The Quantum Threat to Bitcoin: How Your Cryptocurrency Could Be Stolen in Under 10 Minutes

The first part of this series explored the fundamental principles of quantum computing. However, understanding how quantum computers work is only half the story; the other half involves grasping what they can attack and how they can be used for malicious purposes, such as stealing bitcoin. This piece begins by examining bitcoin's encryption method, known as elliptic curve cryptography, which relies on a one-way function to ensure security. Every bitcoin wallet has a private key, a secret number, and a public key derived from the private key through a specific mathematical operation. The security of bitcoin hinges on the difficulty of reversing this process, a challenge known as the elliptic curve discrete logarithm problem, which is virtually impossible for classical computers but can be efficiently solved by a quantum algorithm known as Shor's algorithm. This algorithm exploits the unique properties of quantum mechanics, including superposition, entanglement, and interference, to find the private key given the public key and the generator point on the elliptic curve. The process involves converting the problem into finding the period of a function, which quantum computers can solve efficiently by applying the function to all possible inputs simultaneously and then using the Fourier transform to find the correct answer. The reason bitcoin remains secure for now is that running Shor's algorithm requires a quantum computer with a large number of stable qubits, which has been beyond current technological capabilities. However, a recent paper by Google's Quantum AI division, in collaboration with researchers from the Ethereum Foundation and Stanford, has significantly reduced the estimated number of qubits needed, from millions to fewer than 500,000. This reduction, coupled with the design of quantum circuits that can implement Shor's algorithm against bitcoin's specific elliptic curve, brings the threat of a quantum attack closer to reality. The paper also introduced a practical attack scenario, where parts of the calculation can be precomputed, allowing a quantum computer to sit in a primed state, ready to finish the calculation once a target public key appears. This scenario, known as the mempool attack, gives an attacker approximately nine minutes to derive a private key and submit a competing transaction, a timeframe that is alarming given bitcoin's average block confirmation time of 10 minutes. Furthermore, the paper estimates that the second half of the calculation, which depends on the target public key, can be completed in about nine minutes, giving the attacker a roughly 41% chance of succeeding before the original transaction confirms. A more significant concern, though, is the vulnerability of the 6.9 million bitcoin, roughly one-third of the total supply, that are sitting in wallets where the public key has already been exposed on the blockchain. These coins are at risk of an 'at-rest' attack, which does not require racing against the clock and can be executed at the attacker's leisure. The implications of these findings, including the impact of Taproot, a privacy upgrade on Bitcoin, and the pace at which quantum hardware is advancing, will be explored in the final piece of this series.