What it would mean for Bitcoin if quantum computers could derive private keys from public keys in about nine minutes

Google’s Quantum AI team said earlier this week that a future quantum computer could derive a bitcoin private key from a public key in roughly nine minutes. The claim spread quickly across social media and prompted market concern. The practical meaning depends on how bitcoin keys are exposed and when an attacker would need to act.

How bitcoin keys and confirmations work

Bitcoin transactions are authorized when a wallet signs a transaction using a private key, a secret number that proves ownership of the coins. That signature also reveals a public key, which is broadcast to the network as an address. The transaction then waits in the mempool until a miner includes it in a block. On average, confirmation takes about 10 minutes.

The private key and public key are linked by the elliptic curve discrete logarithm problem. Classical computers cannot reverse that relationship in any useful timeframe. A sufficiently powerful future quantum computer running Shor’s algorithm could, in principle, solve the underlying math.

The “nine-minute” mempool attack

Google’s paper argues that an attacker could reduce the time needed for the attack by pre-computing parts that do not depend on a specific public key. Once a public key appears in the mempool, the quantum computer would only need about nine minutes to derive the corresponding private key.

Because bitcoin’s average confirmation time is about 10 minutes, the attacker would have a narrow window to redirect funds before the original transaction confirms. The paper estimates this would translate into a roughly 41% chance of deriving the key and stealing the funds in time.

How likely is this with today’s quantum hardware?

The attack is described as requiring a quantum computer that does not exist yet. Google’s paper estimates fewer than 500,000 physical qubits would be needed. By comparison, today’s largest quantum processors have around 1,000.

Coins already exposed: a longer-term risk

Beyond the mempool race, the more immediate concern highlighted in the article is the 6.9 million bitcoin—roughly one-third of total supply—that already sit in wallets where the public key has been permanently exposed.

This includes early bitcoin addresses from the network’s first years that used a format called pay-to-public-key, where the public key is visible on the blockchain by default. It also includes wallets that reused an address, because spending from an address reveals the public key for all remaining funds associated with that address.

For these coins, the attacker would not need a nine-minute window. With a sufficiently powerful quantum computer, the attacker could crack exposed keys one by one “at leisure,” without time pressure tied to mempool confirmation.

Taproot and the expansion of exposure

The article also notes that bitcoin’s 2021 Taproot upgrade made the situation worse. As CoinDesk reported earlier Tuesday, Taproot changed how addresses work so that public keys are visible on-chain by default, expanding the pool of wallets that could be vulnerable to a future quantum attack.

What happens to the network if keys can be derived

The bitcoin network would still keep producing blocks. Mining uses SHA-256, which quantum computers cannot meaningfully speed up with current approaches. The ledger would also continue to function.

However, if private keys can be derived from public keys, the ownership guarantees that underpin bitcoin’s value would break down. Anyone with exposed keys would be at risk of theft, and institutional trust in the network’s security model would be undermined.

Potential mitigation: post-quantum cryptography

The article concludes that the fix is post-quantum cryptography, which replaces the vulnerable math with algorithms that quantum computers cannot crack. It adds that Ethereum has spent eight years building toward that migration, while Bitcoin has not even started.