Google Cuts Qubit Estimate for Breaking Bitcoin Encryption by 20x

Google's March 2026 whitepaper cut the estimated qubit threshold for breaking Bitcoin's elliptic curve cryptography by a factor of 20, from millions of physical qubits to fewer than 500,000. The finding comes from Google Quantum AI's published research. It changes the arithmetic of a threat that most blockchain developers had placed comfortably in the mid-2030s.

The gap between theory and hardware remains large. Willow, Google's current flagship processor, holds 105 physical qubits. The estimated attack threshold is roughly 4,800 times that count. No quantum processor has extracted a single cryptocurrency private key to date.

What did Google's processors actually achieve?

Sycamore claimed quantum supremacy in October 2019 with 53 qubits. It finished a specific computation in 200 seconds that Google said would take a leading classical supercomputer roughly 10,000 years. The result had no cryptographic application.

Willow arrived in late 2024 and doubled the count to 105 physical qubits, with improved error correction. Google frames it as a stepping stone toward fault-tolerant quantum computing. That framing is a roadmap, not a delivered capability.

Current machines operate in the Noisy Intermediate-Scale Quantum era. Error rates remain too high for sustained cryptographic computation. Each physical qubit adds noise that compounds across multi-step calculations.

In October 2026, Google demonstrated magic state cultivation on Willow. The technique cut magic-state errors roughly 40-fold and reached 99.99% logical fidelity, according to results published in Science. The team moved a purified quantum state from a distance-3 color code into a distance-5 surface code. Google has not demonstrated the technique at larger scale. That caveat matters more than the headline number.

Why does 500,000 qubits change the timeline?

The whitepaper modeled a quantum computer cracking a Bitcoin private key within approximately nine minutes of a transaction exposing the public key. That window gives an attacker a 41% probability of completing theft before a standard 10-minute block confirmation closes.

Justin Drake of the Ethereum Foundation placed at least a 10% probability on a quantum machine recovering a secp256k1 private key from an exposed public key by 2032. Drake described the optimized circuit as requiring "just 100 million Toffoli gates, which is surprisingly shallow." He added that logical qubit counts "could plausibly go under 1,000 soonish."

The underlying paper estimates up to 90 million Toffoli gates for a 1,200-logical-qubit system and 70 million for a 1,450-logical-qubit system. Those are model outputs, not measurements from working hardware.

Haseeb Qureshi, managing partner at Dragonfly, argued such machines could arrive by the end of the decade. He called on all blockchains to draft post-quantum transition plans now. He also noted that Google released a zero-knowledge proof rather than its full circuits, which he called "very atypical" and a signal of seriousness. A withheld proof invites skepticism even as it signals intent.

Conor Deegan, a security engineer cited in the paper, said quantum computation could turn a one-time investment into indefinitely reusable classical exploits. He called deploying new elliptic curve infrastructure "now indefensible given these resource estimates."

How much Bitcoin sits exposed?

The whitepaper estimated that approximately 6.9 million BTC, roughly one-third of total supply, sits in wallets with public keys already visible on-chain. That figure includes 1.7 million BTC from Bitcoin's earliest years, when the pay-to-public-key format stored keys openly. The 2021 Taproot upgrade expanded public key exposure by default.

Glassnode offered a lower count: approximately 6.04 million BTC with public key exposure as of May 2026. A June 2026 Quantus study estimated roughly 2.3 million BTC may prove extremely difficult or impossible to migrate.

Eli Ben-Sasson, co-founder of StarkWare, urged the Bitcoin community to advance BIP 360, which proposes quantum-resistant wallet formats. A June 2026 study projected that a migration starting in 2026 could complete between 2029 and 2031 under baseline assumptions. Bitcoin has no approved network-wide deadline for post-quantum signatures. Its governance makes coordinated upgrades slower and more contentious than Ethereum's multi-fork roadmap and active test networks.

Google said it is working with Coinbase, the Stanford Institute for Blockchain Research, and the Ethereum Foundation on the post-quantum transition. The Ethereum Foundation has published a research portal backed by eight years of work, with more than 10 client teams running weekly test networks.

What remains unsaid?

Drake flagged state-level actors as a distinct concern. A blackout in published quantum research would itself be a warning signal. The whitepaper estimates a threat that no one has built; the market currently prices none of it. If error-correction gains continue at the pace Willow demonstrated, the binding constraint becomes calendar time rather than physics, and the contested question shifts from whether quantum machines threaten blockchain encryption to when.