Author: Bitcoin Security Consortium, an alliance composed of industry leaders committed to the long-term security and stability of the Bitcoin protocol

Compiled by: Gu Yu, ChainCatcher

A report from the Bitcoin Security Consortium, completed in collaboration with Presidio Bitcoin.

Key Points (TL;DR)

Recent advancements in quantum computing are real—but merely incremental: Developments such as Google's Willow and recent optimizations of Shor's algorithm have raised concerns; however, cryptographically relevant quantum computers (CRQC) have yet to be demonstrated.

The risks quantum computing poses to Bitcoin are limited to its signature schemes, specifically manifested in two ways: static attacks on vulnerable tokens and in-transit attacks on mempool transactions.

Solutions have been identified and are actively being pursued: (1) migrating funds out of reused addresses, (2) developing post-quantum signature schemes, and (3) addressing consensus issues related to likely lost P2PK tokens.

The Resurrection of Quantum Computing?

After years of seeming stagnation, the field of quantum computing has seen an increasing number of academic papers demonstrating progress and the ensuing headlines, raising concerns among investors about Bitcoin's security. These headlines include:

Google's Willow (December 2024). For the first time, it demonstrated that adding physical quantum bits to protect a fault-tolerant "logical" qubit would make that logical qubit more reliable, not less.

Optimizations of Shor's algorithm by Google Quantum AI, Oratomic/Caltech, and ECDSA.fail (2026). Google Quantum AI collaborated with the Ethereum Foundation and Stanford to compress the circuit for breaking Bitcoin's elliptic curve via Shor's algorithm, reducing the prior estimates by about 20 times. Oratomic and Caltech believe their Shor's algorithm optimization could break a single Bitcoin private key in a matter of days. Finally, the ECDSA.fail project—a scoreboard by Eigen Labs—gathered researchers and AI agents to further shrink Google's circuit by nearly 70% over the following months.

IonQ's end-to-end Shor algorithm optimization (September 2026). A complete compilation blueprint for running Shor's algorithm, calculating for both software and hardware—theoretically solving a single private key about every 26 days with a success rate of 63.3%.

Google's magic state cultivation (October 2026). Quantum computing requires "magic states," resources that are consumed with each use and expensive to produce. Google demonstrated on Willow that its filtering protocol reduces errors in these states by about 40 times, achieving a 99.99% logical fidelity.

Quantinuum's "five nines" logical fidelity (October 2026). Quantinuum's Helios computer exhibits 5 errors per million operations (99.9995% logical fidelity), approximately 100 times lower than Google's demonstration. Each time the coding scale increases, errors drop by a factor of 12 (λ = 12).

Although there are currently no cryptographically relevant quantum computers (CRQC)—and this technology still faces many engineering challenges, such as physically scaling up error-corrected quantum bits—why do these headlines matter to the Bitcoin community? What is the relationship between Bitcoin and quantum computers? Let's explore.

A Brief Overview of Quantum Computing

At the heart of quantum computing is the quantum bit, or qubit. Unlike classical bits, which store the values of either 0 or 1, qubits exhibit two characteristics unique to the world of quantum mechanics:

Superposition: A qubit can simultaneously store a mixture of 0 and 1 values, with measurement causing those values to collapse into one of them with weighted probabilities.

Entanglement: Two or more qubits can share a joint state; measuring one determines the value of the other, regardless of the distance between them.

These characteristics enable quantum computers to explore many candidate answers simultaneously while mitigating incorrect answers. However, physical quantum bits are fragile and prone to decoherence, meaning the loss of quantum information, which is why many companies' roadmaps focus on achieving the minimum number of logical qubits—logical qubits are error-corrected qubits made up of multiple redundant physical qubits that allow errors to be detected and repaired, thereby maintaining reliability in computation and information.

To find the minimum ratio of physical qubits to logical qubits, quantum computing labs are researching the most efficient hardware architectures, including but not limited to:

Superconducting Circuits (Google, IBM): Small wire loops cooled to near absolute zero, where the behavior of current acts like a qubit. This technology enables quicker computation times but is slow to scale.

Neutral Atoms (Oratomic): Uncharged atoms held in place by a laser array called "tweezers," with their electrons serving as qubits. This technology scales rapidly, but theoretically, computation times are slower.

Trapped Ions (Quantinuum, IonQ): Charged atoms—ions—manipulated with lasers in an electromagnetic field; in this case, the ions’ ground state or excited state acts as a qubit. Computation is relatively slow; scaling speed is moderate.

Photonic (PsiQuantum, Xanadu): Light particles (photons) passing through chips and optical devices; properties of each photon serve as qubits. Enables faster computation times, but the development timeline appears slower.

Bitcoin's Quantum Attack Surface

Theoretically, a cryptographically relevant quantum computer running Shor's algorithm could break Bitcoin's elliptic curve digital signature algorithm (ECDSA), which is the scheme maintaining ownership and property rights in the network—it proves ownership of a private key to transaction counterparts without revealing the key. Importantly, much of Bitcoin's core game theory and economic principles do not fall within this attack surface, such as its transaction consensus, issuance schedule, and supply cap.

