Google's Willow Quantum Chip Advances Pose Potential Threat to Satoshi-era Bitcoin

Google says its Willow quantum chip reduced errors about 40-fold when preparing special states used in quantum calculations. The result was published in Science this week. The findings do not make a Bitcoin attack 40 times cheaper. The findings advance an engineering method that could help future quantum computers sustain the roughly 500,000 reliable magic states per second required under one modeled attack.

A bitcoin wallet uses a secret key to approve payments and a matching public key that lets the network verify those approvals. Spending typically reveals the public key, while some payment types expose the public key from the start. Recovering the secret key from the public key is supposed to require an impractical amount of computing. However, a sufficiently large quantum computer running Shor's algorithm could theoretically recover the secret key. An attacker with the recovered secret key could sign transactions that the network would accept as genuine. Mathematician Peter Shor first published the method in 1994, but nobody has yet demonstrated the wallet-breaking capability. A recovery phrase stored physically offers no protection against an attacker working from public information already on the blockchain.

Some later payment formats hide the public key behind a hash, a digital fingerprint, until the owner spends. An attacker targeting a previously hidden key would have to wait for exposure and might need to recover the secret quickly enough to interfere with the payment. Some of bitcoin's oldest holdings have exposed public keys that have been available since the coins were mined. Bitcoin can introduce stronger spending protections, but owners need the existing keys to move old holdings into those protections. Owners who have lost the keys cannot move the holdings, leaving exposed public keys available to a future attacker.

On Oct. 7, 100.02 BTC untouched since July 2010 moved after more than 16 years, carrying a value of about $8.5 million. In August, six wallets inactive since 2011-2014 moved another 553.59 BTC, worth roughly $40 million at the time. Those transfers alone do not establish that holders are responding to quantum fears, because transfers can reflect wallet changes, reorganized holdings or preparations to sell.

Quantum computers store information in fragile units called qubits that heat, vibration and stray signals can disturb, introducing errors. Adding more qubits creates more opportunities for mistakes. Engineers organize many physical qubits into groups that detect and correct errors, with each group acting as a more dependable logical qubit. Certain operations require specially prepared quantum states called magic states, which are consumed when used and must be produced throughout a calculation. Hardware devoted to producing magic states cannot be assigned to other work.

Google's method, called cultivation, starts with a rough state, checks the state for errors and discards flawed attempts. The method aims to produce clean states using less hardware than older methods require. Google reported about 99.99% fidelity, measuring how closely the finished states matched the intended states, only for states that passed inspection. Willow retained about 8% of attempts after preparation and measurement checks, equivalent to about eight successful attempts per 100 tries.

The next steps include operating the process at a much larger scale and keeping the states useful during longer calculations. Researchers say further work is needed on real-time operations and moving the states into stronger error-correcting setups.

In March, Google estimated that a future superconducting quantum computer with fewer than 500,000 physical qubits could break Bitcoin and Ethereum wallet cryptography under specific hardware assumptions. Researchers reduced the workload of a core calculation used in that attack, according to September reporting. That work covered one component rather than the complete attack or the physical hardware costs of running the attack. Earlier studies reduce the mathematics an attacker must perform, while cultivation addresses the cost of supplying the machine during those calculations. The gains cannot simply be multiplied together because Google's March estimate already assumed efficient magic-state production. The Willow experiment tests part of that engineering approach rather than providing another 40-fold reduction in the estimated cost of attacking bitcoin.