Bitcoin's Quantum Bill: 2.3M BTC May Sit in Exposed Keys

Google's quantum researchers have put a figure on bitcoin's exposure to a future quantum computer, and a large part of it cannot move. A little over 1.7 million bitcoin, nearly 9% of supply, sits in pay-to-public-key (P2PK) outputs, where the public key is written onto the blockchain rather than hidden behind a hash, the paper states. Counting every script type, it says the total amount of dormant quantum-vulnerable bitcoin may reach 2.3 million BTC.

At the freshest price read available, $80,915.17 at 7:15 a.m. ET on 15 October, 2.3 million bitcoin is about $186 billion, and the 1.7 million in P2PK outputs is about $138 billion. The paper's own description of that stock is blunter: "a fixed target, tens or hundreds of billions of dollars in value that will eventually become accessible to a quantum attacker."

Google's Estimate Shrinks the Hardware Requirement

The document is Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations, a 57-page paper submitted on 30 March 2026 and credited on its listing to Ryan Babbush and seven other authors. Its abstract states that the circuits it describes can execute in minutes on superconducting architectures with 1e-3 physical error rates and planar connectivity using fewer than half a million physical qubits.

In a companion post, Google's researchers frame that as an approximately 20-fold reduction in the physical qubits needed, and describe it as a continuation of "a long history of gradual optimization in compiling quantum algorithms to fault-tolerant circuits." They compiled two circuits for ECDLP-256, the discrete-log problem behind elliptic curve keys: one using fewer than 1,200 logical qubits, the error-corrected kind, and 90 million Toffoli gates, the other fewer than 1,450 logical qubits and 70 million Toffoli gates.

P2PK, Taproot and the Keys Already on Chain

The exposure splits by script type. P2PK coins are vulnerable to both at-rest and on-spend attacks, because the public key is disclosed directly in the locking script. P2PKH is immune to at-rest attacks but not on spend: once such an output is spent, the public key is revealed, and any remaining or future coins sent to the same public-key hash are, in the paper's words, "blatantly vulnerable to a quantum attacker."

Taproot (P2TR) stores the tweaked public key directly in the locking script, without hiding it behind a hash, which the paper calls a security regression because it brings back the quantum exposure of P2PK and P2MS addresses.

An at-rest attack is the patient kind: it targets a public key left exposed on chain for a long time, such as a dormant wallet with a reused key, and the attacker has days or more to derive the private key.

Why the On-Spend Window Is Measured in Minutes

Bitcoin's average block interval is about ten minutes, and the public mempool is a ready source of public keys for on-spend attacks. Google estimates around 9 minutes per private key derivation on a superconducting qubit cryptographically relevant quantum computer (CRQC), with a success probability slightly under 41% under idealized assumptions. It adds that if that 9 minutes could be cut by a few, "even high-fee transactions at times of low congestion would be likely to get compromised."

Shorter settlement narrows the window. The paper lists about 400 milliseconds for Solana, about 12 seconds for Ethereum and about 10 minutes on average for Bitcoin. On that basis Google estimates a less than 3% success probability against Litecoin, which targets 2.5 minutes between blocks, and less than one in eight thousand for Dogecoin.

Architecture matters for who can attempt it. Google distinguishes fast-clock designs, superconducting and photonic, from slow-clock ones using neutral atoms or ion traps, and says the first fast-clock CRQCs would enable on-spend attacks on public mempool transactions of some cryptocurrencies. It does not expect the slower architectures to be able to launch them. Bitcoin's own chain is immune to on-setup attacks, but scaling tools such as Ethereum's Data Availability Sampling and privacy protocols such as Tornado Cash are not.

Coinbase's Board Puts the Count Near 7 Million BTC

The Coinbase Independent Advisory Board on Quantum Computing and Blockchain counts more. It estimates roughly 7 million bitcoin could face some form of future quantum exposure, including about 1.7 million BTC in legacy P2PK addresses and around 5 million BTC tied to address reuse. On address reuse, it cites Project11 for the figure and says most of those coins are assumed to belong to active users rather than being lost, with many held in the large cold wallets of known exchanges. Google's paper names Binance, Robinhood and Bitfinex among the large exchange-linked holdings in a figure on exposed assets.

The board's June 2026 report lists Prof. Scott Aaronson (UT Austin), Prof. Dan Boneh (Stanford), Justin Drake (Ethereum Foundation), Prof. Sreeram Kannan (Eigen Labs and University of Washington), Prof. Yehuda Lindell (Coinbase and Bar-Ilan University) and Prof. Dahlia Malkhi (UCSB). Its stated position is that quantum computers are not a threat to blockchains today, that exact timelines are unknown, and that preparation for a post-quantum reality should begin now.

It also flags the market side. A large number of lost or dormant coins recovered through quantum attacks, it warns, could sharply increase bitcoin's effective circulating supply and cause a sharp decline in the price. One proposed brake, "Hourglass," would limit how many bitcoin from P2PK addresses can be spent per block. On what to do with the coins themselves, the board lays out two positions: burn them at a set deadline, or enable post-quantum addresses and take no further action.

The Fixes on the Table, and What Stays Unfixed

For coins that move next, there is a draft. BIP-360 proposes a script type called Pay-to-Merkle-Root (P2MR), essentially P2TR with the quantum-vulnerable key path spend removed. Google's blog points to a 2029 migration timeline and work with Coinbase, the Stanford Institute for Blockchain Research and the Ethereum Foundation.

Hardware work is moving too. Google Quantum AI says it demonstrated "magic state cultivation" on its Willow processor, cutting errors about 40x against un-cultivated states and hitting a record logical fidelity of 99.99% for cultivated T-states, work now published in Science. The bottleneck was real: some estimates put as much as 95% of a quantum computer's capacity into producing those states.

None of it changes the arithmetic for the 1.7 million bitcoin already sitting in P2PK outputs. Their public keys are on chain today, so the clock is set by the hardware and not by their owners, and the paper's own figure for the dormant stock, up to 2.3 million BTC, is the slice with no migration path.