Researchers Say 30,000-Qubit Quantum Computer Could Crack Bitcoin Keys in One Hour

Researchers have estimated that a future quantum computer with approximately 30,000 physical qubits could break the cryptography protecting Bitcoin private keys in about one hour. The findings raise new questions about how prepared Bitcoin is for advances in quantum computing.

The research comes from scientists associated with Alice & Bob, a quantum computing company based in France and the United States.

In a research paper published on October 28, 2026, the scientists estimate that a specialized quantum computer using approximately 29,588 physical qubits could solve the mathematical problem behind Bitcoin’s public-key cryptography in around 61.8 minutes.

That could theoretically allow an attacker to calculate a Bitcoin private key from its corresponding public key.

However, there is an important distinction: the researchers have not cracked Bitcoin, and no existing quantum computer has demonstrated the ability to perform this attack.

Their findings are mathematical and engineering estimates based on a proposed quantum computing architecture.

Still, the results are significant because they suggest that breaking widely used cryptocurrency security systems may require fewer quantum computing resources than previously believed.

What Did the Quantum Researchers Discover?

The study, titled Shor’s Algorithm Compiled on Cat Qubits: 22,593 Qubits for RSA-2048 in 3.14 Days, examines how quantum computers could attack commonly used cryptographic systems.

These include RSA encryption and elliptic-curve cryptography.

Elliptic-curve cryptography is particularly important for Bitcoin because it is used to generate and verify digital signatures that authorize transactions.

The researchers estimated that their proposed quantum architecture could achieve the following results:

Cryptographic problem	Estimated physical qubits	Estimated time
Bitcoin’s secp256k1 elliptic-curve problem	29,588	61.8 minutes
RSA-2048 factoring	22,593	3.14 days
512-bit finite-field discrete logarithm	About 6,700	About 21 minutes

These figures are theoretical estimates under specific technical assumptions. They are not measurements from a functioning quantum computer.

The researchers fully compiled the RSA-2048 calculation into their proposed architecture. The Bitcoin-related estimate reuses parts of that work, meaning the approximately one-hour result is not an independently demonstrated end-to-end Bitcoin attack.

The study was posted to the IACR Cryptology ePrint Archive, a platform for sharing cryptography research. As of publication, it is a preprint rather than a peer-reviewed journal publication.

What Is a Quantum Computer?

A quantum computer is a type of computer that uses principles of quantum physics to process information.

Ordinary computers use bits.

A bit can represent either 0 or 1.

Quantum computers use quantum bits, commonly called qubits.

Unlike ordinary bits, qubits can exist in combinations of states through a property known as superposition. Quantum computers can also use quantum entanglement and interference to perform certain calculations differently from traditional computers.

This does not mean quantum computers are automatically faster at everything.

Their advantage depends on the problem being solved and the algorithm being used.

One area where sufficiently advanced quantum computers could have a major advantage is cryptography.

Certain mathematical problems that are extremely difficult for conventional computers could become much easier to solve using quantum algorithms.

That is why researchers are studying how quantum computing might affect Bitcoin and other cryptocurrencies.

How Could a Quantum Computer Crack a Bitcoin Private Key?

To understand the risk, it helps to know how Bitcoin wallets work.

A Bitcoin wallet uses cryptographic keys to control access to funds.

There are two important types of keys:

• Private key: A secret number used to authorize transactions. Anyone who obtains it may be able to spend the Bitcoin controlled by that key.
• Public key: A mathematically related value that can be shared and used to verify digital signatures.

Bitcoin uses cryptography based on an elliptic curve called secp256k1.

With today’s conventional computers, calculating a public key from a private key is straightforward.

Doing the reverse is computationally impractical when the system is correctly implemented.

For example, suppose a Bitcoin wallet has a private key and generates a corresponding public key.

The wallet can use its private key to create a digital signature proving that it is authorized to spend Bitcoin.

Other computers on the network can verify the signature using public information.

They do not need to know the private key.

Where does quantum computing become dangerous?

A sufficiently powerful quantum computer could use a mathematical method called Shor’s algorithm.

Shor’s algorithm can solve certain problems involving large-number factoring and discrete logarithms much more efficiently than known classical methods.

For Bitcoin, the relevant problem is the elliptic-curve discrete logarithm problem.

If a quantum computer could solve it, an attacker might be able to take an exposed Bitcoin public key and calculate its corresponding private key.

The attacker could then potentially create valid signatures to authorize transactions without the legitimate owner’s permission.

