Google’s Advance Puts Bitcoin’s Exposed Keys in Focus
Google has demonstrated a technique needed for future fault-tolerant quantum computers, but it has not shown a machine capable of recovering a Bitcoin private key.
The result instead sharpens a longer-term question for Bitcoin: which holdings would be exposed first if such hardware becomes viable, and how could their owners migrate?
In an October 15 announcement, Google Quantum AI said its Willow processor reduced errors by roughly 40 times when preparing specialised quantum states. The experiment concerns one component of a fault-tolerant computer, not the complete system needed to attack Bitcoin’s signatures.
Key Takeaways
- Willow’s 40-fold result applies to magic-state preparation, not directly to the cost of breaking Bitcoin keys.
- The experiment achieved its highest reported fidelity after retaining about 8% of attempts.
- Early pay-to-public-key outputs, reused keys and Taproot outputs face different long-exposure concerns.
- Bitcoin has draft proposals for future protection, but no activated post-quantum migration route.
Willow improved one ingredient needed for fault-tolerant computing
The study, “Magic state cultivation on a superconducting quantum processor,” examines how to prepare resources needed for operations outside the basic set supported by many error-correcting architectures.
Those resources are known as magic states. They are consumed while a quantum computer runs certain operations, meaning a long and complex calculation needs a continuing supply of reliable states as well as the hardware carrying out the calculation.
Cultivation begins with an imperfect state and uses coordinated checks to retain higher-quality results. The researchers reported logical-state fidelity of about 99.99% and roughly 40 times less error than their state-injection baseline.
That result came with an important trade-off: approximately 8% of attempts remained after the selection process, including checks performed during preparation and measurement. The reported fidelity therefore describes the retained states, not the output rate of a complete machine running a large calculation continuously.
This is why the announcement should not be read as a 40-fold reduction in the resources needed to attack Bitcoin. Willow showed that this preparation method works on hardware. Building a fault-tolerant computer capable of maintaining the required quality, scale and throughput for cryptographic key recovery remains a much larger task.
The first risk would be public keys already visible on-chain
Bitcoin uses digital signatures to prove that a transaction is authorised. The owner signs with a private key, while the network checks the signature against the corresponding public key.
A sufficiently capable quantum computer running Shor’s algorithm could, in principle, derive a private key from its public key and then create a valid signature. It would not need to steal the owner’s hardware wallet, compromise a computer or obtain a recovery phrase.
The time for which a public key remains visible is central to the risk. A long-exposure attack targets a key that is already available on the blockchain, giving a future attacker as much time as needed to attempt key recovery. A short-exposure attack begins after a public key appears in a transaction awaiting confirmation, leaving a far narrower window.
Many early mining rewards used pay-to-public-key outputs, which reveal the public key while coins remain unspent. Their exposure comes from the spending conditions, not simply from the age of the coins. Modern holdings can also face long exposure if their key has been revealed in an earlier transaction or if they use Taproot outputs.
The Taproot specification uses an output public key that supports direct signature-based spending. That does not make Taproot insecure today, but it means that a newer address format does not automatically conceal the public-key information relevant to a future quantum key-recovery attack.
Cold storage remains valuable against ordinary theft because it protects private keys from online compromise. It does not remove a public key that has already been published on the blockchain.
A future attack still requires a machine far beyond Willow
A separate Google-led resource study describes what a future attack on Bitcoin’s elliptic-curve signatures could require under specific assumptions. It is not a description of Willow’s demonstrated capabilities.
Using assumptions for a future superconducting architecture—including physical error rates of 10-3, planar connectivity and a fast control system—the study estimated that the relevant circuits could run in minutes with fewer than half a million physical qubits.
For a “primed” fast-clock machine, the paper models an average key-recovery time of roughly nine minutes after a public key becomes available. That timing depends on prior computation and on control-system reaction times that current hardware has not demonstrated at the required scale.
The model also estimates that a nine-minute calculation would need around half a million sufficiently reliable T-states every second. This is a continuing production requirement, not the number of qubits in the machine.
Its hardware estimate already incorporates an efficient approach to producing magic states. Dividing the figure by Willow’s 40-fold error reduction would therefore double-count progress: lower error in one experimental preparation method is not the same as a proportional reduction in the cost of an entire cryptographic attack.
Protecting future outputs will not automatically solve the legacy problem
Bitcoin developers are considering proposals that address different stages of quantum exposure. BIP 360 proposes Pay-to-Merkle-Root, or P2MR, a draft soft-fork output type that removes Taproot’s exposed key-path spend.
P2MR is designed to reduce long-exposure risk by avoiding the key path that makes Taproot outputs vulnerable before spending. It does not provide complete protection once a key is revealed in a transaction waiting in the mempool. The BIP’s authors say that defence against those shorter attacks may require post-quantum signatures.
A proposed migration away from Bitcoin’s existing signatures would add a further challenge. BIP 361 is a draft informational proposal that depends on a separate, still-unspecified post-quantum signature proposal. Its suggested five-year transition would begin only after activation; it is not an active deadline for Bitcoin holders.
Dormant holdings present the hardest migration question. An owner who has lost access to the private keys cannot authorise a move into stronger protection. But inactivity does not prove that coins are abandoned, meaning any rule restricting unmigrated holdings could also affect legitimate owners who return later.
The immediate issue is preparation, not panic
Nothing in the Willow experiment means Bitcoin holders need to make an emergency transfer today. The relevant question is whether an output already exposes a public key, not whether its owner keeps the private key in a hardware wallet or whether the address simply looks old.
The harder task for Bitcoin is to create and adopt a migration path before cryptographically relevant quantum hardware exists: new output types must be agreed, wallet and custody software must support them, and owners need a practical way to move existing funds. That process is likely to take longer than creating a new address format, especially for old or inaccessible coins.
This article is provided for informational purposes only and does not constitute financial or investment advice.
Kosta has reported on cryptocurrency markets and blockchain infrastructure since 2020, bringing over six years of hands-on experience in the crypto industry built through daily tracking of markets, trends, and emerging blockchain developments. Specializing in Bitcoin on-chain analysis, institutional ETF flows, and digital asset price action, his work at Coindoo has been cited by other news agencies and consistently covers market developments with a focus on data-driven reporting across Bitcoin, Ethereum, Solana, and XRP. Over the years, Kosta has contributed to multiple crypto media outlets in different regions, authoring over 6,000 articles across the sector. His reporting spans cryptocurrency markets and the broader fintech industry, tracking not only price action but also the technological and regulatory forces shaping the ecosystem. To support his analysis, Kosta actively leverages on-chain data and metrics from leading platforms such as Santiment, Glassnode, and CryptoQuant, enabling deeper, evidence-based market insights. He believes in the power of transparency and the data that underpins the blockchain ecosystem. His academic background in Marketing Management from Denmark further complements his analytical approach, adding a strong understanding of communication strategy and content positioning to his work.
