Google Builds a Quantum Attack on Crypto Encryption, But Won't Publish It

Google has warned that quantum computers could break the 256-bit elliptic curve encryption used in cryptocurrency wallets with fewer than 500,000 physical qubits by 2029. The firm's Quantum AI team estimates that this threshold could allow attackers to crack encryption in minutes, potentially exposing sensitive data and private keys. This timeline is earlier than previous assumptions in the cybersecurity field.

The research highlights the risk of 'store now, decrypt later' attacks, where adversaries store encrypted data for future decryption once quantum computers mature. Google urges the blockchain industry to adopt post-quantum cryptography (PQC) to mitigate these long-term risks. The company plans to implement PQC in its Android 17 operating system and is advocating for broader adoption by 2029.

Bitcoin and Ethereum are particularly vulnerable due to their reliance on elliptic curve digital signature algorithms (ECDSA). Google researchers estimate that 6.9 million BTC—approximately one-third of the total supply—are already at risk, as their public keys have been exposed. The Taproot upgrade for Bitcoin, which improved privacy in many ways, inadvertently made public key visibility more common, increasing the attack surface.

Will Bitcoin's Governance Respond in Time to Quantum Risks?

Bitcoin's decentralized and slow-moving governance structure poses a challenge in responding to quantum threats. Unlike Ethereum, which has a multi-year roadmap for quantum-resistant upgrades, Bitcoin lacks a centralized team to drive such changes. Implementing quantum-resistant signatures would require a hard fork and consensus among stakeholders, a process that could take years.

Bitcoin developers have limited time to implement quantum-resistant solutions, with research focusing on lattice-based and hash-based signatures. Meanwhile, Ethereum's weekly devnet testing and structured upgrades give it an advantage in preparing for the transition. Prominent figures in the Bitcoin community, such as Nic Carter, have criticized the lack of urgency in quantum readiness.

What Are the Market and Institutional Implications of This Timeline?

Institutional investors are beginning to reassess their Bitcoin holdings, factoring in quantum risk as a component of asset allocation. Some financial institutions are already adjusting their exposure, with any future quantum-resistant upgrades requiring significant consensus.

Google's 2029 timeline for post-quantum migration is not a prediction of when quantum computers will arrive, but rather a call to action for businesses to start preparing. The company has already begun deploying PQC in Android and Chrome, demonstrating its commitment to proactive security. It is also collaborating with standards bodies like NIST to guide the transition.

Regulatory bodies are also stepping in, with the European Commission aiming for an operational quantum communication infrastructure by 2027. The UK's National Cyber Security Centre (NCSC) and the US National Security Agency (NSA) have issued their own guidance, with deadlines set for 2035 and 2033 respectively.

How Are Other Platforms and Firms Responding to Quantum Risks?

Other firms are following similar strategies. Google is not alone in this effort; governments and industry groups are increasingly emphasizing the need for quantum-safe encryption. For example, CoinDCX in India has established a ₹100 crore fund to improve customer education and prevent digital fraud, including steps to support cybercrime investigations and research on digital threats.

The broader cryptocurrency ecosystem is also at risk, with newer protocols gaining an advantage by incorporating quantum resistance from the outset. However, many existing platforms may struggle to adapt quickly due to technical and governance challenges.

Google's research underscores the urgency for the blockchain industry to act before quantum computers reach a critical threshold. While the 2029 deadline is ambitious, it reflects the rapid progress in quantum error correction and qubit stability. Failure to act could leave large portions of digital assets vulnerable to real-time attacks as early as 2029.