Your Bitcoin Has a 9-Minute Expiry Date

Your Bitcoin transaction takes 10 minutes to confirm. A future quantum computer needs 9.

That one-minute gap is the entire threat model laid out in a paper quietly published by Google's Quantum AI team in early April 2026. It's not science fiction. It's arithmetic — and the arithmetic just got a lot more uncomfortable for the 6.9 million Bitcoin already sitting in wallets with permanently exposed public keys.

The Lock That Only Opens One Way

To understand the attack, you need to understand what Bitcoin's security is actually built on.

Every Bitcoin wallet has two keys. A private key — a 256-bit secret number, roughly as long as a typical sentence. And a public key derived from it through a mathematical operation on a specific elliptic curve called secp256k1. Think of it as a one-way map: start at a fixed point on the curve, take a number of steps defined by your private key, and wherever you land is your public key.

Going forward is trivial. Milliseconds. Going backward — figuring out how many steps you took from where you ended up — is what mathematicians call the elliptic curve discrete logarithm problem. For classical computers, solving it would take longer than the universe has existed.

This one-way trapdoor is the whole game. Your public key can be shared freely because no classical machine can reverse it into your private key. When you send Bitcoin, your wallet produces a digital signature proving you know the secret without revealing it.

Shor's Algorithm: The Trapdoor Has a Key

In 1994, mathematician Peter Shor found that key.

His algorithm solves the discrete logarithm problem in what's called polynomial time — meaning difficulty grows slowly as numbers get bigger, not explosively. A classical computer's "longer than the universe" becomes something far more manageable.

The mechanics exploit three quantum properties. Superposition lets the computer evaluate every possible input simultaneously — not one at a time, but all at once. Entanglement keeps inputs and outputs correlated so results stay coherent. Interference cancels out wrong answers while amplifying the correct one, acting as a filter that leaves only the private key standing.

The algorithm converts the problem of finding your private key into finding the period of a mathematical function. Once that period is known, the private key falls out in a single step. The one-way map becomes a two-way street.

Why Bitcoin Still Exists — and What Just Changed

Shor's algorithm has been public knowledge for 30 years. Bitcoin survived because running it requires a quantum computer with enough stable qubits to hold coherence through the entire calculation. Previous estimates put that threshold at millions of physical qubits.

Google's April 2026 paper — co-authored with Ethereum Foundation researcher Justin Drake and Stanford cryptographer Dan Boneh — cut that number to fewer than 500,000. A roughly 20-fold reduction.

Sponsored

Advertise with Us

[email protected]

Sponsored

The team designed two quantum circuits implementing Shor's algorithm against Bitcoin's specific curve. One uses approximately 1,200 logical qubits and 90 million computational gates. The other uses 1,450 logical qubits and 70 million gates. At a physical-to-logical qubit ratio of roughly 400-to-1 (most of the machine exists purely to catch its own errors), that translates to under half a million physical qubits.

The most advanced quantum computers today operate in the thousands of qubits. 500,000 remains distant. But the number moved from "effectively impossible" to "engineering target" — and that's a different conversation.

The Nine-Minutes Attack, Explained

Here's where Google's paper shifts from theoretical to operational.

The parts of Shor's algorithm that depend only on Bitcoin's fixed curve parameters — identical for every wallet on the network — can be precomputed. A quantum computer sits in a primed state, halfway through the calculation, waiting.

When you broadcast a Bitcoin transaction, your public key appears briefly in the network's mempool — the queue of unconfirmed transactions. At that moment, the machine only needs to finish the second half of the computation.

Google estimates that second half takes about nine minutes.

Bitcoin's average block confirmation time: 10 minutes. The attacker derives your private key, submits a competing transaction redirecting your funds, and races your original to confirmation. The math gives them a 41% success rate.

That's the mempool attack. Alarming — but it requires hardware that doesn't exist yet.

The Quieter Threat: 6.9 Million Bitcoin Already Exposed

The mempool attack at least has a clock. The bigger problem doesn't.

6.9 million Bitcoin — roughly one-third of total supply — sit in wallets where the public key is already permanently recorded on the blockchain. No race against time required. An attacker with a capable quantum computer could target these wallets at leisure.

How did those keys get exposed? Two ways. Since Bitcoin's Taproot upgrade went live in November 2021, public keys are visible by default in transactions. For older address formats, the public key is hidden until you spend — at which point it's permanently on-chain. If you've ever sent Bitcoin from a wallet, that wallet's public key exists forever in the public record.

What This Means for Crypto Investors Right Now

The quantum threat isn't binary — it's a sliding timeline with real decisions attached.

For individual holders, the immediate question is whether your public key is already exposed. Wallets that have never sent a transaction have not revealed their public key and are relatively insulated. Wallets with any outgoing transaction history are not. Hardware wallet manufacturers and software clients will eventually need to migrate users to post-quantum address formats.

For institutional investors — funds, ETFs, custodians — the calculus is longer-term but harder to ignore. A portfolio with a multi-decade horizon needs to factor in when quantum hardware reaches the threshold, not just whether it will.

For policymakers and regulators, this paper accelerates a question already on the table: should quantum-resistant cryptography standards be mandated for digital asset custodians? NIST finalized its first post-quantum cryptography standards in 2024. Adoption in Bitcoin requires network-wide consensus — a process that could take years.

The Bitcoin community is not ignoring this. Post-quantum cryptography migration has been discussed for years. But consensus-based protocol upgrades move slowly, and 6.9 million BTC don't have the luxury of waiting for a perfect political moment.