9-Minute Attack Window, 7.1 Million BTC Exposed: How Bitcoin Can Save Itself from Quantum Threats

Author: Bitcoin Security Consortium, an alliance of industry leaders dedicated to the long-term security and stability of the Bitcoin protocol.

Compiled by: Gu Yu, ChainCatcher

A report from the Bitcoin Security Consortium, completed in collaboration with Presidio Bitcoin.

Key Points (TL;DR)

Recent advancements in quantum computing are real—but merely incremental: Developments such as Google’s Willow and recent optimizations to Shor’s algorithm have raised concerns, yet Cryptographically Relevant Quantum Computers (CRQC) have yet to be demonstrated.

Bitcoin’s risk from quantum computing is limited to its signature scheme, manifested in two ways: static attacks on vulnerable tokens and in-transit attacks on mempool transactions.

Solutions have been identified and are actively being pursued: (1) migrating funds away from reused addresses, (2) developing post-quantum signature schemes, and (3) addressing consensus issues regarding P2PK tokens that may have already been lost.

A Renaissance in Quantum Computing?

After years of seeming stagnation, the field of quantum computing has seen an increasing number of academic papers demonstrating its progress, along with accompanying headlines that have sparked concerns about Bitcoin’s security among investors. These headlines include:

• Google’s Willow (December 2024). For the first time, it has been demonstrated that adding physical quantum bits to protect a fault-tolerant "logical" quantum bit makes that logical quantum bit more reliable, not less.

• Optimizations to Shor’s algorithm by Google Quantum AI, Oratomic/Caltech, and ECDSA.fail (2026). Google Quantum AI, in collaboration with the Ethereum Foundation and Stanford, has compressed the circuits for breaking Bitcoin’s elliptic curve via Shor’s algorithm, reducing the previous estimates by about 20 times. Oratomic and Caltech believe their optimization of Shor’s algorithm could crack a single Bitcoin private key in a matter of days. Finally, the ECDSA.fail project—a scoreboard from Eigen Labs—has gathered researchers and AI entities to further shrink Google’s circuits by nearly 70% in the following months.

• IonQ’s end-to-end Shor’s algorithm optimization (September 2026). A complete compilation blueprint for running Shor’s algorithm, computing for both software and hardware—theoretically solving a single private key in about 26 days per attempt, with a success rate of 63.3%.

• Google’s magic state cultivation (October 2026). Quantum computing requires "magic states," which are resource states that are consumed with each use and are costly to produce. Google has demonstrated on Willow that its filtering protocol reduces errors in these states by about 40 times, achieving 99.99% logical fidelity.

• Quantinuum’s "five nines" logical fidelity (October 2026). Quantinuum’s Helios computer has 5 errors per million operations (99.9995% logical fidelity), about 100 times lower than Google’s demonstration. As the scale of encoding increases, errors decrease by a factor of 12 (λ = 12).

Despite the fact that there are currently no Cryptographically Relevant Quantum Computers (CRQC)—and that this technology still faces many engineering challenges, such as physically scaling error-correcting quantum bits—why do these headlines capture the attention of the Bitcoin community? What is the relationship between Bitcoin and quantum computers? Let’s explore.

Overview of Quantum Computing

At the core of quantum computing is the quantum bit, or qubit. Unlike classical bits that store a value of 0 or 1, qubits exhibit two properties unique to the quantum mechanical world:

• Superposition: A qubit can simultaneously store a mixed value of 0 and 1, and measurement causes these values to collapse into one of them with a weighted probability.

• Entanglement: Two or more qubits can share a joint state, and measuring one will determine the value of the other, regardless of the distance between them.

These properties allow quantum computers to explore many candidate answers simultaneously while offsetting incorrect answers. However, physical qubits are very fragile and prone to decoherence, which is the loss of quantum information. This is why many companies’ roadmaps aim for the minimum number of logical qubits—logical qubits are error-correcting qubits constructed from multiple redundant physical qubits, allowing errors to be detected and corrected, thus keeping computations and information reliable.

To find the lowest ratio of physical qubits to logical qubits, quantum computing laboratories are researching the most efficient hardware architectures, including but not limited to:

• Superconducting circuits (Google, IBM): Small wire loops cooled to near absolute zero, where the behavior of the current acts like a qubit. This technology can achieve faster computation times, but its development scale is slow.

• Neutral atoms (Oratomic): Electrically neutral atoms fixed by a laser array known as "tweezers," with their electrons acting as qubits. This technology scales rapidly, but theoretically has slower computation times.

• Trapped ions (Quantinuum, IonQ): Charged atoms manipulated by lasers in an electromagnetic field—i.e., ions; in this case, the ground or excited states of the ions act as qubits. Computation is relatively slow; scaling speed is moderate.

• Photonics (PsiQuantum, Xanadu): Photons (light particles) passing through chips and optical devices; each photon’s properties act as a qubit. This can achieve faster computation times, but the development timeline also seems slower.

Bitcoin’s Quantum Attack Surface

Theoretically, a Cryptographically Relevant Quantum Computer running Shor’s algorithm would be able to break Bitcoin’s Elliptic Curve Digital Signature Algorithm (ECDSA), which maintains ownership and property rights in the network—proving ownership of a private key to transaction counterparts without revealing that private key. Importantly, most of Bitcoin’s core game theory and economic principles do not fall within this attack surface, such as its transaction consensus, issuance schedule, and supply cap.

