// Contents
62 minutes and 29,588 qubits. That is the price tag the French quantum company Alice & Bob put on cracking a bitcoin wallet key, in a resource estimate posted to the cryptographers’ preprint archive on October 28, 2026. In the spring, Google’s figure was half a million qubits. Four years ago, researchers were talking about hundreds of millions. Nobody owns a machine that can do this yet.
It is already clear, though, whose coins would go first: more than 6 million bitcoins sit at addresses where the key a thief needs is on public display. Often that has nothing to do with the owner: by Glassnode’s count, Robinhood has exposed keys for 100% of its customers’ bitcoin, Coinbase for 10%. None of this dooms bitcoin. It isn’t something to shrug off, either.
An envelope that opens when you pay
?How would a quantum computer steal bitcoin?
A wallet has a private key, a 256-bit number, and a public key computed from it. Going forward takes an instant; going backward is out of reach for any ordinary computer. Shor’s algorithm, a quantum method for problems like this one, makes the backward trip feasible. A bitcoin address is a fingerprint of the public key, and until coins are spent from it, the key itself stays hidden, like a letter in a sealed envelope. Paying tears the envelope open: the public key goes into the transaction, where everyone can see it.
?Why does that matter if the key is visible for only a few minutes?
There are two ways to attack. The first is a race: a thief spots a fresh transaction, computes the private key, and broadcasts a competing one while the original waits for confirmation. A new bitcoin block arrives roughly every 10 minutes. For that race, 62 minutes is too slow, but the nine minutes in Google’s spring estimate is fast enough: CoinDesk put a thief’s odds of winning at roughly 41%. The second is simpler and scarier. Some coins already have their public key sitting on the blockchain, and with those, there is no rush at all.
The cat that doesn’t drop the coin
?What exactly did Alice & Bob calculate?
Nobody cracked anything. The paper’s ten authors took Shor’s algorithm and broke it down into individual operations for a machine the company hopes to build. The result is a bill of materials: how many components, running for how long. For secp256k1, the elliptic curve behind bitcoin keys, it came to at most 30,000 qubits and about an hour. For RSA-2048, a widely used encryption standard, the bill comes to roughly 23,000 qubits and 3.14 days.
?Why are they called cat qubits?
Put simply, an ordinary qubit is like a spinning coin. It can land on the wrong side: a bit flip, from 0 to 1. Or it can wobble out of its spin, the second kind of error, called a loss of phase. Machines built on ordinary superconducting qubits have to guard against both at once, and that gets expensive: in Google’s model, one reliable “logical” qubit takes about 400 physical ones. Alice & Bob stores information in a microwave field trapped inside a tiny resonator. Physicists call its state a “cat state,” after Schrödinger’s thought experiment: the field sits in two opposite states at once, the way the cat is both alive and dead, and those two states serve as 0 and 1. This coin almost never lands on the wrong side, so only the spin needs watching, and the machine gets by with far fewer components.
?Where's the catch?
CoinDesk calculated that this is 17 times cheaper than Google’s estimate, but that comparison sets Google’s ordinary qubits against Alice & Bob’s far more elaborate components. A bigger catch hides in the assumptions. The paper’s main design needs a cat qubit that flips by itself only about once a century. The company’s best result, announced in September 2025, was 33 to 60 minutes, and even that is preliminary. A century against an hour: a gap of roughly a millionfold. The authors offer a fallback with an extra layer of error protection. There, a qubit that holds for about an hour is enough, but the machine needs almost twice as many components. That figure appears in the paper only for RSA, 45,000 instead of 23,000; there is no such number for a bitcoin key.
From hundreds of millions to thirty thousand
The most striking part of the story is how fast the estimates keep falling. None of it came from new hardware. Mathematicians and engineers cut the bill by finding ever leaner ways to lay out the same problem.
// Timeline
- Mathematician Peter Shor describes a quantum algorithm that quickly factors numbers and solves the discrete logarithm problem. RSA and elliptic-curve signatures rest on those two problems.
- A University of Sussex team estimates the qubits needed to crack a bitcoin key within minutes to hours: 30 million to 300 million.
- Physicist Élie Gouzien and co-authors, including Alice & Bob researchers, arrive at 126,133 cat qubits and 9 hours.
