In a new study, scientists from French quantum startup Alice & Bob and their co-authors calculated the resources a quantum computer could need to solve the secp256k1 elliptic-curve cryptography problem used to secure Bitcoin. Their estimate matters because Shor’s algorithm could potentially recover private keys from known public keys, although quantum systems capable of carrying out the attack do not currently exist.

The researchers estimated that a quantum computer based on a superconducting cat-qubit architecture could need about 29,600 physical qubits and 62 minutes to complete the calculation. They presented the result as a theoretical resource estimate, not a demonstration of a real-world attack.

How a quantum computer could recover a private key

The paper assessed the resources required to run Shor’s algorithm on two quantum processor architectures: cat qubits using repetition codes and LDPC-cat. The researchers described the required logical operations, the allocation of physical qubits on the chip and the computation schedule.

For Bitcoin, the central calculation involves solving the elliptic-curve discrete logarithm problem on secp256k1, or ECDLP. The problem underpins the cryptography used to create digital signatures and secure cryptocurrency wallets. If an attack succeeded, Shor’s algorithm could potentially derive a private key from its corresponding public key.

The authors calculated that the operation would require no more than 30,000 cat qubits and take about an hour. They also estimated that breaking RSA-2048 would require about 22,593 qubits and 3.14 days, while solving FFDLP-512 would require about 6,700 qubits and 21 minutes. Reducing the estimated time needed to break RSA-2048 to 1.25 hours would require roughly 611,000 qubits.

The main estimates assume an error-correction cycle of one microsecond, a reaction time of 10 microseconds and no bit-flip errors. The no-bit-flip condition corresponds to a qubit-state lifetime of about 100 years. If that assumption were relaxed to a one-hour lifetime by adding another level of error correction, the estimated requirement for RSA-2048 would rise to roughly 45,000 qubits.

Potential exposure for Bitcoin holders

Estimates cited in the study indicate that the potential threat could affect 6.26 million BTC whose public keys have already been exposed. That does not mean the coins can be stolen today: such an attack would require a quantum computer capable of performing the calculations with the necessary precision and error correction.

The estimate follows earlier warnings about quantum risks to cryptocurrencies. Google Quantum AI previously said future quantum systems could break modern cryptography faster than expected, intensifying debate over a transition to post-quantum cryptography.

Coinbase has called for preparations to protect Bitcoin from such threats and presented technical recommendations for upgrading the network’s cryptographic protections. Cardano founder Charles Hoskinson criticized the BIP-361 proposal, saying its implementation would not eliminate risks for all coins.

StarkWare has identified a successful quantum-resistant transaction on the Bitcoin network. Stacks co-founder Muneeb Ali said uncertainty about Bitcoin’s quantum security could deter institutional investment.

Source: Incrypted