This would undermine a fundamental security property of Bitcoin transactions.

However, such an attack would require a highly advanced, fault-tolerant quantum computer capable of performing an enormous number of accurate operations.

That technology has not yet been demonstrated at the required scale.

Why Are Researchers Talking About Just 30,000 Qubits?

One of the most important findings is the reduction in the estimated number of qubits required.

In March 2026, Google Quantum AI published research suggesting that breaking the cryptography used by Bitcoin could require fewer than 500,000 physical qubits under its proposed superconducting architecture.

Alice & Bob’s latest work proposes an architecture requiring approximately 30,000 physical qubits for the same underlying elliptic-curve mathematical problem.

That is a considerably smaller estimate.

However, the two studies use different quantum architectures, error models, and technical assumptions.

Their qubit counts should not be treated as directly interchangeable measurements of the same hardware.

What are cat qubits?

Alice & Bob’s research focuses on a specialized type of superconducting qubit known as a cat qubit.

Cat qubits are designed to suppress certain types of quantum errors at the hardware level.

This matters because quantum computers are extremely sensitive to errors.

Noise, imperfect operations, and interactions with the environment can cause qubits to lose information or produce incorrect results.

A fault-tolerant quantum computer must detect and correct many of these errors while performing calculations.

That process usually requires additional physical qubits.

By using qubits designed to reduce particular errors, researchers hope to lower the hardware requirements for large quantum calculations.

The Alice & Bob paper combines this approach with proposed error-correction techniques and improvements to the operations used by Shor’s algorithm.

The result is a lower theoretical resource estimate.

Does having 30,000 qubits automatically mean Bitcoin can be cracked?

No.

The number of qubits is only one requirement.

The qubits must also have sufficiently low error rates, support the necessary operations, and remain reliable throughout the computation.

For example, the new estimates assume a one-microsecond error-correction cycle, a ten-microsecond reaction time, and extremely low phase-flip error rates.

The main architecture also assumes the absence of bit-flip errors. The paper explores how additional error correction could relax that assumption, although doing so requires additional resources.

These are demanding engineering requirements that have not been achieved together at the scale necessary for the proposed attack.

A quantum computer with 30,000 poorly controlled qubits would not necessarily be capable of breaking Bitcoin keys.

The important measurement is not simply how many qubits a machine contains, but how reliably it can execute the required computation.

Is Bitcoin Already Vulnerable to Quantum Attacks?

Bitcoin is theoretically vulnerable to sufficiently powerful quantum computers, but there is no verified evidence that a quantum computer has recovered a Bitcoin private key by breaking secp256k1 cryptography.

The current threat is about what future quantum technology might make possible.

However, not all Bitcoin holdings have the same level of public-key exposure.

Why exposed public keys matter

Some Bitcoin address types hide the full public key behind a cryptographic hash until funds are spent.

Other output types reveal public keys immediately.

When a Bitcoin public key is exposed, a future quantum attacker could potentially target it using Shor’s algorithm.

Consider two situations.

Situation 1: A public key has never been revealed

Some wallet arrangements reveal only a hash of the public key while the associated Bitcoin remains unspent.

An attacker who sees only the hash does not automatically have the public key needed for the specific quantum attack described in the research.

Situation 2: A public key is already visible

If the public key is recorded on the blockchain, a future sufficiently powerful quantum computer could attempt to calculate the corresponding private key.

This creates particular concerns for older Bitcoin outputs, reused addresses, and certain modern output types.

For example, Taproot outputs expose a public-key equivalent in their output structure.

That does not mean Taproot is insecure against today’s conventional computers. It means its public-key exposure creates a different risk under the future quantum attack model.

The Bitcoin Improvement Proposal BIP-360 discusses these differences and proposes a way to reduce certain long-exposure quantum risks.

How Much Bitcoin Could Be at Risk?

Research suggests that millions of bitcoins are associated with public keys that have already been exposed.

In a May 2026 analysis, blockchain analytics company Glassnode estimated that approximately 6.04 million BTC, representing 30.2% of the issued Bitcoin supply at the time, had public-key exposure while the coins remained unspent.

The researchers divided the exposure into two main categories:

1. Structural exposure

Approximately 1.92 million BTC was associated with output types that reveal public-key information by design.

These include certain older Bitcoin outputs and Taproot outputs.

2. Operational exposure

Approximately 4.12 million BTC was exposed because of factors such as address reuse or previous spending activity that revealed public keys.

