Quantum Threat

Two papers dropped that have accelerated quantum risk to Bitcoin’s cryptography.

TLDR: Neither one of these papers change the basic principles of quantum compute, but they do change the numbers.

How to Attack Bitcoin’s Cryptography

Before we jump into what these papers have stated, let’s first grasp the nature of attacking Bitcoin.

Practical Methods of Attack

Bitcoin can be attacked in two practical states: in flight and at rest. And it can be attacked through two cryptographic systems: elliptic-curve signatures and hash functions. The new March 2026 papers materially tightened the threat timeline for elliptic-curve cryptography (ECC), especially where public keys are exposed. They did not suddenly make SHA-256 easy to break.

‘In Flight’

Bitcoin being spent. If an attacker wanted to exploit bitcoin in flight, they would need to derive the private key fast enough to interfere before the transaction is safely confirmed.

Bitcoin miners write a new block every ten (10) minutes, on average. Once that block is written and confirmed, it is effectively immutable for practical purposes.

‘At Rest’

Bitcoin is sitting still. An attacker has more time, but only some coins are realistically exposed — especially coins whose public keys are already visible.

Elliptic-Curve Cryptography ‘ECC’

This is the signature system that proves you own your bitcoin and authorizes spending it. In Bitcoin, that means ECDSA and Schnorr.

If a sufficiently powerful quantum computer can derive a private key from an exposed public key, it can steal coins or intercept certain spends.

Hash Functions

This is the one-way math used in mining, addresses, and transaction structure. In Bitcoin, that means SHA-256 and RIPEMD-160.

These remain far less practical quantum targets than elliptic-curve signatures.

The Old Math

For context, in Dec 2024, my friend Mike challenged me to investigate the quantum threat to Bitcoin after Google released Willow, a giant leap forward in quantum compute.

The previous math worked like this:

In Flight / Signature Attack (ECC):
Qubits Required - 8,560,000
Time Required: 10.5 hours

The Willow chip operates at 105 physical qubits, implying that an 81,523x hardware improvement would be required for a successful attack.

At Rest / Hash Attack (SHA-256):
Qubits Required: 2,200,000
Time Required: 18,000 years

The New Math

What changed in March 2026 is not the laws of physics. What changed is the estimated cost of attacking elliptic-curve cryptography (‘ECC’).

Google’s Paper

Google’s team built optimized quantum circuits for running Shor’s algorithm against Bitcoin’s ECC.

The resulting paper shows that they could break it in roughly nine (9) minutes with 500,000 superconducting physical qubits. That’s a 20x improvement over previous technology and — critically — a shorter period of time than Bitcoin’s target block time of ten (10) minutes.

This could open ‘in flight’ Bitcoin up to successful attack.

Caltech’s Paper

A second paper released the same day by Caltech and Oratomic points in the same general direction but from a different hardware path.

Their work argues that a neutral-atom quantum architecture could run Shor’s algorithm at cryptographically relevant scale with far fewer qubits than previously assumed, and that ECC-256 discrete logs could be solved in roughly 10 days with 26,000 qubits under their assumptions. (ECC-256 simply means 256-bit elliptic-curve cryptography — the family of math Bitcoin uses for digital signatures.)

This could open some ‘at rest’ Bitcoin up to successful attack — especially coins whose public keys are already exposed.

The Google-style ‘in flight’ ECC attack is estimated at fewer than 500,000 physical qubits in a few minutes, while the Oratomic/Caltech-style ECC attack points to roughly 26,000 qubits over a much longer runtime under a different hardware architecture (superconducting vs. neutral-net).

The BTQ Technologies Paper

A third March 2026 paper helps clarify the other half of the story that the Caltech and Google papers do not: Bitcoin mining and hash functions.

While the Google and Oratomic papers tightened the numbers on elliptic-curve attacks, this paper examined whether quantum computers could realistically attack Bitcoin mining itself using Grover’s algorithm against double-SHA-256.

Its conclusion is blunt: once you cost the real hardware, error correction, energy, and fleet logistics required, practical quantum mining collapses under its own weight. Even favorable assumptions still require an absurd amount of physical hardware and power. At actual Bitcoin difficulty, the required quantum mining fleet rises to astronomical levels.

Qubits required: 10 ^ 23 i.e. a century of hardware production
Watts required: 10 ^ 25 i.e. the real-world energy cost is far too high

In plain English: quantum is a remote and impractical threat to the hash function.

Important Notes

Qubits

First, these are theoretical attacks. The most powerful known quantum computer right now is Google’s Willow at just 105 physical qubits.

The ‘in flight’ attack requires a quantum computer with 500,000 qubits and the ‘at rest’ attack requires 26,000 qubits. A 4,762x improvement in hardware is required.

That kind of hardware does not yet exist, but it will theoretically exist at some point in the future, possibly even this decade based on aggressive estimates.

1940s Nuclear Moment

Second, these papers chose not to publish the actual methodology. For those who study history, this is akin to the 1940s when Nuclear papers were being published but the real meat of the research kept private for security concerns. So, it should be concerning — not just for Bitcoin — that we’ve moved into that territory with Quantum research.

Traditional Banking

This should concern not just Bitcoin, but the entire digital and financial world. Traditional systems built on RSA and ECC have enormous quantum exposure as well. Bitcoin is not uniquely threatened. It is simply more honest about the problem because it cannot paper over reality with a weekend rollback and a press release.

Traditional banking cryptography (RSA / ECC) is significantly easier to break into than either in flight or at rest Bitcoin.

If this is a risk to Bitcoin, it’s a far greater risk to the traditional banking industry. Banks are quick to point out that they could roll back and undo any such disaster, but that entire process is ripe for attack too.

The fact of the matter is more fraud exists in USD — both as a percentage and absolute value — than Bitcoin. A successful quantum attack on Fedwire could close the US economy between $2.0 and $3.3 trillion in indirect impact according to Finextra for example. Even if the banks eventually roll back the data, the resulting six0month recession and 10-17% decline in real GDP would be irreversible according to the Hudson Institute.

If criminals can execute a quantum hack on traditional banking, what’s to stop them from executing more attacks on the ‘roll back’?

If you find yourself rooting against Bitcoin here, remember that Bitcoin is leading the way and traditional routes are at far greater risk of quantum attack.

Conclusion

Bitcoin's hash function (bitcoin minig) is not at risk of a quantum attack. Bitcoin is not helpless with ellipctic-curve attacks, either. The central risk is not just technical. It is whether Bitcoin can coordinate a post-quantum migration before the hardware catches up.

H/t: NYDIG research, Blockspace Media