Google’s Quantum Breakthrough: Bitcoin Private Key Cracked in 9 Minutes?

On March 30, 2026, Google’s Quantum AI team published a whitepaper that is reverberating through the cryptocurrency industry with the urgency of a fire alarm. The paper, authored by Ryan Babbush and Hartmut Neven, reveals that future quantum computers may require dramatically fewer resources than previously estimated to break the elliptic curve cryptography underpinning Bitcoin, Ethereum, and most major blockchains — pushing a threat once dismissed as science fiction into a realistic near-term timeline.

The core finding: Google’s researchers have compiled two optimised quantum circuits implementing Shor’s algorithm against the 256-bit elliptic curve discrete logarithm problem (ECDLP-256). The more efficient circuit requires fewer than 1,200 logical qubits and 90 million Toffoli gates. Translated to hardware, that means a cryptographically relevant quantum computer (CRQC) with fewer than 500,000 physical qubits could, under standard hardware assumptions, execute the attack in a matter of minutes — a roughly 20-fold reduction from estimates that previously stretched into the tens of millions of physical qubits.

The 9-Minute Window — and What It Actually Means

The headline figure — nine minutes — refers to a specific and narrow attack scenario. When a Bitcoin user broadcasts a transaction, their public key is briefly exposed on the network before the transaction is confirmed in a block (which takes roughly 10 minutes on average). A sufficiently powerful quantum computer, pre-loaded with the necessary preparatory computations, could theoretically derive the corresponding private key during that window — allowing an attacker to redirect the funds before the network locks the transaction in.

Critically, the paper estimates the probability of succeeding within this window at slightly less than 41%. This is not a guaranteed crack: it is a statistical race against the Bitcoin confirmation clock. Nevertheless, the scenario represents a qualitatively new class of threat — one that targets live transactions rather than dormant wallets, and that requires no access to private keys, only the publicly visible public key.

Responsible Disclosure: A Novel Approach

Equally notable as the findings themselves is how Google chose to publish them. Rather than releasing the full quantum circuits — which could serve as an instruction manual for state-level adversaries — the team employed a zero-knowledge proof to validate their resource estimates. This cryptographic technique allows independent researchers to verify the results without Google needing to disclose the specific attack blueprints. The team explicitly engaged with the U.S. government prior to publication and urged other research groups to adopt the same responsible-disclosure framework.

“We want to raise awareness on this issue,” the researchers wrote on the Google Research blog, “and are providing the cryptocurrency community with recommendations to improve security and stability before this is possible, including transitioning blockchains to post-quantum cryptography (PQC), which is resistant to quantum attacks.”

Which Bitcoin Is at Risk?

Not all Bitcoin faces equal exposure. The level of risk depends entirely on whether a wallet’s public key is visible on the blockchain. The paper identifies approximately 6.9 million Bitcoin — roughly one-third of all coins in existence — as being at heightened risk, particularly following the Taproot upgrade which, under certain conditions, exposes public keys more directly.

Among the most symbolically significant holdings at risk are the coins associated with Bitcoin’s pseudonymous creator, Satoshi Nakamoto. Those early-mined wallets use P2PK addresses, meaning the public keys have been visible on the blockchain since Bitcoin’s earliest days in 2009. Binance co-founder Changpeng Zhao raised the point directly: if those coins move during a post-quantum migration, it would confirm Satoshi is still alive. If they do not move and an attacker eventually claims them, it could represent one of the most dramatic heists in financial history.

Reactions From Across the Industry

Justin Drake, an Ethereum Foundation researcher who joined the Google paper as a late co-author, said that his confidence in a so-called “Q-day” — the moment a quantum computer can break live cryptography — arriving by 2032 has risen significantly. He estimates at least a 10% probability that a quantum computer recovers a private key from an exposed public key by that date, while also noting that the logical qubit count “could plausibly go under 1,000 soon,” suggesting further optimisation is still possible.

Bitcoin advocate Bit Paine offered a measured perspective: “I still think roughly 10 years is the more likely timeframe, but I assign an uncomfortably high likelihood that we see something disruptive within five years — high enough that action within the next one to two years is prudent.” He flagged the “persistent non-linearities” in quantum computing progress, warning that the window between “quantum is on a trajectory to disrupt Bitcoin” and “secp256k1 is broken” may be uncomfortably short.

Bitfinex analysts took a more sanguine view, framing the issue as “a manageable engineering problem rather than a looming collapse,” and pointing to NIST’s 2024 post-quantum cryptography standards and Bitcoin’s BIP-360 proposal as evidence that the industry is already mobilising. “The path from theoretical vulnerability to practical exploitation is extraordinarily long,” they noted.

The Road to Post-Quantum Security

Google’s paper arrives with an explicit call to action — and a 2029 timeline. The researchers recommend that blockchain developers begin the transition to post-quantum cryptography now, before a cryptographically relevant quantum computer exists. Several crypto teams are already working on this. The Ethereum Foundation has launched a post-quantum migration effort, while Bitcoin Core and external teams are developing BIP-360, a proposal for quantum-resistant address formats.

• 2016 Google begins leading responsible transition to post-quantum cryptography
• 2024 NIST publishes first post-quantum cryptography standards
• March 2026 Google Quantum AI publishes ECDLP-256 whitepaper; qubit estimates cut 20×
• 2029 (Target) Google’s stated timeline for potential quantum threat to materialise; industry urged to complete PQC migration
• 2032 (Worst Case) Ethereum researcher Drake estimates ≥10% probability of a real private key recovery by this date

The immediate, practical advice from researchers is clear: avoid reusing Bitcoin addresses; migrate to Native SegWit (bc1q) or Taproot (bc1p) addresses; and keep private keys off the internet in cold storage. For users whose public keys are already on-chain, the risk cannot be undone retroactively — it can only be mitigated by moving funds to fresh, unexposed addresses before a quantum attacker does it for them.

What This Is Not

It bears emphasising what Google’s paper does not claim. The researchers have not built a quantum computer capable of breaking Bitcoin. The hardware required — a fault-tolerant machine with hundreds of thousands of physical qubits maintaining quantum coherence long enough to execute 90 million Toffoli gates — does not yet exist. Google’s current most advanced superconducting quantum processor operates at a much smaller scale and error rate.

What Google has done is compress the timeline for concern — and action. The paper’s responsible-disclosure framing is itself a signal: this is serious enough to engage governments and employ novel cryptographic verification techniques, but not so imminent that publishing the research creates immediate danger. The message to the cryptocurrency industry is neither panic nor complacency: it is urgency.

The quantum clock is ticking. Whether the industry can upgrade its cryptographic foundations before it runs out is now the defining security question of the decade.