Insider Brief
- Quantum computing could eventually threaten cryptocurrency networks that rely on elliptic curve cryptography, including Bitcoin and Ethereum, as researchers continue to reduce estimated attack requirements.
- The quantum risk for cryptocurrencies differs from traditional encryption threats because attackers could potentially derive private keys during transaction confirmation windows through on-spend attacks.
- The cryptocurrency ecosystem is exploring post-quantum migration approaches, but technical upgrades remain challenging due to decentralized governance and blockchain design constraints.
Quantum computers and encryption debates normally revolve around governmental communications, banking systems, or healthcare data. The role of cryptocurrencies remains underexamined; however, a Google Quantum AI paper released in March 2026 hints at potential problems associated with this issue.
Google Quantum AI’s whitepaper on this topic was written in collaboration with scientists from the Ethereum Foundation and Stanford University. The research examined how much quantum computing power would be required to attack elliptic curve cryptography, the cryptographic system used by networks such as Bitcoin and Ethereum. Under certain conditions, the study suggests that a live Bitcoin transaction could be intercepted and the private key derived in approximately nine minutes. As TQI reported , the paper is the third in a series of publications that have collectively produced the most significant downward revision in quantum threat resource estimates since Shor’s algorithm was published in 1994.
The nine-minute estimate has received much of the attention, but the more important figure for security professionals is the required hardware scale. The 500,000 physical qubit estimate represents a threshold where attacks against Bitcoin’s elliptic curve cryptography could become technically plausible on future quantum systems. This figure has continued to decrease as researchers refine algorithms and architectures.
What the Google Paper Actually Found
Bitcoin, Ethereum, and virtually every major cryptocurrency rely on a mathematical problem called the Elliptic Curve Discrete Logarithm Problem (ECDLP). Given a public key, it is computationally infeasible for a classical computer to reverse-engineer the corresponding private key. A 256-bit key would require more computation than the age of the universe to brute-force. On a quantum computer running Shor’s algorithm , that barrier collapses.
Previous estimates placed the required quantum hardware in the millions of physical qubits – far beyond current capability and unlikely to be crossed for many years. Google ‘s paper materially revised that number downward.
The Google team designed two quantum circuits implementing Shor’s algorithm against secp256k1, the specific elliptic curve used by Bitcoin and Ethereum. When compiled onto a superconducting architecture with standard hardware assumptions, these circuits require fewer than 500,000 physical qubits – roughly a 20-fold reduction from prior best estimates. On a fast-clock superconducting architecture, the estimated runtime is approximately nine minutes.
These are theoretical estimates based on hardware that does not yet exist. Google also chose not to publish the actual attack circuits, instead releasing a zero-knowledge proof validating the results without providing a working attack roadmap. The disclosure was designed to raise awareness rather than provide a blueprint.
Ethereum Foundation researcher Justin Drake, a co-author on the paper, described his confidence in a quantum-capable computer arriving by 2032 as having “shot up significantly,” estimating at least a 10% chance of a private key recovery from an exposed public key by that date. He added that the circuits may improve further: “Low-hanging fruit is still being picked, with at least one of the Google optimizations resulting from a surprisingly simple observation. AI was not yet tasked to find optimizations.”
The On-Spend Attack: Why Bitcoin is Uniquely Vulnerable
Quantum risk discussions typically describe a future scenario where stored encrypted data is decrypted after the fact. Bitcoin faces a more immediate variant.
When a Bitcoin transaction is broadcast to the network, there is a brief window – typically a few seconds to a few minutes before confirmation – during which the public key is exposed but the transaction has not yet settled. A sufficiently powerful quantum computer could derive the private key during that window, generate a competing fraudulent transaction, and broadcast it with a higher fee, front-running the original sender in real time.
This is called an on-spend attack. TQI’s coverage of the Google paper describes it as the specific threat enabled by fast-clock quantum architectures – superconducting and photonic systems where the attack can complete within Bitcoin’s ten-minute block time. The on-spend attack does not require intercepting and storing data over years. It requires seconds of opportunity during the transaction confirmation window.
How Much Bitcoin is Already at Risk
The risk profile depends on whether a wallet’s public key has already been revealed on the blockchain.
According to the Google paper, approximately 6.9 million bitcoin – roughly one-third of the total circulating supply – sit in wallets where public keys have already been exposed. This includes early Pay-to-Public-Key (P2PK) addresses, wallets that have already spent funds, and a substantial portion of Taproot addresses where key-path spending exposes the public key. Approximately 1.7 million bitcoin sit in early P2PK addresses from Bitcoin’s earliest years – a category that includes the holdings widely attributed to Satoshi Nakamoto , where public keys have been visible on-chain for over a decade.
