Quantum Says 30,000 Qubits Could Break a Bitcoin Key in an Hour
The estimate assumes cat qubits that go about a century without a bit-flip, while Alice & Bob's largest demonstrator runs on a 12-qubit chip.
Quantum computing company Alice & Bob said on Thursday that a quantum computer built from about 30,000 of its cat qubits could crack a Bitcoin private key in roughly an hour.
The estimate comes from a preprint the company posted to the IACR Cryptology ePrint Archive, which targets secp256k1, the elliptic curve behind Bitcoin signatures, and puts the attack at no more than 29,588 physical qubits and 61.8 minutes. The paper treats those numbers as a ceiling because the Bitcoin calculation reuses circuits compiled to break RSA-2048 encryption.
Superconducting Design
Cat qubits are Alice & Bob’s own superconducting design. They suppress bit-flip errors in hardware, so error correction only has to catch phase-flips. That cuts the number of physical qubits behind each error-corrected logical qubit. In 2023, the company’s researchers put a 256-bit elliptic curve logarithm at 126,133 cat qubits and nine hours.
In a whitepaper published on March 30, Google Quantum AI separated two kinds of attack. On-spend attacks hit a transaction before a block confirms it. At-rest attacks target public keys already exposed on-chain and give the attacker days or more to work.
Google’s design needed fewer than half a million physical qubits. Primed in advance, that design could crack a single wallet’s private key in about nine minutes once a public key appears. Google said that would make on-spend attacks possible.
Alice & Bob’s machine would need far fewer qubits but run longer. Its hour-long attack exceeds Bitcoin’s 10-minute block time, so transactions in progress stay out of reach, the company said.
Google also counted more than 1.7 million BTC in Pay-to-Public-Key (P2PK) scripts, an early address type that leaves the public key on-chain. That pool includes the Satoshi-era coins seen as a quantum attacker’s first target.
Estimate Assumes No Bit-Flips
Alice & Bob’s figures assume no bit-flips during the computation, which the company equates to a bit-flip time of about a century. With a bit-flip about once an hour, its estimate for RSA-2048, the encryption behind much of the internet, rises from 22,593 qubits to about 45,000.
The company’s own chips are far from that scale. Its latest results, published on October 20, cover the first phase of PROQCIMA, the French government’s quantum computing program. Those results came from three demonstrators, the largest on a 12-qubit chip. Their logical error rate was not yet below the error-correction threshold.
Alice & Bob expects hardware gains and falling resource estimates to converge in the early 2030s. It urged organizations to start moving to post-quantum cryptography now. Among the post-quantum proposals for Bitcoin, Jameson Lopp and five other developers have put forward BIP-361, which would freeze quantum-vulnerable legacy addresses in phases.