Google says its Willow quantum chip has reduced errors roughly 40-fold when preparing special states used in quantum calculations, addressing a costly step on the road toward machines powerful enough to crack bitcoin wallets.

The finding, published this week in the journal Science, highlights a dimension of the quantum debate that rarely enters bitcoin discussions. The conversation typically centers on how large an attacking machine would need to be, while paying little attention to how much of that machine's capacity would be consumed simply getting ready to calculate.

Why the Oldest Coins Give Attackers More Time

A bitcoin wallet relies on a secret key to authorize payments and a corresponding public key that allows the network to verify them. Spending typically reveals the public key, and some payment formats expose it from the outset—bitcoin's earliest format, pay-to-public-key, writes the key directly onto the blockchain, and coins from that era, including those widely attributed to Satoshi Nakamoto, sit in such outputs.

Working backward from the public key to the secret key is supposed to require an impractical amount of computing power, which is what makes reverse-engineering crypto wallets effectively impossible.

In theory, however, a sufficiently large quantum computer running Shor's algorithm could perform that math. Anyone who recovered the secret key could sign transactions as the owner, and the network would accept them as genuine. Mathematician Peter Shor first published the method in 1994, though no one has yet managed to demonstrate it.

A recovery phrase locked in a physical drawer offers no protection in that scenario, because the attacker would be working from information already recorded on the blockchain.

Some later payment formats hide the public key behind a hash—a digital fingerprint—until the owner spends. An attacker targeting a previously hidden key would have to wait for that exposure and might need to recover the secret quickly enough to interfere with the payment.

That is also why lost coins present a difficult problem. Bitcoin can introduce stronger spending protections, but moving holdings into them still requires the existing keys. If those keys are lost, the owner cannot make the transfer, and the exposed public key remains available to a future attacker. Work on post-quantum defenses is already under way elsewhere: the U.S. National Institute of Standards and Technology finalized its first post-quantum cryptography standards in 2024, and bitcoin developers have circulated draft proposals for quantum-resistant spending formats, though adopting any of them across a decentralized network would require broad consensus.

Some of bitcoin's oldest holdings have had their public keys exposed since the coins were mined.

Old coins have also been on the move as the quantum debate grows louder. On Oct. 7, 100.02 $BTC untouched since July 2010 moved after more than 16 years, carrying a value of about $8.5 million. In August, six wallets inactive since 2011–2014 transferred another 553.59 $BTC, worth roughly $40 million at the time.

Those transfers do not by themselves establish that holders are responding to quantum fears, as moving coins can simply mean changing wallets, reorganizing holdings, or preparing to sell. As the debate develops, the concrete signals to watch are further error-correction milestones from quantum hardware makers and any bitcoin improvement proposals that advance toward quantum-resistant spending formats.

This article was originally published on CoinDesk.