Alice & Bob's model cuts hardware needed to break Bitcoin keys by about 17 times
The estimated size of a computer capable of breaking Bitcoin's cryptography just got a lot smaller.Researchers at Paris-based quantum computing firm Alice & Bob say a machine with about 30,000 physical qubits could derive a Bitcoin private key from its public key in just over an hour. Their message to Bitcoin developers is to start the move to quantum-resistant security now, because the upgrade itself could take years.Some context on how fast this number has been falling. Earlier estimates put the hardware needed to crack Bitcoin's cryptography in the millions of physical qubits.In March 2026, Google Quantum AI cut that figure to fewer than 500,000 physical qubits. Alice & Bob's model now lands at around 30,000. Measured against Google's upper bound, that is roughly 17 times less hardware.The target is secp256k1, the elliptic-curve cryptography that protects Bitcoin wallets. The attack method is Shor's algorithm, a quantum routine that can, in principle, work backward from a public key to the private key that controls the funds.A quick word on qubits. Physical qubits are the actual hardware components, and they are notoriously error-prone. Logical qubits are error-corrected units built from many physical ones. Shrinking the number of physical qubits needed means cutting the most expensive and hardest-to-build part of the machine.Alice & Bob's approach relies on superconducting "cat qubits," its own hardware design. The efficiency gains in the model come from pairing that architecture with a leaner way of running the attack.Nobody has built a machine like this yet. Fault-tolerant quantum computers at the required scale are still expected to be several years away, with the researchers pointing to potentially threatening hardware arriving toward the early 2030s.Alice & Bob itself is a player in that race. The company, founded in 2020, has raised approximately €130 million and is aiming for a 100-logical-qubit fault-tolerant system by 2030.Google's own 2026 whitepaper added a sharper detail. It indicated that an "on-spend" attack could be carried out in 9–23 minutes using only 1,200–1,450 logical qubits.An on-spend attack targets coins in motion. When someone broadcasts a Bitcoin transaction, their public key becomes visible before the transaction is confirmed. A fast enough quantum computer could, in theory, derive the private key during that window and redirect the funds.The other exposure is coins sitting still. Roughly 6–7.1 million BTC, or approximately 30% of supply, is held in addresses whose public keys are already exposed.The core of the researchers' argument is less about physics and more about governance. Bitcoin does not upgrade quickly, and it is not designed to.Any change to the protocol, including a switch to quantum-resistant signatures, would need extensive testing before deployment. Alice & Bob cautions that this process is likely to take years. If the hardware arrives in the early 2030s and the fix takes years to ship, the math on when to start is not complicated.The researchers also flagged that hardware efficiency gains could shorten the expected timeline unexpectedly. This study is itself an example: the required qubit count has dropped sharply in a single year, driven by better algorithms and designs rather than a breakthrough machine.The most exposed group is holders of coins in addresses with already revealed public keys. That roughly 30% slice of supply is where a capable quantum attacker would look first, and it is also the part of the network that a protocol upgrade would struggle to protect unless owners actively move their funds.For developers, the challenge is coordination. Choosing a quantum-resistant signature scheme, testing it, and getting a decentralized network to adopt it is a multi-year project even when everyone agrees.