Google said its Willow quantum chip cut errors roughly 40-fold when preparing “magic states,” a specialized resource required for quantum calculations that could eventually threaten Bitcoin wallets. The results were published in Science this week.

The experiment achieved about 99.99 percent fidelity among the states that passed inspection, though only about 8 percent of preparation attempts succeeded, and substantial scaling challenges remain.

The findings do not make an attack on Bitcoin 40 times cheaper. Instead, they advance an engineering method that could help future quantum computers sustain the roughly 500,000 reliable magic states per second required under one modeled attack.

The work addresses a challenge that rarely features in the debate over quantum computing and bitcoin, which typically centers on how large a machine an attacker would need while giving less attention to how much of that machine would be occupied getting ready to calculate.

Why the oldest coins give an attacker more time

A bitcoin wallet uses a secret key to approve payments and a matching public key that allows the network to verify those approvals. Spending typically reveals the public key, while some payment types expose it from the start.

Working backward from the public key to the secret is supposed to take an impractical amount of computing, which is what makes reverse-engineering crypto wallets practically impossible. However, a large enough quantum computer running Shor's algorithm could, in theory, do that math. Whoever recovered the secret key could sign transactions as the owner, and the network would accept them as genuine. Mathematician Peter Shor first published the method in 1994, but no one has yet demonstrated it.

A recovery phrase locked in a physical drawer offers no protection against such an attack, because the attacker would be working from information already sitting on the blockchain.

Some later payment formats hide the public key behind a hash — a digital fingerprint — until the owner spends. An attacker targeting a previously hidden key would have to wait for that exposure and might need to recover the secret quickly enough to interfere with the payment.

That is also why lost coins present a difficult problem. Bitcoin can introduce stronger spending protections, but someone still needs the existing keys to move old holdings into them. If those keys are lost, the owner cannot make the move, and the exposed public key remains available to a future attacker.

Holdings from Bitcoin's earliest years are often described as “Satoshi-era,” after the network's pseudonymous creator, and many early rewards were paid directly to the public key — a format that placed the key itself on the blockchain rather than a hash of it. Some of bitcoin's oldest holdings have had their public keys exposed since they were mined, and old coins have been moving as the quantum debate grows louder. On Oct. 7, 100.02 BTC untouched since July 2010 moved after more than 16 years, carrying a value of about $8.5 million. In August, six wallets inactive since 2011–2014 moved another 553.59 BTC, worth roughly $40 million at the time.

Those transfers do not singularly establish that holders are responding to quantum fears; moving coins can just as easily mean changing wallets, reorganizing holdings or preparing to sell.

The cost of getting ready

Quantum computers store information in units called qubits, which are extremely fragile. Heat, vibration and stray signals can disturb them and introduce errors, and adding more qubits also adds more opportunities for mistakes.

Engineers deal with this by organizing many physical qubits into groups that detect and correct errors. Each group behaves like a more dependable unit known as a logical qubit. Those units then need the digital equivalent of fuel to run certain operations: specially prepared quantum states researchers call “magic states.” Each one is consumed when used, so the computer must keep producing them throughout a calculation.

Think of a restaurant kitchen where every dish requires a fresh batch of a sauce that cannot be reused, and some of the staff must keep making sauce while the others cook. In a quantum computer, hardware devoted to producing magic states is hardware that cannot be assigned to other work.

That overhead means a would-be attacker faces two problems at once: assembling a machine large enough to run the calculation, and keeping it supplied with states for the full duration.

Google's method, called cultivation, starts with a rough version of the state, checks it for errors and throws out flawed attempts. The goal is to produce clean states using less hardware than older methods required.

The company reported about 99.99% fidelity — a measure of how closely the finished states matched what researchers were aiming for. That number applies only to the states that passed inspection. Willow kept about 8% of its attempts after the checks during preparation and measurement. For every 100 tries, roughly eight made it through.

The next steps include running the process at a much larger scale and keeping the states useful as they feed into longer calculations. The researchers say more work is needed on real-time operations and on moving the states into stronger error-correcting setups.

How it fits with earlier research

In March, Google estimated that a future superconducting quantum computer with fewer than 500,000 physical qubits could break the wallet cryptography used by Bitcoin and Ethereum, under a specific set of hardware assumptions. In September, CoinDesk reported on researchers cutting the workload of a core calculation used in that attack. That work covered one component, leaving out the complete attack and the physical hardware costs of running it.

Those studies reduce the amount of math an attacker has to do. Cultivation addresses the cost of supplying the machine while it does that math. The gains cannot simply be multiplied together: Google's March estimate already assumed efficient magic-state production, and the experiment tests part of that engineering approach rather than providing another 40-fold reduction in the estimated cost of attacking bitcoin.

Taken together, the work maps the remaining engineering checklist — enough physical qubits, a leaner calculation and a reliable state supply — with each demonstrated so far on its own rather than as a complete machine.

The March paper also shows how much fuel an attack would burn. For one modeled attack lasting about nine minutes after a public key becomes available, Google estimated the machine would need roughly 500,000 sufficiently reliable magic states every second.

Until cultivation and the other components are shown working together at scale, the modeled attack remains a hardware estimate rather than an operational capability.