Google: Quantum Computers Can Break Bitcoin & Ethereum ECDSA in Minutes

Google Quantum AI’s March 30, 2026 whitepaper delivers the highest-credibility quantum cryptanalysis update to date. Using state-of-the-art compilation and surface-code estimates, the team demonstrates two circuits for secp256k1 ECDLP: one at 1,200 logical qubits / 90 M Toffoli gates and one at 1,450 logical qubits / 70 M Toffoli gates — an order-of-magnitude spacetime improvement over prior work. On superconducting hardware (10⁻³ error rate, planar connectivity), these run in 9–12 minutes with <500 k physical qubits once primed.

The paper introduces a critical fast-clock (superconducting/photonic/silicon) vs slow-clock (neutral-atom/ion-trap) distinction. Fast-clock CRQCs enable “on-spend” attacks on public-mempool transactions within Bitcoin’s 10-minute block time, Ethereum’s 12-second slots, and Solana’s 400 ms finality. Slower architectures are limited to “at-rest” attacks on long-exposed keys.

Bitcoin exposure map (current):

• P2PK + P2TR (on-chain public keys): fully at-rest vulnerable (~1.7 M BTC P2PK + growing P2TR share).
• 2PKH/P2WPKH/P2SH/P2WSH: at-rest safe only if no reuse; all on-spend vulnerable.
• Total vulnerable BTC across all scripts ≈ 6.9 M.

Ethereum’s attack surface is larger and more systemic: account keys, multisig admin keys, smart-contract logic, PoS validator keys, and KZG-based Data Availability Sampling are all ECDLP-vulnerable. On-setup attacks (recovering toxic waste from trusted setups) threaten Tornado Cash-style pools, zk-rollups, and Mimblewimble privacy.

The whitepaper is validated by an SP1 + Groth16 SNARK zero-knowledge proof of the circuit costs, eliminating trust issues while withholding attack details — a responsible-disclosure first in quantum cryptanalysis.

Market context: crypto TVL (especially Ethereum + L2 + stablecoins + RWAs) exceeds $600 B and is growing. Dormant assets alone (2.3 M BTC) represent tens of billions at permanent risk. The authors explicitly warn that financial trends (RWA tokenization, PoS, DAS) are expanding the quantum attack surface faster than defenses are being deployed.

Consensus view (“quantum is 10–15 years away”) is now obsolete. First fast-clock CRQCs will simultaneously enable at-rest and on-spend attacks. Migration to PQC is no longer optional; it is an immediate solvency and systemic-stability issue.