Google says its Willow quantum processor has reduced errors by around 40 times when preparing specialized quantum states used in advanced computations. The development addresses a major hardware limitation that researchers must overcome before quantum computers could potentially compromise Bitcoin wallets.

The findings, published in Science this week, highlight an often-overlooked aspect of Bitcoin’s quantum security debate. While discussions frequently center on how many qubits an attacker would need, they tend to underestimate the resources required to prepare and operate a machine capable of performing the necessary calculations.

Why older Bitcoin wallets could be more exposed

Bitcoin uses private keys to authorize transactions and corresponding public keys to verify them. Public keys are revealed when certain transactions are made, while some address formats expose them from the outset.

Conventional computers cannot practically derive private keys from public keys. However, a sufficiently powerful quantum computer running Shor’s algorithm could theoretically accomplish this, enabling an attacker to sign transactions and transfer the associated bitcoin. Mathematician Peter Shor developed the algorithm in 1994, but no one has demonstrated such an attack against Bitcoin.

Keeping a recovery phrase offline would not prevent an attack based on a public key already visible on the blockchain.

Some Bitcoin transaction formats conceal public keys behind cryptographic hashes until the funds are spent. An attacker targeting these wallets would need to wait for the key to become visible and potentially calculate the corresponding private key before the transaction is confirmed.

Lost coins present another complication. Migrating bitcoin to stronger cryptographic protections generally requires access to the existing private keys. If those keys are lost, the owner cannot transfer the funds, potentially leaving publicly exposed keys vulnerable to future quantum attacks.

Some of Bitcoin’s earliest holdings have had their public keys exposed since they were first mined.

Several long-dormant wallets have also transferred funds amid growing discussion of quantum computing. On Oct. 7, a wallet moved 100.02 BTC that had remained untouched since July 2010, worth approximately $8.5 million at the time. In August, six wallets inactive since 2011–2014 transferred another 553.59 BTC, valued at around $40 million.

These transactions do not necessarily indicate that their owners are responding to quantum risks. Wallet transfers can also reflect changes in custody, reorganized holdings or preparations to sell.

Why preparing a quantum computer is so expensive

Quantum computers rely on quantum bits, or qubits, which are highly sensitive to environmental disturbances. Heat, vibration and unwanted signals can introduce errors, while adding more qubits creates further opportunities for mistakes.

Engineers address this problem by grouping physical qubits into systems that detect and correct errors. These groups function as more reliable computational units called logical qubits.

Certain quantum operations also require specially prepared states known as magic states. Because these states are consumed during use, the computer must continuously generate new ones throughout a calculation.

Consequently, hardware devoted to producing magic states cannot simultaneously perform other tasks, adding substantial overhead to a potential quantum attack.

Google’s cultivation method aims to make this preparation process more efficient. It starts with an imperfect quantum state, checks for errors and discards unsuccessful attempts, keeping only states that meet the required standards.

The company reported approximately 99.99% fidelity, meaning the states that passed inspection closely matched their intended forms. However, only around 8% of attempts survived the preparation and measurement process, meaning roughly eight out of every 100 attempts produced acceptable results.

Further work is needed to scale up the technique, preserve state quality during longer calculations and integrate the process with more advanced error-correction systems.

How Willow fits into Bitcoin’s quantum threat

In March, Google estimated that a future superconducting quantum computer with fewer than 500,000 physical qubits could break the cryptographic protections used by Bitcoin and Ethereum under particular hardware assumptions.

In September, research covered by CoinDesk described improvements that reduced the computational workload for one component of a potential attack. That work did not account for the entire attack or all the physical infrastructure required to execute it.

The studies address different challenges: earlier research reduces the mathematical workload, while cultivation targets the hardware resources needed to prepare quantum states for those calculations.

These advances cannot simply be combined to claim that the cost of attacking Bitcoin has fallen by a corresponding multiple. Google’s March estimate already assumed an efficient method of producing magic states. The Willow experiment evaluates part of that engineering approach rather than providing an additional 40-fold reduction in the estimated cost of breaking Bitcoin’s cryptography.

Google’s earlier research also illustrated the scale of the resources involved. One modeled attack, lasting approximately nine minutes after a public key became available, would require an estimated 500,000 sufficiently reliable magic states per second.

The bottom line: Willow demonstrates progress in reducing an important quantum-computing bottleneck, but it does not mean Bitcoin wallets can now be cracked. Building a quantum computer capable of executing such an attack remains a significant engineering challenge.