Google just told the crypto industry the threat is closer than anyone priced in. The industry, for once, is listening.
A whitepaper published late Monday by Google's Quantum AI team found that breaking the 256-bit elliptic curve cryptography protecting bitcoin and Ethereum wallets could require fewer than 500,000 physical qubits (a unit of computation in quantum systems), roughly a 20-fold reduction from previous estimates that placed the requirement in the millions.
The paper also described how a quantum computer could crack bitcoin private keys in about nine minutes once a transaction exposes a public key, giving an attacker a 41% chance of beating bitcoin's 10-minute confirmation window.
The research landed like a bomb across online crypto circles. Not because it says quantum computers can break bitcoin today — they can't — but because it dramatically compresses the timeline for when they might.
Qureshi pointed to an unusual detail in Google's disclosure. The team did not publish the actual quantum circuits. Instead, they released a zero-knowledge proof that verifies the circuits exist without revealing how they work. "This is very atypical, showing Google thinks this is serious," he said.
Justin Drake, an Ethereum Foundation researcher who joined the Google paper as a late co-author, said his "confidence in q-day by 2032 has shot up significantly," estimating at least a 10% chance that a quantum computer recovers a 'secp256k1' private key from an exposed public key by that date.
Drake noted the optimized quantum circuit is "just 100 million Toffoli gates, which is surprisingly shallow," and that on a superconducting platform, the total runtime would be roughly 1,000 seconds.
While human researchers are still finding straightforward improvements, the floor for the number of qubits needed hasn't been reached. Drake said logical qubit counts "could plausibly go under 1,000 soonish."
Security engineer Conor Deegan, whose published research was cited in the Google paper, offered one of the most technically detailed responses. He flagged a pattern in which the paper surfaces across multiple chains: quantum computation acts as a one-time cost that produces indefinitely reusable classical exploits.
Ethereum's 'KZG' trusted setup, Zcash's 'Sapling' protocol, and Litecoin's 'MimbleWimble' all embed elliptic curve hardness into fixed public parameters that only need to be broken once.
The paper estimates roughly 6.9 million bitcoin, about one-third of the total supply, sit in wallets where public keys have already been exposed. That includes 1.7 million BTC from the network's early years, including Satoshi Nakamoto's (the mysterious creator of the Bitcoin network), as well as additional funds affected by address reuse.
CoinDesk reported earlier Monday that bitcoin's 2021 Taproot upgrade, which was designed to enable more efficient, private transactions, also exposed public keys on the blockchain by default, a technical move that now carries quantum risk.
That figure dwarfs CoinShares' February estimate that only about 10,200 BTC is concentrated enough to cause "appreciable market disruption" if stolen. Google's methodology counts all exposed keys, not just large balances.
The Bitcoin vs Ethereum divide
The reaction split along familiar lines. Ethereum's preparation drew praise. Bitcoin's lack of it drew alarm.
The Ethereum Foundation launched pq.ethereum.org last week with eight years of post-quantum research, more than 10 client teams shipping weekly devnets, and a multi-fork migration roadmap.
Drake, who co-authored the Google paper, is part of that same Ethereum team — a direct link between the researchers quantifying the threat and the developers building the defense.
Eli Ben-Sasson, co-founder of StarkWare, urged the Bitcoin community to "strengthen initiatives like BIP 360," a proposal that would introduce quantum-resistant wallet formats allowing voluntary migration.
Bitcoin advocate Bit Paine offered a measured take. "I still think roughly 10 years is the more likely timeframe, but I assign an uncomfortably high likelihood that we see something disruptive within five years. High enough that action within the next one to two years is prudent."
The element that shifted his thinking was the "persistent non-linearities in QC progress and the shroud of secrecy underlying this research." When estimates of physical qubits drop by orders of magnitude, he said, "we may not have much of a window between 'quantum is on a trajectory to disrupt bitcoin' and 'secp256k1 is broken.'"
Paine added a national security dimension. "A CRQC may be developed in stealth mode and drop out of seemingly nowhere."
Google's decision to use a zero-knowledge proof rather than publish the circuits reinforces that point. If the world's leading quantum lab self-censors its own research for safety reasons, state actors with equivalent or superior capabilities are unlikely to publish at all.
Drake echoed this. "From now on, assume state-of-the-art algorithms will be censored. A blackout in academic publications would be a tell-tale sign."
Why crypto?
Some industry voices questioned why Google aimed its most detailed analysis at crypto rather than banking or military systems. ETF analyst Eric Balchunas asked why Google would "apply this research time/money on crypto versus something of way more societal consequence."
Nic Carter, a partner at Castle Island Ventures, had the answer: blockchains are the most brittle systems relying on the encryption that quantum computers can break. "Banks don't fail because you reverse engineer a single key. Blockchains do," Carter said. "They are much more brittle. Banks will upgrade anyway. There won't be an attack surface there."
Binance co-founder Changpeng Zhao urged calm but acknowledged the practical difficulty.
Zhao also raised the Satoshi question directly. If those coins move during a migration, "it means he is still around, which is interesting to know." If they don't, he said, "it might be better to lock or effectively burn those addresses so that they don't go to the first hacker who cracks it."
The most popular counterargument on crypto X was that quantum computing breaks everything, not just blockchains.
Elon Musk struck a lighter note, posting that at least "if you forgot the password to your wallet, it will be accessible in the future."
The paper addresses this framing head-on. Centralized systems, from banks to military networks, can push software updates to their users. A decentralized blockchain cannot. The timeline to migrate bitcoin's infrastructure, including user wallets, exchange support, and new address formats, could take five to 10 years even after a solution is agreed upon.
Meanwhile, Google said it is working alongside Coinbase, the Stanford Institute for Blockchain Research, and the Ethereum Foundation on responsible approaches to the transition.
The company framed its research not as an attack on crypto but as an effort to "support the long-term health of the cryptocurrency ecosystem."
The message from nearly every corner of the industry is now the same. The threat is no longer theoretical; it's time to act. The only variable left is whether the protocols that need to migrate will do so before the hardware catches up.
Read more: Here's how bitcoin, Ethereum and other networks are preparing for the looming quantum threat