Attacking Bitcoin private keys presents two attack surfaces for the network:

Long-term exposure or static attacks. Tokens in reused addresses or older types of less secure addresses (Pay to Public Key, P2PK) have already exposed the public key, which a quantum computer could leverage to obtain the corresponding private key. Most active addresses today—those based on modern output types—do not readily expose public keys until spending; thus, they are less susceptible to this type of attack. However, Project Eleven estimates that approximately 7.1 million BTC, about 35% of the total, would be vulnerable to theft if a capable quantum computer existed today. Approximately three-quarters of those are stored in reused addresses—mostly in large exchanges—where the risk can be mitigated by exchanges moving funds to one-time addresses and adopting better custodial practices and standards. However, another 1.8 million BTC remains in P2PK addresses, most of which are presumed lost, making their migration to secure addresses possibly unfeasible. Quantum computers, whether fast or slow, can exploit these exposed public keys one at a time to obtain the private keys holding investors' funds.

Short-term exposure or in-transit attacks. Tokens in the Bitcoin network only reveal their public keys when spent, creating a fragile window of about 10 minutes (or more accurately, the time between transaction submission and inclusion in a block). A sufficiently fast quantum computer could exploit this window to steal tokens while the transaction is in progress. Google estimates that a pre-heated fast-clock quantum device could complete the computation to acquire a private key in as little as 9 minutes, meaning that even tokens originally stored in less vulnerable addresses would still face the risk of theft during typical transactions.

Misunderstandings That May Exaggerate Threats

"Quantum hardware has scaled and is ready to go." The best-performing system to date—Quantinuum’s system—produces 48 error-corrected logical qubits. Breaking Bitcoin's elliptic curve requires at least approximately 1,200.

"Quantum demonstrations have proven cryptographically relevant quantum computing." They have not. Willow demonstrates error-correcting memory, not large-scale error-correcting computation. The papers from Google, Oratomic, and IonQ in 2026 are blueprints, not operational machines. The low error rates between many logical qubits remain a significant bottleneck to be overcome.

"All Bitcoin would face immediate theft." Most Bitcoin are not attackable in static states, as their public keys remain hidden behind hashes before being spent. The largest single reason for exposure—address reuse—can now be mitigated by moving to new unspent addresses. Even if an attack were to occur today, it would be per attempt against a single private key rather than all vulnerable supplies at once.

Misunderstandings That May Underestimate Threats

"Shor's algorithm optimization is irrelevant." In March, Google theoretically reduced the logical qubit requirements to break Bitcoin ECDSA by about 20 times, noting that elliptic curves receive far less optimization focus than RSA (Rivest-Shamir-Adleman) systems, meaning there is still more room for optimization. For example, the ECDSA.fail project has further optimized Google's circuit by nearly 70%.

"That's decades away; why worry?" Recent expert surveys estimate about a 50% probability of a capable machine emerging between 2030 and 2035, with government targets set for early to mid-2030s for post-quantum migrations. Google and Cloudflare have set internal deadlines for 2029. It’s important to note that these deadlines are more urgently applicable for governments or companies guarding against "harvest now, decrypt later" attacks—primarily involving private information that may still be relevant in the future. As Bitcoin can self-defend by migrating to public key-hidden addresses by participants, these deadlines can be seen as best practices for the network rather than inevitable deadlines.

"We will see it coming." Breakthroughs may remain private, or be seen as a state secret, while early thefts may appear sporadic and difficult to distinguish from routine custodial turnover or payment transactions.

What Is Being Done Today

Today's Bitcoin holders—including exchanges, institutions, and investors—are actively discussing solutions to mitigate quantum threats, likely prioritizing as follows:

Migrating vulnerable supplies from reused addresses to unspent addresses. This is the easiest task to accomplish, requiring no network consensus or soft forks—it completely relies on large exchanges and custodians, as well as self-custody investors adopting better security practices, such as rotating change outputs and avoiding address reuse at all costs.

Designing post-quantum signature schemes. The leading proposal capable of implementing quantum-resistant spending on Bitcoin to date is Blockstream's SHRINCS (short for "Shrunken SPHINCS"). It is built on SHA-256 and can handle up to 3 transactions per second, while the NIST standard SPHINCS+ runs at only 0.36 transactions. Blockstream tested the scheme on the Liquid Network in March 2026 and released a Bitcoin Improvement Proposal (BIP) in August with other contributors. A formal security proof is still pending, and network-wide deployment will require a soft fork.

Reaching consensus on how to handle vulnerable, but likely lost, P2PK address tokens. This may be the most contentious issue as Bitcoin faces quantum threats in the coming years. Approximately 1.7 million BTC is stored in about 20,000 P2PK addresses, including an estimated 1.1 million belonging to Satoshi Nakamoto. According to Presidio Bitcoin, current discussion highlights are: maintaining old spending valid (allowing quantum attackers to "steal"); slowing old spending (limiting the speed at which vulnerable tokens can move, or "throttling"); and freezing tokens while providing a recovery path (disabling all old Bitcoin spending while allowing owners to recover tokens through zero-knowledge proofs of their seed phrases, known as "soft freeze"). For more extensive reading on this important topic, Presidio Bitcoin elaborates and updates the basics here.

Featured image: Google Sycamore quantum processor (Google Quantum AI, CC BY 3.0, via Wikimedia Commons)

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。