On March 31, 2026, Google's Quantum AI team published a 57-page research paper co-authored with cryptographers from Stanford University and the Ethereum Foundation. The conclusion was specific and significant: future quantum computers could break the cryptography protecting Bitcoin wallets using far fewer resources than previously believed. Under the right conditions, a sufficiently powerful quantum machine could derive a private key from an exposed public key in approximately nine minutes, which is less time than it takes Bitcoin to confirm a single transaction. This is not a prediction that it will happen tomorrow. But it is a serious assessment from the world's leading quantum computing lab that the threat is measurably closer than the crypto industry had priced in. This blog explains exactly how the attack would work, why some Bitcoin is more vulnerable than others, what 6.9 million exposed Bitcoin means, and what is being done about it right now.
By CryptoAcademy Team | Published: 2026-04-18 | 18 min read time read | Category: Educational
Before explaining why quantum computers are a threat, it helps to understand what they would be attacking.
Every Bitcoin wallet has two keys. A private key is a 256-bit number, a secret known only to the wallet's owner. A public key is derived from the private key through a mathematical operation based on a specific mathematical structure called an elliptic curve. Bitcoin uses a curve called secp256k1.
The relationship between the two keys is designed to be a one-way street. Given the private key, computing the public key is easy. Given the public key, working backwards to find the private key is computationally impossible for any classical computer. The math behind this is the elliptic curve discrete logarithm problem (ECDLP), and the reason it is hard is that even the fastest supercomputer alive today would take longer than the age of the universe to solve it by brute force.
When you send Bitcoin, you prove ownership by producing a cryptographic signature using your private key. The signature can be verified by anyone using your public key, but cannot be used to reverse-engineer the private key. The network confirms the transaction, and the funds move.
This system has secured trillions of dollars of value for over a decade. The problem is that it was designed assuming classical computers, not quantum ones.
---
The explanation of quantum computing that most articles give is that qubits can be both 0 and 1 simultaneously (superposition), allowing quantum computers to explore many possibilities in parallel. This is approximately true, but the specific reason quantum computers threaten Bitcoin requires a bit more precision.
In 1994, mathematician Peter Shor published an algorithm, now called Shor's algorithm, that allows a quantum computer to efficiently solve the discrete logarithm problem: the exact mathematical problem that makes deriving a private key from a public key hard for classical computers.
Shor's algorithm does not just make this problem slightly easier. It changes the difficulty from effectively impossible to efficiently solvable. For a classical computer, cracking ECDLP-256 would require operations beyond astronomical. For a quantum computer running Shor's algorithm with enough qubits, it becomes a computation that can complete in minutes.
Google's March 2026 paper designed two quantum circuits implementing Shor's algorithm specifically against Bitcoin's elliptic curve. One uses approximately 1,200 logical qubits and 90 million Toffoli gate operations. The other uses approximately 1,450 logical qubits and 70 million Toffoli gate operations. These resource requirements have been reduced by roughly 20 times compared to earlier estimates, which had placed the bar at millions of qubits.
The current state of the art: Google's Willow chip, the most advanced publicly demonstrated quantum processor, has 105 physical qubits. Leading demonstrations of error-corrected logical qubits remain in the tens, not the thousands needed for a Bitcoin attack.
The gap between where quantum hardware is today and where it needs to be to threaten Bitcoin is still significant. But it is a gap that is closing, and Google's paper has moved the estimated timeline from "comfortably distant" to "plan for it now."
---
The headline figure from Google's paper is that a future quantum computer could derive a Bitcoin private key from an exposed public key in approximately nine minutes. Understanding exactly what this means requires understanding two different types of exposure and the specific attack scenario.
Long-exposure vulnerability. Some Bitcoin addresses have their public key permanently recorded on the blockchain because of how they were created or used. Early Bitcoin transactions often used a format called Pay-to-Public-Key (P2PK) that stored the full public key directly in the transaction output. Anyone who has ever reused a Bitcoin address, sending funds from the same address more than once, has exposed their public key when they first spent from that address. Satoshi Nakamoto's early mining rewards are in this category. Roughly 1.7 million BTC from Bitcoin's earliest years sit in addresses of this type.
The Taproot upgrade of 2021, while greatly improving Bitcoin's privacy and efficiency for many purposes, created a new category of long-exposure vulnerability: Taproot's key path spending option records the public key on-chain by default whenever a simple transaction is made. This was designed for efficiency, but it means that spending from a Taproot address in the most straightforward way permanently exposes the public key.
The total estimate for Bitcoin with exposed public keys is approximately 6.9 million BTC, around one-third of all Bitcoin in circulation, according to the Google paper and blockchain analytics firm Project Eleven.
Short-exposure vulnerability: the nine-minute window. This is the most operationally specific attack scenario in Google's paper, and it is what the nine-minute figure refers to.
When you broadcast a Bitcoin transaction to the network, your transaction sits in the mempool, a waiting room of unconfirmed transactions, until a miner includes it in the next block. While your transaction is in the mempool, before it is confirmed, your public key is visible to the entire network.
