Every few months, a quantum headline sends the Bitcoin community buzzing, and Google is usually the one holding the needle. The company’s newest achievement, a result it calls Quantum Echoes, the first “verifiable quantum advantage” run on its Willow chip, is the latest to prompt the question: is Bitcoin in trouble?
The short answer is no, not from this. The longer answer is more interesting, and more consequential.
What Google Actually Did
Quantum Echoes is a genuine milestone, but it is worth being precise about what it is. Running on Willow’s 105 qubits, Google Quantum AI executed an algorithm (an “out-of-time-order correlator”) roughly 13,000 times faster than the best classical algorithm could on one of the world’s fastest supercomputers, and, crucially, in a way that can be independently verified by repeating it on another quantum computer of similar quality. The work, led by researchers Hartmut Neven and Vadim Smelyanskiy, was published in Nature.
Google frames its usefulness around understanding nature itself: mapping molecular structure, a quantum-enhanced “molecular ruler” for NMR, drug discovery and materials science. Alongside it, Google has reported steady error-correction progress, including techniques that cut error rates by roughly 40 times, as described in its October 15, 2026, announcement on magic-state cultivation.
What Google did not do is say anything about cryptography. Its Quantum Echoes announcement makes no claim about Bitcoin, encryption, or breaking any cryptographic system; because Quantum Echoes is not a code-breaking algorithm, and Willow is not a code-breaking machine.
Why It Doesn’t Break Bitcoin Today
Breaking the cryptography behind Bitcoin requires a specific tool — Shor’s algorithm — running on a very different scale of hardware. Shor’s algorithm can, in principle, derive a private key from a public key by solving the elliptic curve discrete logarithm problem, which underpins Bitcoin’s ECDSA signatures.
Quantum Echoes is not Shor’s algorithm, and running Shor’s against Bitcoin’s curve would take not 105 noisy qubits but hundreds of thousands to around a million error-corrected physical qubits; a system that does not yet exist and is widely seen as years away. The Google Quantum AI resource-estimate paper provides context for the scale of the engineering challenge. The distance between a 105-qubit science demonstration and a cryptographically relevant quantum computer is enormous, and no single announcement this year closes it.
The Real Reason the Question Won’t Go Away
So why does the fear keep resurfacing? Because a different strand of Google’s work speaks directly to Bitcoin. The Google Quantum AI resource-estimate paper found that breaking elliptic-curve cryptography may need roughly 20 times fewer qubits than previously believed; on the order of under a million, with key derivation taking on the order of minutes once such a machine exists. That paper moved expert timelines.
Ethereum researcher Justin Drake called the findings a breakthrough and said his “confidence in q-day by 2032 has shot up significantly”, putting “at least a 10% chance” of a quantum computer recovering a secp256k1 private key from an exposed public key by 2032 — while adding that a cryptographically relevant quantum computer before 2030 “still feels unlikely.” As one measure of the trend, estimates for the resources needed to break standard encryption have fallen from billions of qubits to under a million in little more than a decade, according to the Google research paper and its discussion of earlier resource estimates. In other words: the ceiling isn’t falling, but it is descending faster than many assumed.
What’s Actually At Risk
Not all Bitcoin is equally exposed, and this is the single most misunderstood part of the debate. Shor’s algorithm threatens a key once the public key is visible on-chain. That carves the supply into tiers, according to on-chain analyses:
- Pay-to-public-key (P2PK) coins — about 1.7 million BTC, including an estimated 1.1 million BTC tied to Satoshi Nakamoto’s early mining — expose the public key directly and permanently.
- Reused addresses (P2PKH, SegWit, Taproot) reveal their public key when the key is exposed through spending or the output’s design; researchers estimate this pushes the vulnerable total past 6 million BTC.
- In all, up to roughly 6.9 million BTC, about 34% of supply, has had its public key exposed on-chain at some point.
