Google just told the crypto industry the threat is closer than anyone priced in. The industry, for once, is listening.
A whitepaper published late Monday by Google’s Quantum AI team found that breaking the 256-bit elliptic curve cryptography protecting bitcoin and Ethereum wallets could require fewer than 500,000 physical qubits (a unit of computation in quantum systems), roughly a 20-fold reduction from previous estimates that placed the requirement in the millions.
The paper also described how a quantum computer could crack bitcoin private keys in about nine minutes once a transaction exposes a public key, giving an attacker a 41% chance of beating bitcoin’s 10-minute confirmation window.
The research landed like a bomb across online crypto circles. Not because it says quantum computers can break bitcoin today — they can’t — but because it dramatically compresses the timeline for when they might.
“We are no longer looking at mid-2030s, we could have quantum computers of this scale by the end of the decade,” said Haseeb Qureshi, managing partner at Dragonfly, on X. “All blockchains need a transition plan ASAP. Post-quantum is no longer a drill.”
Qureshi pointed to an unusual detail in Google’s disclosure. The team did not publish the actual quantum circuits. Instead, they released a zero-knowledge proof that verifies the circuits exist without revealing how they work. “This is very atypical, showing Google thinks this is serious,” he said.
Justin Drake, an Ethereum Foundation researcher who joined the Google paper as a late co-author, said his “confidence in q-day by 2032 has shot up significantly,” estimating at least a 10% chance that a quantum computer recovers a ‘secp256k1’ private key from an exposed public key by that date.
Drake noted the optimized quantum circuit is “just 100 million Toffoli gates, which is surprisingly shallow,” and that on a superconducting platform, the total runtime would be roughly 1,000 seconds.
“Low-hanging fruit is still being picked, with at least one of the Google optimizations resulting from a surprisingly simple observation,” Drake added. “AI was not yet tasked to find optimizations.”
While human researchers are still finding straightforward improvements, the floor for the number of qubits needed hasn’t been reached. Drake said logical qubit counts “could plausibly go under 1,000 soonish.”
Today is a monumentous day for quantum computing and cryptography. Two breakthrough papers just landed (links in next tweet). Both papers improve Shor’s algorithm, infamous for cracking RSA and elliptic curve cryptography. The two results compound, optimising separate layers of…
— Justin Drake (@drakefjustin) March 31, 2026
Security engineer Conor Deegan, whose published research was cited in the Google paper, offered one of the most technically detailed responses. He flagged a pattern in which the paper surfaces across multiple chains: quantum computation acts as a one-time cost that produces indefinitely reusable classical exploits.
Ethereum’s ‘KZG’ trusted setup, Zcash’s ‘Sapling’ protocol, and Litecoin’s ‘MimbleWimble’ all embed elliptic curve hardness into fixed public parameters that only need to be broken once.
“Deploying new cryptographic infrastructure on ECDLP curves is now indefensible given these resource estimates,” Deegan said.
The paper estimates roughly 6.9 million bitcoin, about one-third of the total supply, sit in wallets where public keys have already been exposed. That includes 1.7 million $BTC from the network’s early years, including Satoshi Nakamoto’s (the mysterious creator of the Bitcoin network), as well as additional funds affected by address reuse.
CoinDesk reported earlier Monday that bitcoin’s 2021 Taproot upgrade, which was designed to enable more efficient, private transactions, also exposed public keys on the blockchain by default, a technical move that now carries quantum risk.
That figure dwarfs CoinShares’ February estimate that only about 10,200 $BTC is concentrated enough to cause “appreciable market disruption” if stolen. Google’s methodology counts all exposed keys, not just large balances.
The Bitcoin vs Ethereum divide
The reaction split along familiar lines. Ethereum’s preparation drew praise. Bitcoin’s lack of it drew alarm.
“You can think of q-day as Y2K but real,” said well-followed crypto investor only known as ‘McKenna,’ managing partner at Arete. “People should give thanks to the Ethereum Foundation for being early and leading this research. The messy part about this is Bitcoin. The lack of urgency and the consensus issue on what to do with vulnerable coins.”
The Ethereum Foundation launched pq.ethereum.org last week with eight years of post-quantum research, more than 10 client teams shipping weekly devnets, and a multi-fork migration roadmap.
Drake, who co-authored the Google paper, is part of that same Ethereum team — a direct link between the researchers quantifying the threat and the developers building the defense.