Bitcoin's average block confirmation time is approximately ten minutes. That means your transaction, and your exposed public key, is publicly visible for up to ten minutes before being confirmed.
Google's paper outlines a specific attack scenario for this window. The parts of Shor's algorithm that depend only on the fixed, publicly known parameters of Bitcoin's elliptic curve can be precomputed in advance. The quantum computer sits ready, already halfway through the calculation, waiting. The moment a target public key appears in the mempool, the machine only needs to complete the second half of the computation. Google estimates this takes approximately nine minutes.
Under Bitcoin's current confirmation dynamics, this means a sufficiently powerful quantum computer could: see a transaction broadcast by a Bitcoin holder, derive the corresponding private key before the transaction confirms, construct a competing transaction redirecting those funds to an attacker-controlled address, and submit that competing transaction with a higher fee so miners include the attacker's version instead of the legitimate one.
The attack succeeds in what is called a front-running scenario: the attacker uses the nine-minute mempool window to effectively intercept and redirect a transaction in flight.
Google estimates this attack would beat confirmation approximately 41% of the time, reflecting the variability in how quickly miners pick up individual transactions.
---
Bitcoin's 2021 Taproot upgrade is widely regarded as one of the most important protocol improvements in Bitcoin's history. It improved efficiency, enabled more sophisticated smart contracts, and reduced fees for common transaction types. It is the foundation that the Lightning Network's more advanced features, BitVM, and other scaling technologies depend on.
The Google paper casts Taproot in an uncomfortable light. By making the key path spending option the default for simple transactions, Taproot expanded the population of Bitcoin addresses whose public keys would be permanently exposed on-chain whenever their owners made a transaction.
Bitcoin's Taproot upgrade, which makes public keys visible by default, may widen the pool of vulnerable wallets, prompting Google to urge earlier post-quantum migration.
This does not mean Taproot was a mistake. In a world without quantum computers capable of running Shor's algorithm, exposing the public key on-chain is completely harmless because classical computers cannot reverse the elliptic curve relationship. Taproot's efficiency gains are real and valuable. But in a world where such quantum computers might exist within the next decade, the design decision creates a category of exposure that did not exist under older address formats.
The irony is not lost on Bitcoin developers: the upgrade designed to make Bitcoin better for users may have, in combination with future quantum hardware, expanded the number of wallets at risk.
---
Not all Bitcoin has the same level of quantum risk. Understanding the three categories helps Bitcoin holders make practical decisions.
Category One: Permanently Exposed (Highest Risk). Approximately 6.9 million Bitcoin sit in addresses where the public key has already been permanently recorded on the blockchain. This includes Satoshi Nakamoto's early mining rewards in P2PK format, coins in reused addresses, and coins held in Taproot addresses that have been spent at least once using the key path method. A future quantum computer capable of running the attack described in Google's paper could target these addresses at leisure, without any time pressure.
Category Two: Temporarily Exposed During Transactions (Moderate Risk). Every Bitcoin holder, regardless of which address format they use, exposes their public key briefly during any transaction when it passes through the mempool. The nine-minute attack applies to all transactions in flight. The risk can be reduced by using techniques like accelerated confirmation or commit-delay-reveal schemes, but cannot be eliminated entirely without changing how Bitcoin transactions work.
Category Three: Unexposed Public Keys (Lower Risk). Bitcoin held in modern address formats where the funds have never been moved, and the public key has never appeared on the blockchain, is substantially harder to attack. An attacker would need to crack the hash function (SHA-256 and RIPEMD-160) that sits between the public key and the Bitcoin address. Grover's algorithm gives quantum computers a speedup on hash functions, but only a quadratic one, roughly doubling the difficulty of the computation rather than making it trivial. Bitcoin's current hashing parameters are widely considered to retain meaningful security even against quantum attacks on hash functions.
The practical implication is direct: addresses that have never been spent from are the safest. Old addresses with exposed public keys are the most vulnerable. The message for long-term Bitcoin holders is to move funds to freshly generated addresses that have never been transacted from, using modern address formats that do not expose the public key on-chain.
---
The nine-minute attack is a real and specific scenario. It is also a scenario that requires hardware that does not currently exist and may not exist for years.
The required hardware is a fault-tolerant quantum computer with approximately 1,200 to 1,450 logical qubits, capable of executing tens of millions of fault-tolerant gate operations without the cumulative error rate destroying the calculation. Physical qubits, which are what current machines use, are noisy and error-prone. Logical qubits are groups of physical qubits arranged to correct for each other's errors, enabling longer and more reliable computations. Moving from physical to logical qubits requires significant error correction overhead.
The current state of publicly known quantum hardware: Google's Willow chip has 105 physical qubits. IBM's most advanced systems have demonstrated circuits with more than 5,000 two-qubit gates. Quantinuum has reported 48 error-corrected logical qubits. IBM has a public roadmap to 200 logical qubits and 100 million fault-tolerant gates by 2029.
IBM's 2029 target of 200 logical qubits is still below the 1,200 to 1,450 logical qubits Google's paper identifies as necessary for the Bitcoin attack. DARPA's Quantum Benchmarking Initiativ