This is the “harvest now, decrypt later” problem: an attacker doesn’t have to race a live transaction through the mempool if the key is already public. Past exposures are permanent and cannot be revoked; which is why experts treat migration as a problem to solve before a capable machine arrives, not after.
The Reactions, Split Down the Middle
The resurgent debate has divided serious people. On the alarmed side, Dragonfly’s Haseeb Qureshi previously wrote that post-quantum is “no longer a drill”; Project Eleven’s Alex Pruden warned that with a fast enough break, “every active transaction is a target”; and The Hashgraph Group’s Stefan Deiss called the acceleration “a wake-up call,” pointing to the hundreds of billions of dollars potentially sitting in vulnerable formats. Castle Island’s Nic Carter likened the stakes to the Manhattan Project.
On the calmer side, Binance founder CZ said crypto’s response is straightforward — it “has to do is upgrade” — and that there is “no need to panic”. Analysts at Bernstein expect a three-to-five-year runway before quantum becomes operationally relevant, according to an internal note, and ARK Invest’s quantum-computing paper treats it as a long-term risk rather than an imminent attack. Both camps, notably, agree on the destination: Bitcoin will need to migrate to quantum-resistant cryptography. They disagree on the clock and the method.
The Fix, and the Fight
The cryptography to defend against quantum computers already exists. The U.S. National Institute of Standards and Technology has finalized post-quantum standards, including the hash-based SLH-DSA (SPHINCS+, FIPS 205) and lattice-based schemes in the Falcon family, and Google itself set an internal post-quantum migration target of 2029. The catch for Bitcoin is practical: a post-quantum signature can be far larger than today’s — roughly 8 kilobytes for SLH-DSA versus about 64 bytes for an ECDSA or Schnorr signature — which, in Bitcoin’s limited block space, would cut throughput and raise fees. The NIST SLH-DSA standard and the Bitcoin developer documentation on transactions provide technical context for signature formats and transaction constraints.
Bitcoin’s own path runs through two proposals that capture the whole argument. BIP-360 introduces a quantum-resistant output type, committing to a Merkle tree of signature schemes so spenders can reveal a post-quantum path, co-authored by Ethan Heilman, and reported to have run on a dedicated testnet in 2026; mainnet activation, by most accounts, is “nowhere close,” and Heilman has estimated a full migration would take at least seven years even if it started today.
The Crypto Times report on BIP-360’s testnet implementation covers that testnet development. The more contentious BIP-361, put forward by Jameson Lopp and co-researchers, would go further — phasing in a “legacy signature sunset” that eventually freezes unmigrated, quantum-vulnerable coins to stop an attacker from sweeping them. That idea has split Bitcoin hard: Adam Back favors optional upgrades without any forced sunset, arguing a freeze violates permissionless ownership, while figures including Metaplanet’s Phil Geiger and TFTC’s Marty Bent reject freezing coins outright.
As analysts have noted, Bitcoin’s binding constraint here is governance, not technology — getting a decentralized network to agree on a disruptive, multi-year upgrade is the hard part.
The rest of the industry is already moving: the Ethereum Foundation has a dedicated post-quantum security research team, Coinbase formed an independent quantum advisory council, and startups like Project Eleven are building post-quantum tooling for Layer 1 networks. The Crypto Times has also covered Sui’s quantum-resistant signature support on Devnet and NEAR’s quantum-safe mainnet upgrade.
So, Is Bitcoin in Trouble?
Not imminently, and not because of Quantum Echoes. The milestone Google just celebrated is a physics achievement, not a cryptographic one, and the hardware that could threaten Bitcoin remains years off by nearly every serious estimate. But “years off” is not “never,” the resource estimates keep shrinking, and roughly a third of all Bitcoin has already had its public key exposed. The threat is best read not as a trigger to sell but as a deadline to migrate — one Bitcoin will have to meet through the slow, contentious process of changing itself. For ordinary holders, the one concrete step experts agree on costs nothing: avoid reusing addresses, so your public key stays hidden until the day you spend.