These numbers are estimates based on Glassnode’s methodology and its May 2026 blockchain snapshot. They are not a count of bitcoins already stolen or proven recoverable by current quantum machines.

They also do not mean that all the identified coins would necessarily be stolen if powerful quantum computers became available.

Owners could potentially move some funds to quantum-resistant arrangements once suitable protections exist.

Nevertheless, the findings show why researchers consider Bitcoin’s exposed public keys an important long-term security issue.

Could a Quantum Computer Steal Bitcoin Before a Transaction Is Confirmed?

Bitcoin produces a new block approximately every ten minutes on average.

When a transaction is broadcast to the network, its public-key information may become visible before the transaction is confirmed.

This creates another possible attack scenario.

A sufficiently powerful quantum computer might attempt to calculate the private key and broadcast a competing transaction before the original transaction is confirmed.

This is sometimes called a short-exposure attack.

However, the Alice & Bob estimate of approximately 61.8 minutes is longer than Bitcoin’s average ten-minute block interval.

That means the proposed machine would not generally be fast enough to complete the calculation before a normally timed first confirmation.

There are important qualifications.

Some Bitcoin transactions remain unconfirmed for much longer than ten minutes, particularly when transaction fees are too low during busy periods.

A one-hour quantum attack could therefore still be relevant to transactions that remain pending long enough.

Other researchers have also proposed different attack architectures with shorter theoretical runtimes.

For instance, Google’s March 2026 work described configurations that could theoretically complete certain elliptic-curve attacks in minutes using substantially more physical qubits.

It is therefore incorrect to conclude that Bitcoin would be safe from transaction interception simply because this particular model takes about an hour.

When Could Quantum Computers Become a Real Threat to Bitcoin?

Nobody knows exactly when quantum computers will become powerful enough to break Bitcoin’s cryptography.

Researchers continue to improve quantum hardware, algorithms, and error-correction methods.

Some quantum computing companies anticipate major progress during the next several years.

Alice & Bob has suggested that quantum hardware improvements and declining resource requirements could converge in the early 2030s.

However, that is a projection, not a confirmed arrival date.

The difference between demonstrating small-scale quantum experiments and operating a large, fault-tolerant machine capable of breaking cryptographic keys remains substantial.

There are also competing approaches to quantum computing, each with different advantages, limitations, and development challenges.

The new research demonstrates how estimates can change as mathematical methods improve.

It does not establish when the necessary hardware will exist.

Can Bitcoin Be Upgraded to Resist Quantum Computers?

Yes, Bitcoin could potentially adopt quantum-resistant cryptographic techniques.

These are methods designed to remain secure against both conventional computers and known quantum attacks.

However, the upgrade process would be complex.

Bitcoin is decentralized, meaning no single company or developer can simply replace its cryptographic rules for every user.

Changes to Bitcoin’s transaction validation rules require technical development, testing, and coordination among network participants.

Developers would need to address several challenges.

1. New signature algorithms

Bitcoin would need ways to authorize transactions using cryptographic methods believed to resist quantum attacks.

Possible approaches include hash-based signatures and other post-quantum signature schemes.

2. Larger transaction sizes

Some post-quantum cryptographic systems use larger signatures and public keys than Bitcoin’s existing arrangements.

This could increase transaction data requirements and affect fees or network capacity.

3. Wallet compatibility

Wallet developers would need to support new address types, key-management processes, and transaction formats.

4. Protecting existing coins

Some Bitcoin holdings are stored in addresses whose owners may be inactive, unreachable, or unable to migrate their funds.

Deciding how to handle these coins could become a difficult technical and governance question.

5. Reaching agreement

Bitcoin upgrades require broad review and coordination across a global network of users, miners, developers, exchanges, and infrastructure providers.

A major cryptographic transition would therefore need careful planning.

Are Bitcoin Developers Already Working on Quantum Resistance?

Yes.

One example is Bitcoin Improvement Proposal 360 (BIP-360), which proposes an output type called Pay-to-Merkle-Root, or P2MR.

The proposal aims to reduce long-exposure quantum risks associated with revealing public keys in certain Bitcoin output structures.

P2MR is not a complete quantum-resistant replacement for Bitcoin’s existing signature algorithms.

It is intended as a possible step toward improving Bitcoin’s defenses against particular quantum attacks.

Full protection against attacks on public keys revealed during transaction spending would require additional cryptographic changes.

