Can 30,000 Qubits Really Break Bitcoin? Here’s What the Research Actually Says

A quantum computer that can crack a Bitcoin private key in about an hour sounds like the beginning of a costly disaster.

There’s just one problem. Nobody has built that computer yet.

On October 29, quantum computing company Alice & Bob released research suggesting that a machine with just 29,588 physical qubits could solve the cryptographic problem protecting Bitcoin’s digital signatures in 61.8 minutes.

That’s a considerably smaller hardware requirement than earlier estimates. And yes, the underlying science deserves attention.

But the research doesn’t mean Bitcoin can be hacked today, nor does it mean every Bitcoin wallet would suddenly become vulnerable once such a machine exists.

The answer depends on three things: how the quantum computer works, how long it needs to recover a private key, and whether the wallet’s public key is already exposed.

Ravel examined the research alongside Google’s earlier quantum-security estimates and Bitcoin’s proposed defenses. The interesting part isn’t simply that the number of qubits is shrinking. It’s what happens when those three factors collide.

The 30,000-Qubit Claim Comes With a Catch

Let’s start with the number everyone is talking about.

The research paper published in the IACR Cryptology ePrint Archive estimates that a fault-tolerant quantum computer built using superconducting cat qubits could solve the elliptic-curve discrete logarithm problem underlying Bitcoin’s secp256k1 cryptography.

That matters because Bitcoin’s ECDSA signatures and Taproot’s Schnorr signatures both rely on the difficulty of solving discrete logarithms on that curve.

A sufficiently powerful quantum computer running Shor’s algorithm could potentially recover a private key from an exposed public key.

But Alice & Bob isn’t describing an ordinary quantum processor with 30,000 interchangeable qubits.

Its architecture uses specialized cat qubits designed to suppress one category of quantum error, known as bit flips. That allows the researchers to reduce some of the expensive error-correction overhead that conventional approaches require.

The study assumes an error-correction cycle lasting one microsecond, a classical reaction time of ten microseconds, and a specific phase-flip error rate.

Then comes the biggest assumption: no bit flips during the computation.

In its October 29 announcement, Alice & Bob explain that this corresponds to an average bit-flip interval of roughly a century.

Relaxing that assumption changes the hardware requirements. For RSA-2048, the researchers estimate that allowing an average bit-flip interval of one hour would increase the required qubits from 22,593 to around 45,000.

Importantly, that revised figure applies to RSA-2048, not directly to Bitcoin’s elliptic-curve problem. The paper fully compiles the RSA computation and derives the Bitcoin-related estimate by reusing compiled operations.

There’s also a rather large gap between the proposed architecture and the company’s current hardware.

On October 20, Alice & Bob reported results from three physical demonstrators, including its largest system built on a 12-qubit chip. The experiments demonstrated several building blocks of quantum error correction, but the measured logical error rate had not yet fallen below the required threshold.

That’s meaningful experimental progress. It is not a functioning 29,588-qubit cryptographic attack machine.

Google’s research offers another useful comparison.

In March, Google Quantum AI estimated that a future superconducting quantum computer using fewer than 500,000 physical qubits could break the same broad class of elliptic-curve cryptography within minutes under its stated hardware assumptions.

It’s tempting to conclude that Alice & Bob have made the attack nearly 17 times easier.

But that’s not a fair apples-to-apples comparison.

Google and Alice & Bob use different architectures, error-correction methods, and runtime assumptions. A lower physical-qubit count in one design doesn’t automatically establish superior real-world performance.

The real question is what those machines could accomplish once engineers actually build them.

Which Bitcoin Wallets Would a Quantum Computer Target First?

Here’s where the research becomes more relevant to Bitcoin holders.

Consider two hypothetical wallets.

The first holds Bitcoin behind a public key that anyone can already inspect on the blockchain.

The second uses a fresh pay-to-public-key-hash address that hasn’t revealed its underlying public key.

Both rely on cryptography that a sufficiently capable quantum computer could eventually threaten.

But they don’t offer an attacker the same opportunity.

In the first case, the attacker can theoretically begin working on the exposed public key whenever the necessary machine becomes available.

In the second case, the attacker generally must wait until the owner initiates a transaction that reveals the public key. The attacker then has to recover the private key and get a competing transaction confirmed before the legitimate payment succeeds.

