Why Bitcoin is not facing a near-term quantum threat

Since the dawn of Bitcoin, various FUD (fear, uncertainty and doubt) campaigns have tried to herald its end. Yet the cryptocurrency has become a multi-trillion-dollar asset and started carving out a role in the global monetary system. Lately, a new version of that FUD has resurfaced: the idea that a cryptographically relevant quantum computer (CRQC) could derive private keys from public keys and sign transactions to move others' coins. Is that a realistic obstacle to Bitcoin's expansion? Simply put, no. No proof exists that a CRQC will materialize in the next ten years, and it is unclear if one will ever be built. The quantum concern is still just FUD.

State of the Art

As of now, not a single quantum machine has performed a calculation beyond the ability of a precocious six-year-old — this has been confirmed by experiment. Quantum computers are impressive pieces of engineering that demonstrate the near-science-fiction potential of current technology. They rely on techniques like optical tweezers, laser cooling, superconducting flux qubits, electromagnetic traps, dilution refrigerators and others. Inside the machine, individual qubits are forced into specific subatomic states (depending on the technology), entangled into superpositions, manipulated to perform computations, and then their subatomic attributes are read off and interpreted. The remarkable fact is that these devices exist and can be steered to produce useful calculations on a small number of inputs. The sobering counterpoint is that, for one candidate technology, running a computation that a small child can manage demands enough electricity to cool a Texas high school, many hours of preparation and additional hours of post-processing.

Reading the Future

You might be thinking, 'but there's so much money flowing into quantum computing'. Does investment in a field actually correlate with how fast real-world technology advances? Not really. It can even be argued that before the right underlying technology exists and product-market fit is proven, pouring money into an area is inversely correlated with the chance of developing applicable technology. This is evident when comparing NASA's Space Shuttle program to SpaceX's Falcon 9. SpaceX took largely known science and turned it into a practical system to meet a clear market need for reliable, cheaper access to space, spending under $5 billion to achieve its first crewed flight. The Space Shuttle cost about $50 billion for its first crewed launch. Falcon 9 was not only an order of magnitude cheaper to develop but also has a perfect crew safety record so far. Many factors explain the difference, but it shows that no amount of funding can make a technology that isn't ready become practical. Applying that to quantum computing: lots of money is being thrown at the problem, enabling expensive demonstrations of technology. But that tells us nothing about whether more money will deliver the holy grail of stable, low-error qubits (like Falcon 9's reliability). No amount of continued work on the Space Shuttle would ever have produced the low cost and high reliability of Falcon 9, and it is entirely probable that no amount of continued work, at any cost, will ever make any current quantum technology reliable enough to break a single key pair.

You may be thinking, 'but what about all the recent advancements?' Two things are important to note about recently published breakthroughs. First, many are only advances in pure mathematics. Take the recent Google paper that was so significant the authors redacted the theoretical quantum circuit for fear it could break important cryptographic systems. That might look like huge progress toward CRQCs, but in reality it changed nothing. Unless or until the quantum hardware reaches its Falcon 9 moment, no device exists with the stability and scale to run that redacted circuit. It is pure theatrics to conceal a circuit intended for a machine that may never exist. Second, on the hardware side, numerous new results and incremental progress are published each year, but how many concern the same candidate quantum technology? How many are simply restarts after a prior result led to a dead end? The truth is that these advances do not represent a linear path to eventual success. They are a breadth-first exploration of an infinite possibility space, where quantum researchers are hoping to find a route they can follow even a short distance without hitting another dead end.

Looking at the actual future of quantum computing, it is quite unclear at best. There are promising developments, particularly in neutral atom devices in my view. But it is still far too soon to know whether a path to a CRQC exists along any current branch or whether additional restarts are ahead. If eventually we see multiple iterations of the same candidate technology building progressively more capable machines, producing meaningful results that a precocious child cannot also compute, we can revisit the conversation with new evidence.

In Theory

Two possible explanations exist for why quantum research has repeatedly failed to produce a CRQC over many decades. One is that it is simply a very difficult problem and we keep applying science and engineering to solve it, and eventually human ingenuity will succeed, as it did with the Internet, smartphones, social media and Bitcoin (the reader is left to decide which of those are beneficial). On the other hand, it may be that building a CRQC is either impossible or will always be beyond our reach. Think about what a CRQC would require: the machine would need to represent within its superposition a field of possibilities as large as the complexity of the cryptographic problem being solved. That is, to break the 128-bit security of the elliptic curve discrete log on Bitcoin's secp256k1 curve, the quantum superposition would have to represent every possible value of a 128-bit number. In classical computing, representing all those values would take more storage (by many orders of magnitude) than all the storage ever created by humans. If the quantum superposition has any granularity at all — if it is not perfectly continuous across all possible values — then the quantum computer can never be cryptographically relevant. If the energy needed to hold a superposition scales with the complexity of the field being represented, then a quantum computer can never be cryptographically relevant. Current understanding of quantum physics does not exclude either of these scenarios.

Conclusion: Bitcoin Cannot Rest

Despite everything above, Bitcoin development must press ahead with new cryptographic algorithms. A quantum attack on Bitcoin's cryptography is not just around the corner, but it is entirely possible that another flaw could be discovered through other routes. Some elliptic curves have already been found to have weaknesses, and secp256k1 could follow. Bitcoin has survived this long because attacks on the system have made it stronger, and that will continue as the quantum FUD attack runs its course. Development of P2MR or P2TRv2, SHRINCS, SPHINCS, IBC, ML-DSA and other post-quantum signature schemes will eventually improve Bitcoin's resilience to future attacks, even if a real CRQC is never built.