Quantum computing company Alice & Bob released a pre‑print paper estimating that a fault‑tolerant quantum machine built from roughly 29,588 physical "cat" qubits could solve the 256‑bit elliptic‑curve problem underlying Bitcoin’s secp256k1 signatures in approximately 61.8 minutes. The calculation, detailed in a new IACR ePrint submission, marks a significant reduction from earlier estimates that required millions of qubits, according to the company’s CEO Théau Peronnin.

BTC / USD
Source: CoinGecko. Prices are indicative.

How the Estimate Was Derived

Alice & Bob’s analysis combines a superconducting cat‑qubit architecture, which suppresses bit‑flip errors at the hardware level, with more efficient error‑correction codes and optimized implementations of Shor’s algorithm. By reducing the overhead for correcting phase‑flip errors, the researchers claim the logical qubit count needed for a 256‑bit elliptic‑curve discrete logarithm drops to under 30,000 physical qubits. The same methodology yields a figure of 22,593 qubits to break RSA‑2048 in about 3.1 days, far below the 20‑million‑qubit estimates published in 2019.

Implications for Bitcoin Security

If a quantum computer of the described scale were built, it could compute a private key from any exposed public key, allowing an attacker to forge signatures and move funds. The one‑hour runtime exceeds Bitcoin’s average 10‑minute block interval, meaning on‑spend attacks—where a transaction is intercepted before confirmation—remain impractical. However, at‑rest attacks targeting addresses with publicly visible keys, such as legacy Pay‑to‑Public‑Key scripts that hold an estimated 1.7 million BTC, could become viable because the attacker would have days to complete the computation after the key is revealed.

Industry Response and Next Steps

The findings add urgency to ongoing discussions about post‑quantum upgrades for Bitcoin. Developers have proposed BIP‑361, a phased approach to freeze legacy addresses vulnerable to quantum attacks, and other groups are evaluating lattice‑based signature schemes. Alice & Bob cautioned that its numbers are theoretical resource estimates, not evidence that current quantum hardware can execute the attack. Nonetheless, the company expects hardware improvements and shrinking resource requirements to converge in the early 2030s, echoing similar projections from Google Quantum AI and Quantinuum. Both firms have reported advances in logical fidelity and error‑reduction techniques that could accelerate the path to fault‑tolerant machines.

What to Watch Next

Follow progress on cat‑qubit scalability and logical error rates from Alice & Bob, Google Quantum AI, and Quantinuum, as breakthroughs could further lower the qubit threshold. Monitor the Bitcoin development community’s movement on post‑quantum proposals, especially any formal BIP submissions or test‑net implementations. Keep an eye on disclosures of large on‑chain public‑key holdings, which would represent high‑value targets if a quantum‑capable adversary emerges.