Crypto News: Google Says Crypto Keys Could Be Cracked in Minutes

Crypto news out of Google’s Quantum AI division has raised fresh urgency around the long-term security of blockchain networks.

In a newly published whitepaper, Google researchers revealed that breaking the elliptic curve cryptography protecting most cryptocurrency wallets would require far fewer quantum computing resources than previously estimated.

The research makes the threat more concrete and directly calls on the crypto industry to begin migrating to post-quantum cryptography by 2029.

Crypto News: Google’s Whitepaper Cuts the Qubit Threshold by 20x

The core finding in Google’s white paper is a notable reduction in the estimated quantum-computing resources required to break the 256-bit elliptic curve discrete logarithm problem, known as ECDLP-256.

This is the mathematical problem underpinning elliptic curve cryptography, which secures private keys and transaction signing across most major blockchains, including Bitcoin and Ethereum.

Google compiled two quantum circuits implementing Shor’s algorithm for ECDLP-256. The first uses fewer than 1,200 logical qubits and 90 million Toffoli gates. The second uses fewer than 1,450 logical qubits and 70 million Toffoli gates.

Both circuits, Google estimates, could be executed on a superconducting qubit system with fewer than 500,000 physical qubits in a matter of minutes.

That figure is roughly 20 times more efficient than prior estimates for the same attack. Dragonfly Capital Managing Partner Haseeb Qureshi noted in response to the publication that the research improves ECDSA cracking efficiency by approximately 20x, which pushes the expected timeline for when this threat becomes actionable forward rather than backward.

The practical implication is that a future cryptographically relevant quantum computer, or CRQC, capable of these operations would be able to derive a private key from a public key exposed on-chain. This will allow an attacker to steal funds from any wallet address that has previously sent a transaction.

What the Industry Must Do Before 2029

Google’s white paper is direct about the path forward. Post-quantum cryptography, or PQC, refers to cryptographic algorithms designed to resist attacks from quantum computers. Unlike elliptic curve cryptography, PQC is not vulnerable to Shor’s algorithm or its variants.

Google described PQC as a well-understood path to post-quantum blockchain security and pointed to examples of post-quantum blockchain implementations and experimental PQC deployments already in development.

The company set its own 2029 migration timeline and called on the broader cryptocurrency community to treat this deadline with urgency.

Two near-term recommendations stand out from the whitepaper. The first is for users and developers to stop reusing or unnecessarily exposing wallet addresses.

When a wallet address sends a transaction, its public key is revealed on-chain, making the address potentially vulnerable once a CRQC exists. Addresses that have received funds but never sent any remain protected because their public keys have not been exposed.

The second recommendation addresses abandoned coins, a policy-level concern around wallets that are no longer actively managed.

How Google Disclosed the Research Without Creating a Roadmap for Attacks

One of the more unusual aspects of Google’s disclosure approach was its decision to verify the research findings using a zero-knowledge proof rather than publishing the actual quantum circuits.

Google stated that it engaged with the US government before publication and developed this verification method specifically to allow the research to be confirmed without giving bad actors a step-by-step guide to executing the attack.