Researchers at quantum computing firm Alice & Bob estimate that a machine with about 30,000 physical qubits could break the cryptography protecting bitcoin wallets in just over an hour, using far less hardware than earlier models suggested.
Google estimated in March that a future quantum computer would need fewer than 500,000 physical qubits to crack Bitcoin’s cryptography, down from previous estimates in the millions. Alice & Bob’s new estimate of 29,588 qubits is roughly 17 times lower than Google’s earlier figure, although the two studies use different hardware designs and assumptions.
The findings suggest that the computing power needed to threaten Bitcoin could be smaller than previously expected, potentially also bringing such attacks closer to reality than previously believed.
Alice & Bob’s research also adds concerns about bitcoin held at addresses whose public keys are already exposed. A public key allows the Bitcoin network to verify transactions without revealing the private key used to authorize spending. A powerful quantum computer could potentially work backwards from the public key to recover that private key and steal the coins.
“Yes, it becomes of utmost importance that migration starts now,” Dahmun Goudarzi, senior cryptanalyst at Alice & Bob told CoinDesk. “We know how hard and long this task can be, and this paper shows that Shor’s algorithm could be run sooner than later.”
The attack would take roughly 62 minutes, compared with Bitcoin’s average block time of 10 minutes. That makes it too slow to reliably steal funds from a transaction before it is confirmed. Asked whether adding more qubits could cut the time below 10 minutes, Goudarzi said his team had not yet completed the necessary calculations.
“There is no architectural floor,” said Goudarzi, who holds a PhD in cryptography. He also said that further work could produce estimates comparable to Google's earlier research, which modeled an attack taking about nine minutes.
The distinction matters because bitcoin faces two types of quantum risk: transactions pending confirmation and BTC held at addresses whose public keys have already been exposed. The latter would give an attacker more time to derive a private key.
More than 6 million bitcoins sit behind exposed, therefore vulnerable, public keys, making those assets potential targets for future quantum attacks.
Gourdarzi stressed that Alice & Bob’s findings are theoretical. He said his company expects hardware improvements and declining resource requirements to converge in the early 2030s.
That leaves Bitcoin developers facing a difficult timetable: replacing vulnerable signatures across a decentralized network could take years, even if the machines capable of exploiting them are still being developed.
The researchers at Alice & Bob used Shor’s algorithm, a method that could allow sufficiently powerful quantum computers to solve mathematical problems that conventional machines cannot crack in a practical amount of time.
A qubit is a quantum computer's basic unit of data that can be a 0 and a 1 at the same time, allowing it to solve complex problems much faster than a regular computer, whose basic unit of data is a bit, which can only ever be a 0 or 1, but not both.