Scientists Estimate Bitcoin Cryptography Breach by Quantum Computer in 62 Minutes

Scientists from the French quantum startup Alice & Bob and their co-authors have calculated that a quantum computer based on superconducting cat qubits architecture might require about 29,600 physical qubits and 62 minutes to solve the discrete logarithm problem on the secp256k1 elliptic curve, which is used to secure Bitcoin. This scenario could potentially allow for the recovery of private keys from known public ones; however, this is a theoretical estimate rather than a demonstration of an actual hack: quantum systems with the necessary characteristics do not currently exist.

In their work, the researchers assessed the resources needed to run Shor's algorithm on two architectures – cat qubits with repetition codes and LDPC-cat. For Bitcoin, the key task is the ECDLP on secp256k1: it underlies digital signatures and wallet security. According to the authors' calculations, the attack would require no more than 30,000 cat qubits, and the execution time would be about an hour. Other scenarios were separately evaluated: RSA-2048 – about 22,593 qubits and 3.14 days; FFDLP-512 – about 6,700 qubits and 21 minutes; RSA-2048 in 1.25 hours with approximately 611,000 qubits.

For the main estimates, the authors provided for an error correction cycle of one microsecond, a reaction time of 10 microseconds, and no bit errors – this corresponds to maintaining the qubit state for about 100 years. If the condition is relaxed to one hour and another level of correction is added, the requirement for RSA-2048 would increase to approximately 45,000 qubits.

According to estimates, the potential threat could affect 6.26 million BTC, whose public keys have already been revealed. But this does not mean that the coins can be stolen today: a quantum computer with the necessary precision and error correction is required. Previously, Google Quantum AI warned that future quantum systems might break modern cryptography faster than expected. Coinbase has called for Bitcoin to prepare, presenting technical recommendations. Cardano founder Charles Hoskinson criticized BIP-361, pointing out that its implementation will not eliminate risks for all coins.