The Quantum Threat to Bitcoin: How a Powerful Computer Can Steal Your Cryptocurrency in Under 10 Minutes

This series began with an explanation of quantum computing's underlying physics. However, knowing how quantum computers work doesn't reveal how they can be used to steal bitcoin. To understand the threat, it's essential to grasp what a quantum computer is attacking, how bitcoin's security is structured, and where the vulnerability lies. This article delves into bitcoin's encryption, the nine-minute window a quantum computer needs to break it, as identified by Google's recent quantum computing paper. Bitcoin utilizes elliptic curve cryptography, which involves a one-way map. Each wallet has two keys: a private key, which is a secret 256-digit binary number, and a public key derived from the private key using a mathematical operation on the 'secp256k1' curve. This process can be thought of as taking a private number of steps on the curve, with the number of steps being the private key, and the endpoint being the public key. Anyone can verify the public key, but only the owner knows the private key. Technically, this is represented as K = k × G, where k is the private key, and K is the public key. The 'multiplication' here is not standard but a geometric operation that results in a seemingly random spot on the curve that only the specific private key could produce. The crucial property of this system is that going forward is easy, but going backward is virtually impossible for classical computers. If you know the private key and the generator point, calculating the public key takes milliseconds. However, if you know the public key and the generator point and want to find the private key, you're solving the elliptic curve discrete logarithm problem, which is estimated to take longer than the age of the universe for the best-known classical algorithms. This one-way trapdoor is the foundation of bitcoin's security model. Your private key proves ownership of your coins, and your public key is safe to share because classical computers cannot reverse the math. When sending bitcoin, your wallet uses the private key to create a digital signature, a mathematical proof that you know the secret number without revealing it. In 1994, mathematician Peter Shor discovered a quantum algorithm that breaks this trapdoor. Shor's algorithm efficiently solves the discrete logarithm problem, which classical computers cannot do in a reasonable timeframe. The algorithm works by converting the problem into finding the period of a function, which is exactly what quantum computers are designed for. By putting the input register into a superposition, representing all possible values simultaneously, and applying a quantum operation called the Fourier transform, the algorithm cancels out wrong answers and reinforces the correct ones. When measured, the result reveals the period, from which the private key can be easily recovered. This attack uses all three quantum properties: superposition evaluates the function on every possible input at once, entanglement links the input and output, and 'interference' filters out noise until only the answer remains. Despite Shor's algorithm being known for over 30 years, bitcoin remains secure because running the algorithm requires a quantum computer with a large enough number of stable qubits. Google's recent paper reduced the estimated number of qubits needed from millions to fewer than 500,000, a roughly 20-fold reduction. The team designed two quantum circuits that implement Shor's algorithm against bitcoin's specific elliptic curve, one using approximately 1,200 logical qubits and 90 million Toffoli gates, and the other using about 1,450 logical qubits and 70 million Toffoli gates. Because qubits lose their quantum state constantly, hundreds of redundant qubits are needed to maintain a single reliable logical qubit, reflecting the extensive self-babysitting infrastructure within a quantum computer. Google's paper introduced a practical attack scenario that changes how to think about the threat. Parts of Shor's algorithm that depend on the elliptic curve's fixed parameters can be precomputed, allowing the quantum computer to sit in a primed state, waiting for a target public key to appear. Once a public key is visible, the machine only needs to finish the second half of the calculation, which Google estimates takes about nine minutes. Given bitcoin's average block confirmation time of 10 minutes, a quantum attacker has roughly nine minutes to derive a private key and submit a competing transaction that redirects funds, with a 41% chance of succeeding before the original transaction confirms. This 'mempool attack' is alarming but requires a quantum computer that does not yet exist. The more significant concern is the 6.9 million bitcoin sitting in wallets where the public key has already been exposed on the blockchain, making them vulnerable to an 'at-rest' attack that requires no time constraint. A quantum computer running Shor's algorithm can turn a bitcoin public key into the private key that controls the coins, with significant implications for the security of the bitcoin network.