Key takeaways
- Google Quantum AI published a whitepaper identifying five attack vectors that could put over $100 billion in Ethereum assets at risk from quantum computers.
- The research slashes previous qubit estimates by 20x, finding that fewer than 500,000 physical qubits could crack the encryption protecting most crypto wallets.
- A quantum machine matching those specs could derive a private key in as little as nine minutes, fast enough to intercept a Bitcoin transaction before confirmation.
- The Ethereum Foundation is working on quantum-resistant upgrades targeted for 2029, but existing smart contracts and wallets must each be migrated independently.
Published: April 1, 2026 UTC
Google Quantum AI released a 57-page whitepaper on March 31 that maps five specific ways a future quantum computer could attack Ethereum’s infrastructure, exposing more than $100 billion in assets to potential theft. The paper, co-authored with Ethereum Foundation researcher Justin Drake and Stanford cryptographer Dan Boneh, represents the most detailed public assessment of quantum risk to any single blockchain network.
Elliptic curve cryptography (ECDLP-256) is the encryption standard that protects private keys on both Bitcoin and Ethereum. Google’s researchers compiled two quantum circuits implementing Shor’s algorithm that would require between 1,200 and 1,450 logical qubits and 70 to 90 million Toffoli gates to break it. That translates to fewer than 500,000 physical qubits on a superconducting system, a 20-fold reduction from the “millions of qubits” figure commonly cited in prior research.
Five ways quantum could break Ethereum
The whitepaper goes beyond the standard “quantum breaks encryption” warning by identifying five distinct attack surfaces across Ethereum’s architecture.
The first is long-lived account attacks. Because Ethereum public keys become permanently visible once a wallet sends a transaction, the top 1,000 Ethereum wallets by balance, holding roughly 20.5 million ETH ($41.5 billion), are already exposed. A quantum machine cracking one key every nine minutes could work through all 1,000 in under nine days.
The second targets admin key compromise. At least 70 smart contracts controlled by admin keys manage billions in locked assets. Google estimates $5.1 billion sits behind these exposed keys, including contracts that govern major stablecoin infrastructure.
Third, stablecoin control points. Minting functions, price feed oracles, and liquidity pools tied to roughly $200 billion in tokenized assets and real-world asset tokens all rely on the same vulnerable key pairs.
Fourth, Layer 2 protocol exposure. About 15 million ETH ($30.4 billion) locked in Layer 2 rollup bridges and sequencer systems could be targeted. A Layer 2 network is a separate blockchain that processes transactions off Ethereum’s main chain for speed and lower cost, then settles the results back to Ethereum.
Fifth, consensus stake via BLS signatures. Approximately 37 million staked ETH ($74.9 billion) securing Ethereum’s proof-of-stake consensus uses BLS cryptography, which faces its own quantum vulnerabilities distinct from ECDSA.
Bitcoin is not spared
The paper also quantifies Bitcoin’s exposure. About 6.7 million BTC ($444 billion) sits in addresses with exposed public keys. Of that, 1.7 million BTC ($112.6 billion) remains locked in legacy Pay-to-Public-Key scripts from Bitcoin’s early years, many tied to wallets whose owners have lost their private keys and cannot migrate to safer formats. Bitcoin’s Taproot upgrade, ironically, reintroduced quantum vulnerability by placing tweaked public keys directly in locking scripts.
For active transactions, the attack window is tight but real. Google’s analysis found a fast-clock quantum system could execute an “on-spend” attack within approximately nine minutes, just inside Bitcoin’s average 10-minute block interval, with a success probability slightly under 41%.
The timeline is tightening
Google has set its own internal migration deadline to post-quantum cryptography for 2029. Drake disclosed that his confidence in a quantum event has increased, stating there is “at least a 10% chance that by 2032 a quantum computer recovers a secp256k1 ECDSA private key from an exposed public key.”
The Ethereum Foundation is actively developing quantum-resistant upgrades on a similar 2029 timeline. But the researchers stressed that upgrading Ethereum is harder than upgrading a centralized system. Every smart contract, wallet, and Layer 1 protocol must be individually migrated and rekeyed. Abandoned wallets and immutable contracts cannot be upgraded at all.
The paper’s authors, Google’s Ryan Babbush (Director of Research, Quantum Algorithms) and Hartmut Neven (VP of Engineering, Google Quantum AI), used a zero-knowledge proof approach to disclose the vulnerabilities without publishing working attack code. They urged other research teams to adopt the same responsible disclosure framework.
For wallet holders, the immediate practical advice is straightforward: avoid reusing addresses with exposed public keys and move funds to fresh wallets where the public key has not yet been broadcast to the network.
FAQ
Can quantum computers steal cryptocurrency right now?
No. Current quantum computers do not have enough qubits to break the encryption protecting crypto wallets. Google’s paper estimates the attack requires fewer than 500,000 physical qubits, while the most advanced quantum systems today operate with around 1,000 to 1,500 qubits. The threat is projected for the late 2020s to early 2030s.
Why is Ethereum more exposed than Bitcoin to quantum attacks?
Ethereum has more attack surfaces because its proof-of-stake consensus, smart contract admin keys, Layer 2 bridges, and stablecoin infrastructure all depend on vulnerable cryptography. Bitcoin’s risk is concentrated in wallets with exposed public keys, while Ethereum’s risk spans its entire protocol stack.
What can crypto holders do to protect themselves from quantum threats?
The most immediate step is to avoid reusing wallet addresses that have already broadcast a public key. Move funds to new addresses where the public key remains hidden. Long term, the industry will need to transition to post-quantum cryptographic standards, a process both Ethereum and Bitcoin communities are actively researching.
