Google’s quantum researchers have significantly narrowed the resource gap between today’s quantum computers and the kind capable of breaking the cryptography that secures Bitcoin, Ethereum and most other blockchains — a finding that has reopened debate over how much time the digital-asset industry actually has to prepare.
In a whitepaper published by Google Quantum AI, in collaboration with researchers from the Ethereum Foundation and Stanford University, the team presented new resource estimates for breaking the 256-bit Elliptic Curve Discrete Logarithm Problem (ECDLP-256) — the mathematical problem underlying the secp256k1 curve that protects nearly every major cryptocurrency’s private keys.
The paper’s authors, led by Ryan Babbush and Hartmut Neven of Google Quantum AI, said an optimised version of Shor’s algorithm could solve the problem using either fewer than 1,200 logical qubits and 90 million Toffoli gates, or fewer than 1,450 logical qubits and 70 million Toffoli gates — whichever pairing reflects a trade-off between qubit count and gate operations.
On error-corrected superconducting hardware, the researchers estimated this could translate into an attack completed in minutes using fewer than half a million physical qubits.
That figure represents roughly a 20-fold reduction from earlier estimates, which had placed the resource requirement in the millions of qubits, according to the paper and multiple outlets that reviewed it, including Forbes and SecurityWeek.
Google said it verified the results through a zero-knowledge proof — a cryptographic technique that allows third parties to confirm the findings without disclosing the underlying attack methodology, a step the company described as part of a “responsible disclosure” approach.
The Attack Vectors
The paper outlines what it calls an “on-spend” attack: because a wallet’s public key becomes visible on the network the moment a transaction is broadcast — but before it is confirmed on-chain — a sufficiently fast quantum computer could theoretically derive the corresponding private key and reroute funds within that narrow window.
The researchers distinguish between “fast-clock” architectures, such as superconducting or photonic systems, and “slow-clock” architectures, such as neutral-atom or ion-trap systems, noting that only the former would plausibly be fast enough to exploit this window before a transaction settles.
Separately, the paper flags a longer-term risk to dormant or lost wallets whose public keys are already exposed on public ledgers — funds that, researchers say, would become vulnerable to extraction once capable quantum hardware exists, without requiring any action from the wallet owner.
The authors also survey quantum-era risks to smart contracts, proof-of-stake consensus mechanisms and data-availability sampling systems, though the paper stops short of assigning a firm timeline to when any of these vulnerabilities might be practically exploited.
Context and Caveats
Interestingly, industry observers have cautioned against reading the findings as an imminent threat.
The hardware needed to execute such an attack does not yet exist, and independent analysts who reviewed the paper — including commentary from post-quantum security researchers — noted that the estimates describe a theoretical resource floor rather than a demonstrated capability.
Quantum Computing Report and other trade publications framed the study as a recalibration of assumptions rather than evidence of an imminent break.
Even so, the timing has drawn scrutiny. Google has separately set a 2029 internal deadline to migrate its own systems to post-quantum cryptography, a target the company had announced prior to this paper’s release.
The Ethereum Foundation has likewise been developing post-quantum migration plans through a dedicated initiative, mapping out hard forks intended to move the network toward quantum-resistant signatures.
The paper’s authors have urged blockchain communities broadly to accelerate the transition to post-quantum cryptographic standards, while also calling for policy frameworks to address the fate of dormant, quantum-vulnerable holdings — an issue the paper terms “digital salvage” — without creating new avenues for adversarial seizure.
