Google’s Willow processor has shown how to prepare certain quantum states with far fewer errors. It’s a useful advance in quantum computing, but nowhere near a machine that can crack Bitcoin. The result brings a long-term security question into focus: how much time would Bitcoin need to switch to quantum-resistant cryptography if the threat becomes practical?
- Google reported about 40-fold fewer errors in cultivated quantum states.
- The experiment did not attack Bitcoin or expose private keys.
- A Bitcoin migration would bring technical and coordination challenges.
Google announced the results on October 15, 2026, and published the research in Science. Using its 105-physical-qubit Willow processor, the team applied a method called magic state cultivation. Under the researchers’ testing method, the resulting T-states reached 99.99% logical fidelity. Their errors were reduced approximately 40 times compared with states produced without the method.
That’s a meaningful engineering result. It isn’t a countdown to Bitcoin being broken.
What Google demonstrated
Quantum computers use quantum bits, or qubits, to perform some calculations differently from conventional computers. But qubits are fragile, and errors can disrupt a computation. Quantum error correction uses repeated checks and carefully arranged information to detect and manage those errors.
Some advanced quantum operations also need magic states, special quantum resources that enable operations ordinary error-correction methods cannot perform on their own. Google researchers have estimated that producing magic states could use as much as 95% of a quantum computer’s capacity.
Magic state cultivation aims to produce more reliable states from imperfect ones. The process repeatedly checks them and discards attempts that fail. Google also demonstrated transferring a state from a distance-3 color code to a distance-5 surface code, two different approaches to quantum error correction.
The method builds on theoretical work published in 2024 by Craig Gidney, Noah Shutty, and Cody Jones. Research scientists Emma Rosenfeld and Gidney described the experiment as the first demonstration of an efficient method for producing these resources on real quantum hardware. Google says larger-scale testing is still needed.
Logical fidelity measures how accurately the logical quantum state was prepared and verified in the experiment. It does not measure how close a computer is to breaking a cryptographic key. And the 40-fold reduction does not mean the machine made 40 times fewer errors in every possible task. It compares cultivated states with states created without the method.
Why Bitcoin watches quantum progress
Bitcoin uses elliptic curve cryptography to authorize transactions. A digital signature proves that a transaction was authorized by someone with the relevant private key, without revealing that key during ordinary verification. The corresponding public key is used to check the signature.
Whether a public key is visible on-chain depends partly on the type of Bitcoin output and how it is used. Some common output formats reveal a hash of the public key and disclose the key when the coins are spent. Other formats, including Taproot outputs, expose a public key in the output itself. Reusing an address or spending only part of an output can also leave a public key visible in transaction data.
A sufficiently powerful quantum computer running Shor’s algorithm could, in theory, derive a private key from an exposed public key. In March 2026, Google researchers estimated that fewer than 500, 000 physical qubits could be enough to break 256-bit elliptic curve cryptography under specified hardware assumptions. They said this was roughly 20 times lower than earlier resource calculations.
That figure alone does not mark a practical attack threshold. Physical qubits are the hardware components of a quantum processor. An attack would also need reliable error correction and millions of quantum operations. Google’s estimate depends on assumptions about hardware and error correction, and no machine has demonstrated the required capability. Willow’s 105 physical qubits are far below the resources described in that estimate. Project Eleven has warned about the potential timeline for quantum risks to Bitcoin.
The cultivation result matters because magic states are among the resources needed for certain advanced quantum operations. But improving one part of the process does not show that a quantum computer can perform the full sequence of calculations needed to attack Bitcoin. Scale, reliability, and practical execution remain major hurdles.
Exposed public keys do not mean coins are currently stealable
Glassnode estimated in May that approximately 6.04 million BTC, or 30.2% of mined Bitcoin supply at the time, were held in unspent transaction outputs with exposed public keys. An unspent transaction output, or UTXO, is a Bitcoin output that has not yet been spent. The possibility of adversaries stockpiling data for future decryption adds another dimension to long-term quantum risk.
Glassnode classified approximately 1.92 million BTC as structurally exposed, meaning their output formats reveal public keys by design. It classified another 4.12 million BTC as operationally exposed, including coins affected by address reuse or partial spending.
These figures describe exposure under Glassnode’s methodology. They do not mean those coins can be stolen today, or that every exposed holding would be equally accessible to a future attacker. A capable quantum computer would still have to derive a private key. An owner who can move the funds may be able to do so before such an attack becomes practical.
Blockchain data cannot show whether an inactive wallet is abandoned, inaccessible to its owner, or simply unused. A separate June study by Quantus estimated that approximately 2.3 million BTC could be difficult or impossible to migrate through ordinary wallet procedures. That estimate concerns migration challenges, not the same exposure categories measured by Glassnode. It should not be read as a confirmed count of lost or permanently unmovable coins.
Bitcoin’s migration challenge
Coinbase published recommendations on Bitcoin’s long-term security on October 13. Its proposals address exposed coins, new wallet formats, and the practical demands of migration, including transaction fees, limited block space, wallet compatibility, custody systems, and node verification. These are recommendations, not adopted Bitcoin policy.
BIP-360 proposes an output type intended to reduce public-key exposure in certain circumstances. It is not, by itself, a post-quantum signature system or a complete migration plan. Reducing how often a public key is exposed may help address one part of the risk, but Bitcoin would still need to consider support for signatures designed to resist quantum attacks.
A network-wide change would require compatible software and broad adoption by users, wallet providers, custodians, and node operators. Bitcoin has not approved a deadline for switching to post-quantum signatures. Researchers have warned that a large-scale migration could take several years. A June study projected that a migration beginning in 2026 might finish between 2029 and 2031 under its assumptions. That’s a conditional projection, not a schedule Bitcoin has adopted. Recent research has also prompted renewed debate about the quantum threat timeline.
The hardest decisions may concern coins whose owners cannot move them. Any proposal to restrict or otherwise handle those funds would raise questions of ownership and consent, as well as technical security. Bitcoin has no central authority that can order every holder to upgrade. That makes coordination slower, but it also means these decisions cannot simply be imposed from above.
Key questions about quantum computing and Bitcoin
-
Did Google’s experiment break Bitcoin’s cryptography?
No. It demonstrated improved preparation of quantum states, not an attack on Bitcoin or the extraction of private keys.
-
How much did Google reduce errors?
Google reported an approximately 40-fold reduction compared with states produced without magic state cultivation. The resulting T-states achieved 99.99% logical fidelity under the researchers’ testing method.
-
When could an exposed Bitcoin key be at risk?
Exposure alone does not enable theft today. An attacker would need a sufficiently capable quantum computer to derive the private key, overcoming substantial hardware and error-correction challenges.
-
Does Glassnode’s 6.04 million BTC estimate mean those coins can be stolen?
No. It estimates BTC in unspent outputs with exposed public keys under Glassnode’s methodology. It does not show that a practical quantum attack is possible or that every holding is accessible.
-
Has Bitcoin agreed on a post-quantum migration?
No. Coinbase has published recommendations, and BIP-360 proposes an output type that could reduce exposure in some circumstances, but Bitcoin has approved no network-wide migration deadline.
Google’s result deserves attention because it improves one difficult part of quantum computing. The right response is neither panic nor complacency. Track whether the engineering advances scale, and work through the practical questions around replacement cryptography, user migration, and funds that cannot be moved.
