Google’s decision to pull its post-quantum cryptography migration timeline forward to 2029 has landed hard in Bitcoin and crypto, because the company did not just change a policy deadline. It paired that warning with a new whitepaper arguing that breaking the 256-bit elliptic curve cryptography used across major blockchains may require far fewer quantum resources than many in the market had assumed.
In Google’s formulation, Shor’s algorithm could solve the target problem with either no more than 1,200 logical qubits and 90 million Toffoli gates, or no more than 1,450 logical qubits and 70 million Toffoli gates. On a superconducting architecture, the authors say those circuits could run in minutes with fewer than half a million physical qubits.
That is the real shock to the Bitcoin threat model. Google’s March 25 blog post said the company moved to a 2029 migration target because of progress in quantum hardware, error correction and quantum factoring resource estimates, and said it had already adjusted its threat model to prioritize post-quantum migration for authentication services. The crypto paper then gave markets a concrete reason for why that deadline may have moved.
The paper is also unusual in how it handles disclosure. Rather than publishing the attack circuits in full, the authors say they used a zero-knowledge proof to validate the results without leaking sensitive details. Google framed that as a responsible-disclosure choice in a field where public discussion can itself create fear and instability, especially when the assets in question are bearer instruments with no recourse layer.
He added that Google’s decision not to publish the actual circuits, and instead publish a proof that they exist. “They believe this result is so severe that they are not publishing the actual circuits. They instead published a ZKP proving that they know of the quantum circuit with these properties. This is very atypical, showing Google thinks this is serious shit. All blockchains need a transition plan ASAP. Post-quantum is no longer a drill,” he added.
This is wild. Google Research demonstrates a ~20x more efficient implementation of Shor’s algorithm that could break ECDSA keys within minutes with ~500K physical qubits.
Ethereum Foundation researcher Justin Drake pushed the same point even further. “Today is a monumentous day for quantum computing and cryptography. Two breakthrough papers just landed,” he wrote. “The results are shocking. I expect a narrative shift and a further R&D boost toward post-quantum cryptography.”
In a separate post, he added: “My confidence in q-day by 2032 has shot up significantly. IMO there’s at least a 10% chance that by 2032 a quantum computer recovers a secp256k1 ECDSA private key from an exposed public key. While a cryptographically-relevant quantum computer before 2030 still feels unlikely, now is undoubtedly the time to start preparing.”
Today is a monumentous day for quantum computing and cryptography. Two breakthrough papers just landed (links in next tweet). Both papers improve Shor’s algorithm, infamous for cracking RSA and elliptic curve cryptography. The two results compound, optimising separate layers of…
For Bitcoin specifically, the most important part of the paper is not some vague future threat to “crypto,” but the distinction it draws between attacks on dormant or exposed keys and attacks on live transactions. The authors argue that fast-clock architectures such as superconducting and photonic systems could eventually enable “on-spend” attacks, where a public key exposed during transaction flow is broken quickly enough to race the original payment into a block.
Their estimate explicitly says fast-clock systems could solve ECDLP in about nine minutes on average, putting Bitcoin’s roughly 10-minute block cadence uncomfortably close to the attack window. The paper points to private mempools and commit-reveal schemes as possible mitigations, but treats migration to post-quantum cryptography as the actual answer.
The broader message is hard to miss. Google’s paper ends by urging “all vulnerable cryptocurrency communities to join the migration to PQC without delay,” and its separate security timeline now points to 2029, not some comfortably distant date in the mid-2030s.
Bitcoin has spent years treating quantum risk as a long-range problem. What changed this week is that a major quantum lab put a much tighter engineering estimate around the threat, and some of the sector’s most technically literate observers immediately started talking less about whether the transition will be needed and more about how fast it has to begin.
At press time, Bitcoin traded at $67,475.