Attacking Bitcoin private keys presents two attack surfaces for the network:

• Long-term exposure or static attacks. Tokens in reused addresses or older types of addresses with lower security (pay-to-public-key, P2PK) have already exposed public keys, which quantum computers can exploit to obtain the corresponding private keys. Most active addresses based on modern output types—where public keys are hidden until spent—are not easily susceptible to such attacks. However, Project Eleven estimates that about 7.1 million BTC, approximately 35% of the total, would be vulnerable to theft if a capable quantum computer existed today. About three-quarters of these are stored in reused addresses—mostly in large exchanges—where the risk could be mitigated if exchanges moved funds to one-time addresses and adopted better custodial practices and standards. However, another 1.8 million BTC are located in P2PK addresses and are largely assumed to be lost, making their migration to secure addresses potentially unfeasible. Quantum computers, regardless of speed, could exploit these exposed public keys one at a time to obtain the private keys holding investors’ funds.

• Short-term exposure or in-transit attacks. Tokens in the Bitcoin network only reveal their public keys when spent, creating a vulnerable window of about 10 minutes (or more accurately, the time between transaction submission and inclusion in a block). A sufficiently fast quantum computer could exploit this window to steal tokens in transit. Google estimates that a pre-warmed fast-clock quantum device could complete the computation to obtain a private key in as little as 9 minutes, meaning that even tokens originally stored in less vulnerable addresses would face the risk of theft during typical transactions.

Misunderstandings That May Exaggerate the Threat

"Quantum hardware has scaled up and is ready to go." The best-performing system currently demonstrated—Quantinuum’s system—has produced 48 error-corrected logical qubits. Breaking Bitcoin’s elliptic curve requires at least about 1,200.

"Quantum demonstrations have proven cryptographically relevant quantum computing." They have not. Willow demonstrates error-correcting memory, not large-scale error-correcting computation. The papers from Google, Oratomic, and IonQ in 2026 are blueprints, not operational machines. The low-error operations among many logical qubits remain a bottleneck yet to be overcome.

"All bitcoins will immediately face theft." Most bitcoins in static states are not easily attacked, as public keys remain hidden behind hashes until spent. The largest single exposure reason—address reuse—can now be resolved by rotating to new unspent addresses. Even if an attack were to occur today, it would be an attempt targeting individual private keys rather than a simultaneous attack on all vulnerable supply.

Misunderstandings That May Underestimate the Threat

"Shor’s algorithm optimizations are trivial." In March, Google theoretically compressed the logical qubit requirements needed to break Bitcoin ECDSA by about 20 times and noted that the optimization focus on elliptic curves is far less than that on the RSA (Rivest-Shamir-Adleman) cryptosystem, indicating that there is still more room for optimization. An example is the ECDSA.fail project, which has further optimized Google’s circuits by nearly 70%.

"That’s decades away, why worry?" Recent expert surveys estimate a 50% probability that a capable machine will emerge between 2030 and 2035, with governments aiming for post-quantum migration in the early to mid-2030s. Google and Cloudflare have set internal deadlines for 2029. It’s important to note that these deadlines apply more urgently to governments or companies preventing "harvest now, decrypt later" attacks—primarily involving private information that may still be relevant in the future. Since Bitcoin can self-defend by migrating to addresses where public keys are hidden, these deadlines can be seen as best practices for the network rather than inevitable deadlines.

"We’ll see it coming in advance." Breakthroughs may remain private or be viewed as classified by nation-states, and early thefts may appear sporadic and difficult to distinguish from regular custodial turnover or payment transactions.

What Is Being Done Today

Today’s Bitcoin holders—including exchanges, institutions, and investors—are actively discussing solutions to mitigate quantum threats, with priorities possibly as follows:

• Migrate vulnerable supply from reused addresses to unspent addresses. This is the easiest action to implement, requiring no network consensus or soft forks—it entirely relies on large exchanges and custodians, as well as self-custody investors, adopting better security practices, such as rotating change outputs and avoiding address reuse at all costs.

• Design post-quantum signature schemes. The leading proposal to achieve quantum-resistant spending on Bitcoin to date is Blockstream’s SHRINCS (an acronym for "Shrunken SPHINCS"). It is built on SHA-256 and can handle up to 3 transactions per second, while the NIST standard SPHINCS+ only handles 0.36 transactions. Blockstream tested this scheme on the Liquid Network in March 2026 and published a Bitcoin Improvement Proposal (BIP) in August with other contributors. Formal security proofs are still pending, and full network deployment will require a soft fork.

• Reach consensus on how to handle vulnerable but likely lost P2PK address tokens in Bitcoin. As Bitcoin faces quantum threats in the coming years, this may be the most contentious issue. About 1.7 million BTC are stored in approximately 20,000 P2PK addresses, including an estimated 1.1 million belonging to Satoshi Nakamoto. According to Presidio Bitcoin, the more prominent options currently under discussion are: keeping old-style spending valid (allowing quantum attackers to "steal"); slowing down old-style spending (limiting the movement speed of vulnerable tokens, or "throttling"); and freezing tokens while providing a recovery path (disabling all old-style Bitcoin spending but allowing owners to recover tokens through zero-knowledge proofs of their seed phrases, i.e., "soft freeze"). For broader reading on this important topic, Presidio Bitcoin elaborates and updates the fundamentals here.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.