Wallets using Pay-to-Public-Key-Hash (P2PKH) that have never spent funds carry lower immediate risk. They become vulnerable only when the owner initiates a transaction.
Ethereum’s exposure extends further. Security engineer Conor Deegan, whose research was cited in the Google paper , flagged a structural problem – quantum computation acts as a one-time cost that produces indefinitely reusable classical exploits. As Deegan noted , protocols like Ethereum’s KZG trusted setup, Zcash’s Sapling protocol, and Litecoin’s MimbleWimble all embed elliptic curve hardness into fixed public parameters that only need to be broken once. “Deploying new cryptographic infrastructure on ECDLP curves is now indefensible given these resource estimates,” he said.
Bitcoin’s Response: A Community Divided
Bitcoin’s decentralized governance makes cryptographic upgrades significantly harder than in centralized systems. Any change requires broad consensus among miners, node operators, and developers – a process that can take years even for uncontroversial proposals.
Bitcoin Improvement Proposal 360 (BIP-360), introduced in February 2026 by developers Hunter Beast, Ethan Heilman, and Isabel Foxen Duke, proposes a new output type called Pay-to-Merkle-Root (P2MR) that keeps public keys off-chain until spending, reducing the attack surface for future transactions.
BIP-361 , proposed in April 2026 by Jameson Lopp and five co-authors, goes further. It outlines a three-phase migration plan that would phase out quantum-vulnerable address types and ultimately freeze coins in wallets that fail to migrate. Community reaction was immediate and largely critical. “This quantum proposal is highly authoritarian and confiscatory,” one user wrote on X . “Upgrade should be 100% voluntary.” Developers behind BIP-361 framed it differently: “This is not an offensive attack, rather it is defensive: our thesis is that the Bitcoin ecosystem wishes to defend itself and its interests against those who would prefer to do nothing.”
Avihu Levy, Chief Product Officer at StarkWare, published Quantum Safe Bitcoin (QSB) on April 9, 2026. This protocol utilizes hash-based proof in place of elliptic curve signature under Script constraints set forth in Bitcoin without necessitating a soft fork in the process. Each transaction requires between $75 and $150 in computing power on a GPU, well above ordinary Bitcoin transaction fees.
Postquant Labs launched Quip Network on April 28, 2026, a Layer 2 Bitcoin wallet using WOTS+ (Winternitz One-Time Signature) cryptography via the Arch Network smart contract layer. As per the company, this method reduces the “on-spend” window to about two blocks without any modification to the core Bitcoin protocol or even a soft fork.
Bitcoin developer Bit Paine offered a measured assessment: “I still think roughly 10 years is the more likely timeframe, but I assign an uncomfortably high likelihood that we see something disruptive within five years.” What changed his thinking was the persistent nonlinearity of quantum hardware progress. “We may not have much of a window between ‘quantum is on a trajectory to disrupt Bitcoin’ and ‘secp256k1 is broken.'”
What This Means for Organizations
For any organization that stores its cryptocurrency in the treasury, provides custodial services, or operates an exchange, there are two aspects to how the Google paper alters the risk paradigm.
The on-spend attack creates a real-time threat model with no equivalent in traditional encryption risk assessment. A sufficiently powerful quantum computer could target high-value transactions as they move through the mempool – affecting institutional transfers, exchange settlements, and custodial operations. The long-exposure risk to existing holdings is now substantially more concrete. Holdings in wallets with exposed public keys are already in a vulnerable state.
According to the study carried out by the Federal Reserve in 2025, one of the main issues is the inherent structure of the public ledger. Bitcoin’s entire transaction history is public, permanent, and cannot be retroactively re-encrypted. Unlike a financial institution that can rotate its encryption keys, a public blockchain preserves every historical transaction in a form that will become readable if the underlying cryptography is broken.
NIST’s transition guidance calls for ECC-256 to be deprecated by 2030 and disallowed after 2035. Cryptocurrency infrastructure built on secp256k1 falls under the same threat profile – with the additional complication that blockchain immutability prevents retroactive remediation.
In assessing exposure for these organizations, the tangible initial steps include creating an inventory of all the wallets and exchanges that contain money in exposed address formats, assessing the transaction process exposure for the on-spend period, and evaluation of whether custodians and exchange partners have post-quantum migration roadmaps in place.
For a deeper look at the challenges of post-quantum migration, including why timing affects cost and implementation complexity, read TQI’s analysis on Why Timing Affects the Cost of Post-Quantum Migration and for a broader overview of how RSA and ECC are being replaced, see Why RSA and ECC Are Being Replaced