Google Says Quantum Computers Could Crack Bitcoin in 9 Minutes. The Math Behind That Claim Is More Complicated.

Google published a 57-page technical paper today that reduced the estimated computing resources needed to break Bitcoin’s encryption by roughly a factor of ten. Headlines immediately declared Bitcoin could be cracked in nine minutes.

Neither claim is wrong exactly. Both are missing the context that determines whether this is an emergency or a well-documented long-term engineering problem.

What the paper actually found

The Google paper — authored by researchers at Google Quantum AI, UC Berkeley, the Ethereum Foundation, and Stanford — calculated two circuits for breaking the 256-bit elliptic curve discrete logarithm problem underlying Bitcoin and Ethereum’s transaction signing (ECDSA over secp256k1). The more efficient circuit requires 1,200 logical qubits and 90 million Toffoli gate operations, executable on a machine with under 500,000 physical qubits.

The prior best estimate, from a 2022 paper, required 317 million physical qubits for a one-hour attack, or 1.9 billion for a ten-minute attack. Google’s algorithmic improvements represent a genuine advance — roughly a 10x reduction in the spacetime volume of the attack.

The nine-minute figure comes from modeling an attack against a live Bitcoin transaction. When a wallet spends funds, the public key becomes visible in the transaction broadcast. Bitcoin’s confirmation window is approximately ten minutes. Google’s model estimates the attack could be prepared partially in advance and completed in roughly nine minutes once the public key is visible — giving a 41% probability of forging a competing transaction before the original confirms.

The gap between the math and a working machine

Here is where the headlines diverge from the engineering reality.

The paper’s 500,000-qubit estimate assumes a fully fault-tolerant superconducting quantum computer with physical-to-logical qubit ratios of approximately 345-417 to 1 — the kind of error correction Google has demonstrated in small-scale systems. Google’s Willow chip, their current most advanced processor, has 105 physical qubits. The machine required for this attack is approximately 5,000 times larger.

That gap is not primarily a qubit-count problem. It is a fabrication, connectivity, thermal management, and sustained error-correction problem. Producing 500,000 superconducting qubits that maintain consistent error rates across millions of gate operations simultaneously requires solving engineering challenges that have not been demonstrated at any scale. IBM’s most aggressive roadmap projects 500-1,000 logical qubits by 2029 — well short of the 1,200 needed for Google’s attack circuit, and logical qubits still require hundreds of physical qubits each.

The Taproot complication

Bitcoin’s 2021 Taproot upgrade introduced a complexity the paper specifically flags. In older Bitcoin address formats, public keys are only revealed when funds are spent. Taproot makes public keys visible in transaction outputs by default — meaning an attacker with a sufficiently capable quantum computer could target wallets before they initiate a transaction, rather than only during the narrow spend window.

Approximately 6.9 million BTC — roughly one-third of the total supply — sits in wallets where public keys have already been exposed through prior transactions or Taproot outputs. At current prices that represents several hundred billion dollars in potentially vulnerable holdings. The most concentrated risk: roughly 1.6 million BTC in legacy Pay-to-Public-Key addresses, the oldest format, where public keys have been visible since the transactions were made.

One blockchain has a plan. The other doesn’t.

This is the genuinely newsworthy finding in the paper, and it received less coverage than the nine-minute figure.

The Ethereum Foundation has been building a post-quantum migration roadmap for eight years. More than ten client teams are running weekly post-quantum interoperability devnets. The roadmap integrates post-quantum signature schemes incrementally, targeting completion by 2029. Justin Drake of the Ethereum Foundation co-authored the Google paper — a signal of how seriously the Ethereum ecosystem is treating the timeline.

Bitcoin has no coordinated post-quantum migration plan. Bitcoin’s decentralized governance structure — no foundation, no roadmap authority, consensus required among independent developers who move deliberately — is a structural disadvantage for organizing a multi-year cryptographic transition. The necessary changes would require a hard fork: a coordinated upgrade that every node operator must adopt. Bitcoin has executed hard forks before, but never for a change of this scope, and never under a defined time pressure.

What the realistic risk looks like

The threat has two timescales. The near-term risk — over the next five years — is primarily to wallets with already-exposed public keys if quantum hardware advances faster than expected. The longer-term risk — ten to twenty years out, which is where most expert consensus sits — is a systematic attack capability that could undermine transaction security broadly.

The asymmetry that makes this worth taking seriously even with a distant timeline: migrating cryptographic infrastructure at scale takes years. If the threat is real in 2035, the migration needs to begin by 2030 at the latest to avoid a window of vulnerability. Ethereum is already running that timeline. Bitcoin is not.