Quantum computing company Alice & Bob said Thursday that a quantum computer built from approximately 30,000 of its cat qubits could crack a Bitcoin private key in roughly an hour.
The estimate comes from a preprint posted to the IACR Cryptology ePrint Archive targeting secp256k1, the elliptic curve behind Bitcoin signatures. The company calculated the attack would require no more than 29,588 physical qubits and 61.8 minutes. The numbers represent a ceiling, as the Bitcoin calculation reuses circuits compiled to break RSA-2048 encryption.
Cat Qubits and Error Correction
Cat qubits are Alice & Bob's superconducting design that suppress bit-flip errors in hardware, requiring error correction to catch only phase-flips. This reduces the number of physical qubits needed for each error-corrected logical qubit.
In 2023, the company's researchers estimated breaking a 256-bit elliptic curve logarithm would require 126,133 cat qubits and nine hours.
Comparison With Google's Quantum Approach
A Google Quantum AI whitepaper published March 30 distinguished two types of attacks. On-spend attacks target transactions before block confirmation, while at-rest attacks target public keys already exposed on-chain.
Google's design required fewer than half a million physical qubits and could crack a single wallet's private key in about nine minutes once a public key appears, making on-spend attacks possible. Alice & Bob's machine would need far fewer qubits but run longer—its hour-long attack exceeds Bitcoin's 10-minute block time, leaving transactions in progress out of reach, the company stated.
Google identified more than 1.7 million BTC in Pay-to-Public-Key scripts, an early address type that leaves the public key on-chain.
Current Hardware Limitations and Assumptions
Alice & Bob's estimates assume no bit-flips during computation, equivalent to a bit-flip time of about a century. With a bit-flip occurring roughly once per hour, the company's RSA-2048 estimate rises from 22,593 qubits to approximately 45,000.
The company's current hardware remains far from that scale. Results published October 20 covered the first phase of PROQCIMA, the French government's quantum computing program. The largest of three demonstrators ran on a 12-qubit chip, with logical error rates not yet below the error-correction threshold.
Post-Quantum Cryptography Timeline
Alice & Bob expects hardware gains and falling resource estimates to converge in the early 2030s. The company urged organizations to begin transitioning to post-quantum cryptography now. Among post-quantum proposals for Bitcoin, developers including Jameson Lopp have put forward BIP-361, which would freeze quantum-vulnerable legacy addresses in phases.
