply) in wallets where the public key has been permanently exposed on the blockchain, making them vulnerable to an 'at-rest' attack that requires no time constraint. A quantum computer running Shor's algorithm can turn a bitcoin public key into the private key that controls the coins, with implications for both coins transacted since Taproot and those in older addresses.