- A French quantum hardware firm says it has found a way to cut the machine needed to break a bitcoin key by a factor of 17.
- Seventeen times smaller than enormous is still enormous. The largest quantum processors anyone has announced are orders of magnitude short.
- is not the weak point. The signatures that prove coins are yours are, and millions of coins have been advertising theirs for years.
Quantum computing headlines arrive on a schedule, usually announcing that bitcoin is finished and then going quiet for a year. This one moves a number that genuinely matters, so it is worth understanding what the number measures and how much further it still has to fall.
If a machine capable of this is ever built, the coins at risk will not be spread evenly. They will be the ones held at addresses that have already published the mathematical fingerprint an attacker needs, which covers most addresses that have ever sent a payment and a very large block of coins untouched since 2009 and 2010.
Nothing you hold is exposed by this research today, and there is no product to buy that fixes it. But whether you reuse the same receiving address over and over is a habit you can change this week, and it is the only part of this that is currently in your hands.
What you actually own when you own bitcoin
Your bitcoin does not sit inside a wallet the way cash sits in a purse. It sits on a public ledger, and what you own is the ability to move it.
That ability comes from a : a 256-bit number, essentially a randomly chosen value so large that guessing it is not worth discussing. From that private key, your wallet calculates a second number called the public key. From the public key, it calculates a shorter string called an address, which is the thing you hand out when someone pays you.
When you spend, your wallet uses the private key to produce a signature. The network checks the signature against the public key and confirms the payment is authorised, without the private key ever appearing anywhere.
The one-way street quantum machines threaten
The chain from private key to public key runs in one direction only. Bitcoin uses elliptic-curve cryptography, a branch of maths where multiplying is easy and reversing the multiplication is, for a normal computer, hopeless. Every machine on earth working together would not get there.
A quantum computer running Shor’s algorithm does not face that wall. Given a public key, it can in principle run the maths backwards and recover the private key. No hacking, no phishing, no access to your device. Just arithmetic that current hardware cannot do and future hardware might.
That is the whole threat, and it is narrower than most coverage suggests.
Mining is the part that is fine
Mining uses SHA-256 hashing rather than elliptic curves. Quantum computers do have an advantage against hashing, via Grover’s algorithm, but it is a square-root speedup rather than the wholesale collapse Shor delivers against elliptic curves. Doubling the difficulty, or in the worst case moving to a longer hash, absorbs it.
Addresses that are hashes of a public key get the same partial protection, and that distinction turns out to matter a great deal.
Which coins are actually exposed
Modern bitcoin addresses are derived from a hash of the public key, which means the public key itself stays hidden until the first time you spend. No public key on the ledger, nothing for Shor’s algorithm to work on.
Three groups do not get that cover. The earliest coins, from 2009 and 2010, were often paid directly to a raw public key with no hash in front of it, and those keys have been sitting in plain view ever since. That category includes the coins widely believed to have been mined by Satoshi Nakamoto. Second, any address that has sent a payment has revealed its public key in the process, so leftover balances at spent-from addresses are visible in the same way. Third, anyone who reuses one address to receive repeatedly is doing both at once.
Estimates of how much bitcoin sits in that exposed state vary by methodology. The figure most often cited, from an analysis by Deloitte, is somewhere around a quarter of all coins mined.
There is a fourth, trickier case. Even a well-behaved address reveals its public key at the moment you broadcast a spend, and the transaction then waits roughly ten minutes for a block. A fast enough attacker could in theory derive the key inside that window and push out a competing transaction paying themselves. That requires a machine not just capable of the maths but capable of it in minutes, which is a far harder specification than cracking a key at leisure.
What 17 times smaller still leaves
The research comes from Alice & Bob, a Paris-based firm building what it calls cat qubits, an approach designed to suppress one of the two main types of quantum error so that fewer physical components are needed to build each reliable logical one. Error correction is where almost all the hardware cost lives, so improvements there move the headline number sharply.
We have not seen the underlying paper, and the 17-fold figure is the company’s own description of its model as relayed by CoinDesk, so treat it as a claim with working behind it rather than a measured result.
Scale matters more than the multiplier anyway. Published estimates for attacking bitcoin’s curve have run from the high hundreds of thousands into the tens of millions of physical qubits, depending on error rates and how quickly the attack has to finish. The largest processors publicly announced sit in the hundreds to low thousands of physical qubits, and the number of fully error-corrected logical qubits demonstrated anywhere is in single figures. Divide a very large number by 17 and you still have a very large number.
What the result changes is the slope. Each improvement of this kind shortens the runway, and the runway is what the ’s timetable depends on.
What anyone can do about it
Bitcoin developers have been working on post-quantum signature schemes for some time, including a draft proposal to add a quantum-resistant address type that holders could migrate into. Adding one is the straightforward half. The hard half is the roughly four million coins whose owners are dead, lost or uninterested, which cannot migrate and would become a standing bounty, and the only remedies anyone has proposed for that involve freezing coins that belong to somebody.
Our inference, clearly labelled as inference: the fight that actually decides this will be about those old coins rather than about the cryptography. A signature upgrade is an engineering problem with known solutions. Deciding whether a network defined by nobody being able to touch your money can make an exception is not.
For a UK holder, the practical list today is short. Stop reusing addresses, which costs nothing and is what modern self-custody wallets do by default anyway. Keep your safe, while remembering it protects against theft rather than against maths. And treat any firm offering to migrate your coins somewhere quantum-safe as a scam until proved otherwise, because that offer is exactly how this story will be monetised by people who are not building quantum computers.
What to watch
Two things. Whether the Alice & Bob model is independently reviewed and reproduced, because a single company’s estimate of its own architecture is where this kind of figure usually starts and not where it should end. And whether the migration debate among bitcoin developers gets a timetable attached to it.
Next time a quantum headline lands, the question worth asking is not how many qubits the machine has. It is how many of them are error-corrected, and whether the attack described finishes in ten minutes or ten years.