Eli Ben-Sasson, co-founder of StarkWare, urged the Bitcoin community to “strengthen initiatives like BIP 360,” a proposal that would introduce quantum-resistant wallet formats allowing voluntary migration.
“Saying that quantum computers are coming is not FUD,” Ben-Sasson said. “FUD is claiming Bitcoin can’t adapt. It can adapt. Just need to start working on these solutions today.”
Bitcoin needs to get ready for the quantum era.
We need to strengthen initiatives like BIP 360.
We need to invest more efforts in finding creative, smart solutions to ensure Bitcoin is post-quantum secure.
Saying that quantum computers are coming is not FUD. FUD is claiming… https://t.co/KqQ0RpXKbX
— Eli Ben-Sasson | Starknet.io (@EliBenSasson) March 31, 2026
Bitcoin advocate Bit Paine offered a measured take. “I still think roughly 10 years is the more likely timeframe, but I assign an uncomfortably high likelihood that we see something disruptive within five years. High enough that action within the next one to two years is prudent.”
The element that shifted his thinking was the “persistent non-linearities in QC progress and the shroud of secrecy underlying this research.” When estimates of physical qubits drop by orders of magnitude, he said, “we may not have much of a window between ‘quantum is on a trajectory to disrupt bitcoin’ and ‘secp256k1 is broken.’”
Paine added a national security dimension. “A CRQC may be developed in stealth mode and drop out of seemingly nowhere.”
Google’s decision to use a zero-knowledge proof rather than publish the circuits reinforces that point. If the world’s leading quantum lab self-censors its own research for safety reasons, state actors with equivalent or superior capabilities are unlikely to publish at all.
Drake echoed this. “From now on, assume state-of-the-art algorithms will be censored. A blackout in academic publications would be a tell-tale sign.”
Why crypto?
Some industry voices questioned why Google aimed its most detailed analysis at crypto rather than banking or military systems. ETF analyst Eric Balchunas asked why Google would “apply this research time/money on crypto versus something of way more societal consequence.”
Nic Carter, a partner at Castle Island Ventures, had the answer: blockchains are the most brittle systems relying on the encryption that quantum computers can break. “Banks don’t fail because you reverse engineer a single key. Blockchains do,” Carter said. “They are much more brittle. Banks will upgrade anyway. There won’t be an attack surface there.”
Binance co-founder Changpeng Zhao urged calm but acknowledged the practical difficulty.
“All crypto has to do is upgrade to quantum-resistant algorithms. So, no need to panic,” Zhao said. “In practice, there are some execution considerations. It’s hard to organize upgrades in a decentralized world.”
Zhao also raised the Satoshi question directly. If those coins move during a migration, “it means he is still around, which is interesting to know.” If they don’t, he said, “it might be better to lock or effectively burn those addresses so that they don’t go to the first hacker who cracks it.”
Saw some people panicking or asking about quantum computing’s impact on crypto.
At a high level, all crypto has to do is to upgrade to Quantum-Resistant (Post-Quantum) Algorithms. So, no need to panic. 😂
In practice, there are some execution considerations. It’s hard to…
— CZ 🔶 BNB (@cz_binance) March 31, 2026
The most popular counterargument on crypto X was that quantum computing breaks everything, not just blockchains.
“If quantum kills Bitcoin, it also kills the global banking system, SWIFT transfers, stock exchanges, military communications, nuclear command systems, every HTTPS website on earth,” wrote crypto commentator Quinten Francois.
Elon Musk struck a lighter note, posting that at least “if you forgot the password to your wallet, it will be accessible in the future.”
The paper addresses this framing head-on. Centralized systems, from banks to military networks, can push software updates to their users. A decentralized blockchain cannot. The timeline to migrate bitcoin’s infrastructure, including user wallets, exchange support, and new address formats, could take five to 10 years even after a solution is agreed upon.
Meanwhile, Google said it is working alongside Coinbase, the Stanford Institute for Blockchain Research, and the Ethereum Foundation on responsible approaches to the transition.
The company framed its research not as an attack on crypto but as an effort to “support the long-term health of the cryptocurrency ecosystem.”
The message from nearly every corner of the industry is now the same. The threat is no longer theoretical; it’s time to act. The only variable left is whether the protocols that need to migrate will do so before the hardware catches up.
Read more: Here’s how bitcoin, Ethereum and other networks are preparing for the looming quantum threat
