9-Minute Attack Window, 7.1 Million BTC Exposed: How Bitcoin Can Save Itself Under Quantum Threats
Author: [Bitcoin Security Consortium](https://x.com/btcconsortium/status/2120513958096277963?s=46), an alliance composed of industry leaders dedicated to the long-term security and stability of the Bitcoin protocol.
Compiled by: Gu Yu, ChainCatcher
A report from the Bitcoin Security Consortium, completed in collaboration with Presidio Bitcoin.
### Key Points (TL;DR)
Recent advancements in quantum computing are real—but merely incremental: Progress such as Google's Willow and recent optimizations to Shor's algorithm have raised concerns; however, cryptographic-related quantum computers (CRQC) have yet to be demonstrated.
The risks Bitcoin faces from quantum computing are limited to its signature scheme, specifically manifested in two aspects: static attacks on vulnerable tokens and in-transit attacks on mempool transactions.
Solutions have been identified and are being actively pursued: (1) migrating funds out of reused addresses, (2) developing post-quantum signature schemes, (3) addressing consensus issues regarding likely lost P2PK tokens.
### The Resurgence of Quantum Computing?
After years of seeming stagnation, the field of quantum computing has seen an increasing number of academic papers demonstrating its progress and the accompanying headlines have raised concerns about Bitcoin's security among investors. These headlines include:
Google's Willow (December 2024). For the first time, it has been demonstrated that adding physical quantum bits to protect a fault-tolerant "logical" quantum bit makes that logical quantum bit more reliable, not less.
Optimizations to Shor's algorithm by Google Quantum AI, Oratomic/Caltech, and ECDSA.fail (2026). Google Quantum AI collaborated with the Ethereum Foundation and Stanford to compress the circuits for breaking Bitcoin's elliptic curve using Shor's algorithm, reducing previous estimates by about 20 times. Oratomic and Caltech believe their optimization of Shor's algorithm could crack a single Bitcoin private key in a matter of days. Finally, the ECDSA.fail project—a scoreboard from Eigen Labs—gathered researchers and AI agents to further shrink Google's circuits by nearly 70% in the following months.
End-to-end Shor's algorithm optimization by IonQ (September 2026). A complete compilation blueprint for running Shor's algorithm, computing for both software and hardware—theoretically solving a single private key in about 26 days per attempt, with a success rate of 63.3%.
Google's magic state cultivation (October 2026). Quantum computing requires "magic states," which are resource states that are consumed with each use and are costly to produce. Google demonstrated on Willow that its filtering protocol reduces errors in these states by about 40 times, achieving 99.99% logical fidelity.
Quantinuum's "five nines" logical fidelity (October 2026). Quantinuum's Helios computer has 5 errors per million operations (99.9995% logical fidelity), about 100 times lower than Google's demonstration. As the scale of encoding increases, errors decrease by a factor of 12 (λ = 12).
Despite the absence of cryptographic-related quantum computers (CRQC) today—and the many engineering challenges that remain, such as physically scaling error-corrected quantum bits—why do these headlines capture the attention of the Bitcoin community? What is the relationship between Bitcoin and quantum computers? Let's explore.
### Overview of Quantum Computing
At the core of quantum computing is the quantum bit, or qubit. Unlike classical bits that store a value of 0 or 1, qubits exhibit two properties unique to the quantum mechanical world:
Superposition: A qubit can simultaneously hold a mixed value of 0 and 1, and measurement causes these values to collapse into one or the other with weighted probabilities.
Entanglement: Two or more qubits can share a joint state, and measuring one will determine the value of the other, regardless of the distance between them.
These properties allow quantum computers to explore many candidate answers simultaneously while offsetting incorrect answers. However, physical qubits are very fragile and prone to decoherence, which is the loss of quantum information. This is why many companies' roadmaps target the minimum number of logical qubits—logical qubits are error-corrected qubits constructed from multiple redundant physical qubits, allowing errors to be detected and corrected, thus keeping computations and information reliable.
To find the lowest ratio of physical qubits to logical qubits, quantum computing labs are researching the most efficient hardware architectures, including but not limited to:
Superconducting circuits (Google, IBM): Small wire loops cooled to near absolute zero, where the behavior of current acts like a qubit. This technology enables faster computation times, but its development scale-up is slow.
Neutral atoms (Oratomic): Uncharged atoms held in place by a laser array known as "tweezers," with their electrons acting as qubits. This technology scales rapidly, but theoretically has slower computation times.
Trapped ions (Quantinuum, IonQ): Charged atoms—ions—manipulated with lasers in an electromagnetic field; in this case, the ions' ground or excited states act as qubits. Computation is relatively slow; scaling speed is moderate.
Photonic (PsiQuantum, Xanadu): Photons—light particles—passing through chips and optical devices; each photon's properties act as a qubit. This can achieve faster computation times, but the development timeline also seems slower.
### Bitcoin's Quantum Attack Surface
Theoretically, a cryptographic-related quantum computer running Shor's algorithm would be able to break Bitcoin's Elliptic Curve Digital Signature Algorithm (ECDSA), which is the signature scheme that maintains ownership and property rights on the network—it proves ownership of a private key to transaction counterparts without revealing that private key. Importantly, most of Bitcoin's core game theory and economic principles do not fall within this attack surface, such as its transaction consensus, issuance schedule, and supply cap.
