Quantum Threat to Bitcoin: Google's 40x Error Cut, a Nine-Firm Alliance and 6 Million Exposed Coins

In one week the quantum threat to Bitcoin moved from conference panels to a working agenda. On October 13 Coinbase, which holds about 5% of all bitcoin in custody, published a paper asking developers to start the migration now. On October 15 Google reported in Science that a technique called magic state cultivation cut a key class of errors on its Willow chip by about 40 times. The same day nine crypto companies launched the Quantum Alliance, a standards body for judging what "quantum-resistant" actually means. Meanwhile Glassnode counted 6.26 million BTC, 31.2% of supply, sitting in addresses whose public keys are already visible on-chain. None of this means a quantum computer can take coins today. It does mean the industry has stopped treating the question as science fiction. Here is what changed, what the numbers measure and what a holder can do without waiting for a protocol upgrade.

Key takeaways

• Google's result is about error correction, not code breaking: the experiment used at most 54 of Willow's 105 qubits, while attacking Bitcoin's curve would need fewer than 500,000 physical qubits by Google's own March 2026 estimate.
• The Quantum Alliance unites Quantus, Hacken, Keystone, Midnight Foundation, Abelian, Postquant Labs, The Vault, American Fortress and Intmax to write open test criteria and migration rules for networks, wallets and bridges.
• Coinbase proposes flexible output types (P2MR from BIP-360 and P2TRv2), hybrid spending during transition and a separate decision about dormant coins with exposed keys.
• Exposure estimates cluster between 6 and 7 million BTC: Glassnode counts 6.26 million, the Alliance 6.04 million, Coinbase's advisory council 6.9 million including 1.7 million in old pay-to-public-key outputs.
• Starknet's plan to leave Ethereum for a quantum-resistant chain by 2027 pushed STRK up more than 80% in a week and then down about 41%, a reminder that the trade is far ahead of the technology.

What Google actually did on October 15

A quantum computer needs two kinds of operations. The simple ones can be protected by standard error correction. The harder ones, which any useful program depends on, consume a resource physicists call magic states: single-use ingredients that must be manufactured clean before each operation. Making them has been the most expensive part of the machine. Google cites estimates that preparation can eat up to 95% of a quantum computer's capacity.

The standard recipe since 2004 is distillation: take many noisy magic states, boil them down into a few clean ones, and accept that whole regions of the chip do nothing else. In 2024 Google researchers proposed a cheaper route, magic state cultivation. It works like a filter: inject a rough state into a tiny patch of the chip, run a chain of checks, discard every attempt with a detected flaw and keep growing the survivors.

The October paper in Science shows the filter working on real hardware. On Willow it produced T-states with a logical fidelity of 99.99% and roughly 40 times fewer errors than uncultivated states. Only about 8% of attempts passed every check, so the chip throws away more than nine out of ten tries to keep one. The team also moved the finished states from one error-correcting code into another, a step needed for them to be used in a larger computation.

What it is not: an attack on anything. The run used 54 qubits at most. Factoring an RSA-2048 key would need magic states with error rates around one in ten billion, far beyond this experiment. Cultivation is one of the ingredients behind Craig Gidney's 2025 estimate that RSA-2048 could fall to under a million noisy qubits, down from 20 million in his 2019 paper, and behind the March 2026 Google whitepaper co-authored with Ethereum Foundation researcher Justin Drake and Stanford cryptographer Dan Boneh that put the cost of breaking Bitcoin's elliptic curve cryptography at fewer than 500,000 physical qubits. Those are cost estimates for a machine nobody has built, not a schedule.

Why the quantum threat to Bitcoin is a public key problem

Bitcoin addresses are hashes. As long as coins sit at an address that has never spent, the public key behind it is not on the ledger, and a quantum computer would have to break the hash function first, which no known algorithm does efficiently. The exposure starts the moment a public key becomes visible: in the oldest pay-to-public-key outputs from the Satoshi era, in any address that has been reused after a spend, and for the minutes a transaction waits in the mempool before confirmation. That is where Shor's algorithm would apply: derive the private key from the public key and sign a competing transaction.

The numbers in the headlines measure this exposed slice, and they are consistent with each other.

Two details matter more than the headline figure. First, about two thirds of the exposed coins are exposed by habit, not by design: the owner reused an address. That part can shrink today without any protocol change. Second, Glassnode attributes roughly 1.66 million exposed BTC to exchange wallets, which reuse hot addresses by construction. The coins in the Satoshi lawsuit we covered belong to the structural category: old outputs whose keys were visible from day one and whose owners may never move them.

The Quantum Alliance: nine firms and one missing definition

Any network can call itself quantum-resistant today. There is no agreed definition of the claim, no standard test and no rule for how two migrated chains should talk to each other. The Alliance launched on October 15 to close that gap. Its founding contributors span base layers, privacy networks, rollups, hardware wallets and auditors: Quantus, Postquant Labs, Midnight Foundation, Keystone, Abelian, Hacken, The Vault, American Fortress and Intmax.

