Google's latest quantum-computing results have sharpened a longer-term question for Bitcoin: which holdings would be exposed first if cryptographically relevant quantum hardware becomes viable, and how could their owners migrate?

In an October 15 announcement, Google Quantum AI said its Willow processor reduced errors by roughly 40 times while preparing specialised quantum states. The experiment concerns one component of a fault-tolerant quantum computer, not the complete system required to attack Bitcoin's digital signatures.

What Willow demonstrated

The study, "Magic state cultivation on a superconducting quantum processor", examines how to prepare resources needed for operations outside the basic set supported by many error-correcting architectures. These resources are known as magic states.

Magic states are consumed when a quantum computer performs certain operations. A long and complex calculation therefore requires a continuing supply of reliable states, in addition to the hardware that executes the calculation.

The cultivation process begins with an imperfect state and uses coordinated checks to retain higher-quality results. The researchers reported logical-state fidelity of about 99.99% and roughly 40 times less error than their state-injection baseline.

That result involved an important trade-off. Approximately 8% of attempts remained after the selection process, including checks performed during preparation and measurement. The reported fidelity therefore describes the retained states, rather than the output rate of a complete machine running a large calculation continuously.

As a result, the announcement should not be interpreted as a 40-fold reduction in the resources required to attack Bitcoin. Willow demonstrated that the preparation method works on hardware, but building a fault-tolerant computer capable of maintaining the necessary quality, scale and throughput for cryptographic key recovery remains a substantially larger task.

Public keys already visible on-chain would face the first risk

Bitcoin uses digital signatures to prove that a transaction is authorised. An owner signs with a private key, while the network verifies the signature against the corresponding public key.

A sufficiently capable quantum computer running Shor's algorithm could, in principle, derive a private key from its public key and then create a valid signature. Such an attack would not require the attacker to steal a hardware wallet, compromise a computer or obtain a recovery phrase.

The length of time that a public key remains visible is central to the risk. A long-exposure attack targets a key that is already available on the blockchain, giving a future attacker as much time as needed to attempt key recovery. A short-exposure attack begins after a public key appears in a transaction awaiting confirmation, leaving a much narrower window.

Many early mining rewards used pay-to-public-key outputs, which reveal the public key while the coins unspent. Their exposure results from the spending conditions, not simply from the age of the coins. Modern holdings can also face long-exposure risk if their key was revealed in an earlier transaction or if they use Taproot outputs.

The Taproot specification uses an output public key that supports direct signature-based spending. That does not make Taproot insecure today. It does mean, however, that a newer address format does not automatically conceal the public-key information relevant to a possible future quantum key-recovery attack.

Cold storage remains valuable against ordinary theft because it protects private keys from online compromise. It does not remove a public key that has already been published on the blockchain.

A future attack would require a machine far beyond Willow

A separate Google-led resource study describes what a future attack on Bitcoin's elliptic-curve signatures could require under specific assumptions. It is not a description of Willow's demonstrated capabilities. Resource estimates of this kind translate the quantum threat into specific hardware requirements, giving developers and researchers measurable benchmarks to track as the technology develops.

Using assumptions for a future superconducting architecture—including physical error rates of 10 -3, planar connectivity and a fast control system—the study estimated that the relevant circuits could run in minutes with fewer than half a million physical qubits.

For a "primed" fast-clock machine, the paper models an average key-recovery time of roughly nine minutes after a public key becomes available. That timing depends on prior computation and on control-system reaction times that current hardware has not demonstrated at the required scale.

The model also estimates that a nine-minute calculation would require around half a million sufficiently reliable T-states every second. This is a continuing production requirement, not the number of qubits in the machine.

The hardware estimate already incorporates an efficient approach to producing magic states. Dividing the estimate by Willow's 40-fold error reduction would therefore double-count the progress. Lower error in one experimental preparation method is not equivalent to a proportional reduction in the cost of an entire cryptographic attack.

Future protection would not automatically solve the legacy problem

Bitcoin developers are considering proposals that address different stages of quantum exposure. BIP 360 proposes Pay-to-Merkle-Root, or P2MR, a draft soft-fork output type that removes Taproot's exposed key-path spend.

P2MR is designed to reduce long-exposure risk by avoiding the key path that makes Taproot outputs vulnerable before spending. It would not provide complete protection once a key is revealed in a transaction waiting in the mempool. The BIP's authors say that defending against those shorter attacks may require post-quantum signatures.

A proposed migration away from Bitcoin's existing signatures would create an additional challenge. BIP 361 is a draft informational proposal that depends on a separate, still-unspecified post-quantum signature proposal. Its suggested five-year transition would begin only after activation; it is not an active deadline for Bitcoin holders.

Dormant holdings present the most difficult migration question. An owner who has lost access to the private keys cannot authorise a move into stronger protection. Inactivity, however, does not prove that coins have been abandoned. Any rule restricting unmigrated holdings could therefore also affect legitimate owners who return later.

The immediate issue is preparation, not panic

Nothing in the Willow experiment means that Bitcoin holders need to make an emergency transfer today. The relevant question is whether an output already exposes a public key, not whether its owner keeps the private key in a hardware wallet or whether the address simply appears old.

Bitcoin's more difficult task is to create and adopt a migration path before cryptographically relevant quantum hardware exists. New output types would need to be agreed upon, wallet and custody software would need to support them, and owners would need a practical way to move existing funds.

That process is likely to take longer than creating a new address format, particularly for old or inaccessible coins. Bitcoin has draft proposals for future protection, but no activated post-quantum migration route. For now, the concrete markers to follow are whether BIP 360 and BIP 361 advance from draft status, and whether quantum hardware progress extends from single-component demonstrations such as Willow toward the fault-tolerant machines that the resource study models.

This article is provided for informational purposes only and does not constitute financial or investment advice.