The existence of BIP-360 shows that the Bitcoin development community is examining these risks.

However, a proposal should not be confused with an activated Bitcoin network upgrade.

What Should Ordinary Bitcoin Holders Do?

There is no evidence that Bitcoin users need to panic or immediately sell their holdings because of this research.

The proposed attack cannot currently be performed by known quantum hardware.

However, users can follow sensible security practices.

Avoid unnecessary address reuse. Reusing certain Bitcoin addresses can leave funds associated with public keys that have already been revealed.

Keep wallet software updated. Future security improvements will depend partly on wallet developers supporting new standards.

Protect private keys and recovery phrases. Phishing, malware, fraudulent investment schemes, and stolen recovery phrases remain real threats today.

Follow credible Bitcoin security research. Technical developments should be assessed through original research, established security experts, and well-reviewed Bitcoin proposals.

Be skeptical of quantum-proof wallet marketing. A company claiming its wallet is quantum-resistant should explain exactly which cryptographic methods it uses and what risks remain.

Moving funds without understanding the destination wallet’s security arrangements can create additional risks.

There is currently no universal Bitcoin wallet upgrade that makes all ordinary Bitcoin transactions fully resistant to every relevant future quantum attack.

Frequently Asked Questions

Can quantum computers crack Bitcoin today?

No. No existing quantum computer has demonstrated the ability to recover Bitcoin private keys by breaking secp256k1 cryptography.

Did researchers actually crack Bitcoin in one hour?

No. The researchers calculated that a hypothetical advanced quantum computer using their proposed architecture might solve the relevant mathematical problem in approximately 61.8 minutes.

How many qubits would be needed to break Bitcoin?

The latest Alice & Bob model estimates approximately 29,588 specialized physical cat qubits under demanding technical assumptions. Other researchers have produced different estimates using other architectures.

What is Shor’s algorithm?

Shor’s algorithm is a quantum computing algorithm capable of efficiently solving certain mathematical problems underlying widely used public-key cryptographic systems.

Can someone steal Bitcoin using a public key?

Not with known conventional computing methods. However, a sufficiently advanced quantum computer could theoretically derive a private key from an exposed public key.

Are all Bitcoin addresses vulnerable?

Not in the same way. Some output types reveal public keys or public-key equivalents, while others initially hide them behind hashes. The timing and nature of public-key exposure affect the quantum risk.

Is Bitcoin mining vulnerable to the same attack?

Bitcoin mining relies on hashing rather than the elliptic-curve signature problem targeted by Shor’s algorithm. Quantum computing may affect mining economics in other ways, but it is a different security question.

What is BIP-360?

BIP-360 is a Bitcoin improvement proposal introducing Pay-to-Merkle-Root, a proposed output type intended to reduce certain quantum risks associated with public-key exposure.

When will Bitcoin become quantum-resistant?

There is no confirmed date for a complete quantum-resistant upgrade. The process would require technical research, implementation, testing, and network coordination.

Should I sell my Bitcoin because of quantum computing?

The research does not establish an immediate cryptographic break. Investment decisions should consider a range of financial risks rather than a theoretical future attack alone.

Key Takeaways

• Alice & Bob researchers estimate that approximately 29,588 physical cat qubits could solve Bitcoin’s underlying elliptic-curve cryptographic problem in about 61.8 minutes.
• The study was published as a research preprint on October 28, 2026.
• The findings are theoretical estimates, not evidence that Bitcoin has been hacked.
• The model depends on demanding assumptions about quantum hardware and error correction.
• Glassnode estimated in May 2026 that approximately 6.04 million BTC had public-key exposure while unspent.
• Bitcoin developers are researching possible protections, including BIP-360.
• No reliable timeline exists for when a quantum computer capable of performing this attack will become available.

Sources and Further Reading

1. Alice & Bob researchers, original research paper, IACR Cryptology ePrint Archive, October 2026
2. Bitcoin.com News, Quantum Researchers Say 30K Qubits Could Crack Bitcoin Keys in Just One Hour, October 29, 2026
3. Google Quantum AI, Securing Elliptic Curve Cryptocurrencies Against Quantum Vulnerabilities, March 2026
4. Glassnode, Measuring Bitcoin’s Quantum-Exposed Supply, May 2026
5. Bitcoin Improvement Proposal 360, Pay-to-Merkle-Root
6. IonQ, Quantum Threat to 256-Bit Elliptic-Curve Cryptography, September 2026