The Quantum Threat to Bitcoin: How a Powerful Computer Can Steal Your Cryptocurrency

The first part of this series delved into the physics of quantum computing, explaining how these machines differ fundamentally from regular computers. However, understanding the inner workings of a quantum computer does not reveal how it can be used to steal bitcoin. To grasp this, one must comprehend what a quantum computer attacks and how the security of bitcoin is established. This piece begins by examining bitcoin's encryption, working through to the nine-minute window required to break it, as identified by Google's recent quantum computing paper. Bitcoin utilizes a system called elliptic curve cryptography to verify ownership. Each wallet has two keys: a private key, which is a secret number, and a public key derived from the private key through a mathematical operation. The relationship between the private and public keys can be thought of as a one-way map, where starting from a known point and taking a certain number of steps leads to the public key, but reversing this process is virtually impossible for classical computers. This one-way function is the cornerstone of bitcoin's security model. Your private key proves ownership of your coins, and your public key can be safely shared because no classical computer can reverse the math. When sending bitcoin, your wallet uses the private key to create a digital signature, proving knowledge of the secret number without revealing it. However, a quantum algorithm known as Shor's algorithm can break this one-way trapdoor. Discovered by mathematician Peter Shor in 1994, this algorithm efficiently solves the discrete logarithm problem, which would take a classical computer longer than the universe has existed. The intuition behind Shor's algorithm relates to the properties of quantum mechanics, including superposition, entanglement, and interference. These properties allow a quantum computer to evaluate a function on all possible inputs simultaneously, find the period of a function, and filter out wrong answers. The result is that a quantum computer can derive a private key from a public key, thereby gaining control over the associated bitcoin. Despite Shor's algorithm being known for over 30 years, running it has required a quantum computer with a large number of stable qubits, which has been out of reach. Google's recent paper reduced the estimated number of qubits needed from millions to fewer than 500,000, making the threat more tangible. The team designed quantum circuits that implement Shor's algorithm against bitcoin's specific elliptic curve, requiring approximately 1,200 to 1,450 logical qubits. Because qubits lose their quantum state constantly, hundreds of redundant qubits are needed to maintain a single reliable logical qubit. The paper introduced a practical attack scenario where parts of Shor's algorithm can be precomputed, allowing the quantum computer to sit in a primed state, waiting for a target public key to appear. Once a public key is visible, the machine only needs to finish the second half of the calculation, which Google estimates takes about nine minutes. This creates a window of opportunity for a quantum attacker to derive a private key and submit a competing transaction. The average block confirmation time for bitcoin is 10 minutes, giving the attacker a roughly 41% chance of succeeding before the original transaction confirms. This mempool attack is alarming but requires a quantum computer that does not yet exist. A more significant concern is the 6.9 million bitcoin, roughly one-third of the total supply, sitting in wallets where the public key has already been permanently exposed on the blockchain. These coins are vulnerable to an 'at-rest' attack, which can be executed without a time constraint. A quantum computer running Shor's algorithm can turn a bitcoin public key into the private key that controls the coins, posing a significant threat to the security of the bitcoin network.