- Google Quantum AI, with researchers from the Ethereum Foundation and Stanford: fewer than 500,000 ordinary qubits and a matter of minutes.
- Alice & Bob: at most 30,000 cat qubits and about an hour.
Gouzien is an author of the new paper too. In three years, the team cut its own estimate fourfold in qubits and ninefold in time.
The hardware tells a humbler story. Willow, the chip Google unveiled in December 2024, has 105 qubits. By Google’s own model, an attack needs up to 500,000 of those same qubits, almost five thousand times more. Alice & Bob’s own roadmap aims for a chip with 100 logical qubits by 2030, and that is still a goal, not a product. Dahmun Goudarzi, the company’s senior cryptanalyst, expects the two curves, growing hardware and shrinking requirements, to cross in the early 2030s. In his view, moving bitcoin to new protection can’t wait: “it becomes of utmost importance that migration starts now,” Goudarzi told CoinDesk.
Freeze someone else’s coins, or hand them to a thief
There is no shortage of coins with exposed keys. Analysts at Glassnode counted more than 6 million bitcoins in October 2026, or 31.2% of the circulating supply. Some sit at address types that reveal the key from the start: the network’s very first addresses from 2009 and 2010 work that way, and so does the modern Taproot format. But Glassnode’s May report found that about two-thirds of exposed keys leaked through how addresses are handled, not through the network’s design. Much of that comes from exchanges and services that hold coins for their customers.
If you hold bitcoin in an app, you probably have no idea which addresses the service keeps your coins on. By Glassnode’s count, Robinhood has exposed keys for 100% of those coins, Revolut for 99%, Binance for 83%, Coinbase for 10%, and Fidelity for about 2%. Government holdings in the United States, Britain, and El Salvador show none. As CoinDesk stresses, the figures describe how addresses are used, not how close a theft is.
?What does this mean for someone who owns bitcoin?
Two habits expose a key: reusing the same address and spending from it in pieces. A new address type won’t rescue anything by itself, either: old coins will have to be moved to it.
That address type is already on paper. The draft BIP-360, a Bitcoin Improvement Proposal assigned its number in December 2024, proposes Pay-to-Merkle-Root (P2MR), an output type that drops the payment path which reveals the key. Its authors admit it only protects coins that sit still for a long time, not a fresh transaction caught in a race. Switching to it means moving your coins. Someone who lost their keys, or died, will never move anything.
That leads to the ugliest argument. Programmer Jameson Lopp and his co-authors laid out a strict schedule in a draft called BIP-361. About three years after the rule activates, the network stops accepting payments to vulnerable addresses. Two years after that, old signatures only work through a special rescue protocol meant to tell the real owner from a quantum thief. Coins that never get moved to new addresses stay stuck forever, and the supply in circulation shrinks. The authors state their reason plainly: “We may not know the attack is underway.”
The most famous of these coins are linked to bitcoin’s pseudonymous creator. Glassnode calls the coins from Satoshi Nakamoto’s era, parked at the earliest addresses, the most stubborn part of the exposed supply. The BIP-361 authors concede that for those addresses, no one currently thinks a rescue protocol is possible, and they defer to a separate proposal called Hourglass. So even their own plan leaves Satoshi’s coins in limbo. To justify the plan, they quote Satoshi himself: “Lost coins only make everyone else’s coins worth slightly more. Think of it as a donation to everyone.” Then they turn the quote around: “Quantum recovered coins only make everyone else’s coins worth less. Think of it as a theft from everyone.”
For bitcoin, that is close to heresy. Since 2009 the network has promised that coins answer only to whoever holds the key. The alternative is no prettier: one day, millions of dormant coins go to whoever builds the right machine first. The authors of Google’s paper suggest a third path they call “digital salvage”: rules for putting abandoned assets back into circulation or destroying them, rather than letting whoever grabs them first keep them. Nobody yet knows who would write such rules for a network that has no owner.
The race for fresh transactions, where the Alice & Bob estimate still lags, isn’t settled either. The team hasn’t yet calculated whether more qubits could squeeze the attack under ten minutes, though Goudarzi allows that further work could bring estimates close to Google’s nine minutes. And he added that there is no obvious limit to how low these numbers can go: “There is no architectural floor.”