The body is modeled on the Internet Engineering Task Force. Proposals advance on public evidence and working implementations rather than on a member's size or token holdings, and everything it produces is published openly. Work is split into four groups: blockchain migration, post-quantum zero-knowledge systems, wallet security and cross-chain compatibility. The reference point is the first set of post-quantum standards that NIST approved in August 2024; the Alliance's complaint is that two years later the industry still has no shared way to adopt them.

Quantus founder Christopher Smith summed up the ambition: in the future, post-quantum cryptography will just be called cryptography, and everything else will be in a museum. The Alliance also cites a cluster of forecasts pointing to the late 2020s, including a model built by two of its contributors that flags March 2028 as an early window. Treat that as a planning assumption, not a prediction: the same documents say no machine can do it yet.

Coinbase's paper: start before the threat is confirmed

Coinbase custodies roughly one million BTC for clients, about 5% of everything mined and around $80 billion at mid-October prices. Its October 13 paper, written by Shashank Agrawal, is framed as input to a discussion, not a plan Bitcoin has adopted. The proposals are specific enough to argue with:

• Output types that separate where coins sit from how they are spent, so the signature scheme can change without redesigning the protocol again. Named candidates are pay-to-merkle-root (P2MR) from BIP-360 and P2TRv2.
• Hybrid spending during the transition: a coin can be unlocked with today's ECDSA or Schnorr signature or with a post-quantum one, letting wallets and custodians migrate before legacy signatures are restricted.
• Candidate algorithms ML-DSA, SLH-DSA, FN-DSA and SHRINCS, weighed against block space, fees, verification speed and hardware wallet compatibility. Stateful schemes are flagged as operationally dangerous, because reusing a signing state can enable forgery.
• A separate track for dormant coins and lost keys: recovery mechanisms, migration deadlines and possible limits on legacy spending, with an admission that all of these raise ownership questions.

Coinbase is already building PQ-CoreKMS, a post-quantum version of its institutional key management, with a first signing pipeline promised within about a year of its July announcement. A separate research consortium backed by BlackRock, Strategy and Coinbase has committed $15 million to the problem.

Starknet and the market's reaction

On October 8 StarkWare CEO Eli Ben-Sasson said Starknet is actively considering leaving Ethereum to become its own layer-1, with the goal of being the first fully quantum-resistant network by 2027. His argument is structural: a rollup can only be as quantum-safe as the chain it settles on, and Ethereum's own target is 2029. Starknet's proofs already rest on hash functions, which are considered quantum-resistant; a roadmap published on June 30 covers replacing the remaining elliptic curve pieces. A day earlier Justin Drake had asked the industry to calmly plan for a "bunker mode" in case AI-assisted mathematics weakens ECDSA before quantum hardware does.

STRK rallied more than 80% in seven days to $0.126, its highest level since December 2025 and the best performance among the top 100 tokens that week. By October 18 the token had given back about 41%, with a 127 million STRK unlock on October 15 adding supply into the move. Nothing in the protocol changed during those ten days. The price reflected a narrative, and narratives round-trip.

What a holder can do now

• Stop reusing addresses. Every spend from an address reveals its public key; send change and new deposits to fresh addresses, which every modern wallet does by default.
• Move old coins once. Funds in pay-to-public-key outputs or in addresses that have already spent can be sent to a fresh address today. That moves them out of the exposed 6 million until the next spend.
• Do not expect a hardware wallet to solve this. The devices protect the key from theft, not from mathematics; our piece on hardware wallet security shows the failure modes they do cover.
• Watch where custody sits. Exchange hot wallets reuse addresses and hold about 1.66 million exposed BTC by Glassnode's count; a custodian's migration plan is now a fair due-diligence question.
• Follow BIP-360 and the Alliance's working groups rather than token announcements. The upgrade that matters will be a Bitcoin soft fork debated in public, not a listing.

Key terms

• Shor's algorithm: a quantum algorithm that can derive a private key from a public key on the elliptic curve Bitcoin uses, given a large enough fault-tolerant machine.
• Magic state: a consumable quantum resource required for the hardest class of operations; cultivation and distillation are two ways to produce it cleanly.
• Exposed public key: a key visible on the ledger because the coins sit in a pay-to-public-key output or at an address that has already spent.
• BIP-360: a Bitcoin improvement proposal for a quantum-resistant output type, referred to by Coinbase as pay-to-merkle-root.
• Post-quantum cryptography: signature and key-exchange schemes designed to resist quantum attacks; NIST approved the first standards in August 2024.
• Hybrid spending: a transition design where a coin can be unlocked with either a classical or a post-quantum signature.