Attacking Bitcoin private keys presents two attack surfaces for the network:
Long-term exposure or static attacks. Tokens in reused addresses or older types of addresses with lower security (pay-to-public-key, P2PK) have already exposed the public key, allowing quantum computers to exploit these public keys to obtain the corresponding private keys. Most active addresses based on modern output types—where the public key remains hidden before spending—are not easily susceptible to such attacks. However, Project Eleven estimates that about 7.1 million BTC, approximately 35% of the total, would be vulnerable to theft if a capable quantum computer existed today. About three-quarters of these are stored in reused addresses—mostly in large exchanges—where the risk could be mitigated if exchanges moved funds to one-time addresses and adopted better custody practices and standards. However, another 1.8 million BTC are in P2PK addresses and are mostly presumed lost, making migration to secure addresses potentially unfeasible. Quantum computers, regardless of speed, could exploit these exposed public keys one at a time to obtain the private keys holding investors' funds.
Short-term exposure or in-transit attacks. Tokens in the Bitcoin network only reveal their public keys when spent, creating a vulnerable window of about 10 minutes (or more accurately, the time between transaction submission and inclusion in a block). A sufficiently fast quantum computer could exploit this window to steal tokens in transit. Google estimates that a pre-heated fast-clock quantum device could complete the computation to obtain a private key in as little as 9 minutes, meaning that even tokens originally stored in less vulnerable addresses would face theft risk during typical transactions.
### Misunderstandings That May Exaggerate the Threat
"Quantum hardware has scaled up and is ready." The currently best-performing system—Quantinuum's system—produces 48 error-corrected logical qubits. Breaking Bitcoin's elliptic curve requires at least about 1,200.
"Quantum demonstrations have proven cryptographic-related quantum computing." They have not. Willow demonstrated error-corrected memory, not large-scale error-corrected computation. The papers from Google, Oratomic, and IonQ in 2026 are blueprints, not operational machines. The low-error operations among many logical qubits remain a bottleneck yet to be overcome.
"All Bitcoin will immediately face theft." Most Bitcoin is not easily vulnerable in a static state, as public keys remain hidden behind hashes before being spent. The largest single exposure reason—address reuse—can now be addressed by rotating to new unspent addresses. Even if an attack were to occur today, it would be an attempt against individual private keys rather than a single attempt against all vulnerable supply.
### Misunderstandings That May Underestimate the Threat
"Optimizations to Shor's algorithm are irrelevant." In March, Google theoretically compressed the logical qubit requirements needed to break Bitcoin ECDSA by about 20 times and noted that the optimization focus on elliptic curves is far less than that on the RSA (Rivest-Shamir-Adleman) cryptosystem, indicating there is still more room for optimization. An example is that the ECDSA.fail project has further optimized Google's circuits by nearly 70%.
"That's decades away, why worry?" Recent expert surveys suggest a 50% probability of a capable machine appearing between 2030 and 2035, with governments aiming to complete post-quantum migrations in the early to mid-2030s. Google and Cloudflare have set internal deadlines for 2029. It is important to note that these deadlines apply more urgently to governments or companies preventing "harvest now, decrypt later" attacks—primarily involving private information that may still be relevant in the future. Since Bitcoin can self-defend by migrating to addresses where public keys are hidden, these deadlines can be viewed as best practices for the network rather than inevitable deadlines.
"We will see it coming." Breakthroughs may remain private or be considered confidential by nation-states, and early thefts may appear sporadic, making them difficult to distinguish from regular custody turnover or payment transactions.
### What Is Being Done Today
Today's Bitcoin holders—including exchanges, institutions, and investors—are actively discussing solutions to mitigate quantum threats, with priorities possibly as follows:
Migrate vulnerable supply from reused addresses to unspent addresses. This is the easiest measure to implement, requiring no network consensus or soft fork—it relies entirely on large exchanges and custodians, as well as self-custody investors, adopting better security practices such as change output rotation and avoiding address reuse at all costs.
Design post-quantum signature schemes. The leading proposal so far capable of achieving quantum-resistant spending on Bitcoin is Blockstream's SHRINCS (short for "Shrunken SPHINCS"). It is built on SHA-256 and can handle up to 3 transactions per second, while the NIST standard SPHINCS+ only handles 0.36 transactions. Blockstream tested the scheme on the Liquid Network in March 2026 and released a Bitcoin Improvement Proposal (BIP) in August with other contributors. Formal security proofs are still pending, and full network deployment will require a soft fork.
Reach a consensus on how to handle vulnerable but likely lost P2PK address tokens in Bitcoin. This may be the most controversial issue as Bitcoin faces quantum threats in the coming years. Approximately 1.7 million BTC are stored in about 20,000 P2PK addresses, including an estimated 1.1 million belonging to Satoshi Nakamoto. According to Presidio Bitcoin, the more prominent options currently under discussion are: keeping old-style spending valid (allowing quantum attackers to "steal"); slowing down old-style spending (limiting the movement speed of vulnerable tokens, also known as "speed limiting"); and freezing tokens while providing a recovery path (disabling all old-style Bitcoin spending but allowing owners to recover tokens through zero-knowledge proofs of their seed phrases, known as "soft freezing"). For broader reading on this important topic, Presidio Bitcoin elaborates and updates the fundamentals [here](https://github.com/presidiobtc/bitcoin-quantum/blob/main/index.md#mitigations).