Bitcoin’s developer documentation explains why avoiding address reuse helps prevent unnecessary public-key exposure.

There is another complication that surprises some users: newer address technology doesn’t necessarily mean less exposure to this particular quantum threat.

Under Bitcoin’s Taproot specification, a Taproot output directly contains a public key rather than merely its hash. That makes the output key visible before the coins move, even though Taproot provides other important privacy and efficiency improvements.

So the relevant distinction isn’t simply old Bitcoin versus new Bitcoin.

It’s whether an attacker already has the cryptographic information needed to attempt private-key recovery.

And time changes everything.

Alice & Bob provides two configurations for attacking Bitcoin’s elliptic-curve problem:

Ravel compared those two configurations directly.

Reducing the hardware requirement by just 1,405 qubits, or 4.75%, increases the estimated runtime by 84.2 minutes. That’s a 136.2% increase in computation time.

In other words, the smaller configuration takes more than twice as long.

Compare that with Bitcoin’s average block interval of ten minutes.

The balanced configuration requires the equivalent of 6.18 average block intervals to recover a key. The smaller configuration requires 14.6.

These ratios do not establish the probability of a successful attack. Bitcoin’s ten-minute interval is an average, not a guaranteed confirmation deadline. Some transactions confirm quickly; others can remain pending much longer.

Still, the distinction is revealing.

An hour-long quantum computation looks relatively slow when the attacker must race a normally confirming transaction.

But an hour means very little when the attacker can inspect an exposed public key today, run the computation, and attempt to spend the coins afterward.

That’s why the first serious quantum threat to Bitcoin may not involve intercepting payments.

It could involve wallets that have been sitting quietly for years.

Can Bitcoin Fix the Problem Before Quantum Computers Arrive?

Bitcoin isn’t ignoring the issue.

One proposal, BIP-360, introduces Pay-to-Merkle-Root (P2MR), an alternative output structure designed to address some of the long-exposure risks associated with elliptic-curve public keys.

Unlike Taproot, the proposed structure removes the public-key spending path and commits to a script tree instead.

That can help prevent the output itself from exposing a quantum-vulnerable public key before spending, provided users construct and manage their scripts and keys appropriately.

But BIP-360 remains a draft. It is not an activated Bitcoin upgrade.

And it doesn’t solve everything.

The proposal explicitly distinguishes long-exposure attacks, in which attackers have ample time to work against public keys already visible, from short-exposure attacks targeting keys revealed during pending transactions.

Addressing the second category more comprehensively would require quantum-resistant signature mechanisms.

Those technologies aren’t purely theoretical. The US National Institute of Standards and Technology finalized FIPS 204 in 2024, establishing the ML-DSA digital signature standard designed to resist attacks from large-scale quantum computers.

But introducing a quantum-resistant signature scheme into Bitcoin involves much more than selecting an algorithm.

Developers must consider transaction sizes, network capacity, wallet compatibility, hardware support, migration procedures, and what happens to coins controlled by people who never upgrade.

There is also a difficult governance question: what should Bitcoin do about funds whose owners have disappeared or lost access to their wallets?

Leaving old signatures valid could preserve a route for future quantum theft. Restricting those signatures, however, could affect property rights and Bitcoin’s longstanding expectations around ownership.

Neither option comes without consequences.

And there’s a reasonable counterargument to treating the new research as an immediate emergency.

Quantum hardware still faces enormous engineering challenges. Alice & Bob’s own experimental results demonstrate how much work separates small demonstrators from fault-tolerant machines capable of sustained cryptographic attacks.

Even a technically credible resource estimate cannot tell us exactly when that hardware will arrive.

But uncertainty cuts both ways.

The fact that a quantum computer cannot break Bitcoin today doesn’t guarantee that developers can postpone migration until one appears. Any significant protocol transition would require coordination, testing, adoption, and potentially years of preparation.

So, can 30,000 qubits really break Bitcoin?

Under Alice & Bob’s proposed architecture and assumptions, they could be enough to recover a vulnerable private key in about an hour. But no existing machine has demonstrated that capability, and the result doesn’t mean every Bitcoin balance becomes immediately accessible to an attacker.

The more useful question is whether Bitcoin can reduce public-key exposure and establish credible migration options before practical quantum key recovery becomes possible.

The research hasn’t started a countdown to Bitcoin’s death.

It has made the cost of waiting a little harder to dismiss.