Willow vs Bitcoin: 105 Qubits Now, Under 500K to Break It

KEY TAKEAWAYS

Google’s March 2026 whitepaper estimated that fewer than 500,000 physical qubits could break Bitcoin’s elliptic curve cryptography, roughly 20 times below earlier projections.
Google’s Willow quantum processor contains 105 physical qubits, far below the threshold needed to threaten any blockchain encryption currently deployed in production.
Approximately 6.9 million Bitcoin, roughly one-third of total supply, sits in wallets with public keys already exposed on the blockchain, creating future vulnerability.
Justin Drake of the Ethereum Foundation estimated at least a 10% probability of a quantum machine recovering a private key from exposed public keys by 2032.
Google’s October 2026 demonstration of magic state cultivation on Willow cut magic-state errors by approximately 40-fold, achieving 99.99% logical fidelity in a result published in Science.

Google’s quantum computing division published a whitepaper in March 2026 that reduced the estimated qubit threshold for cracking Bitcoin’s encryption by a factor of 20. That finding dropped the requirement from millions of physical qubits to fewer than 500,000, according to research data published by Google Quantum AI.

This article traces Google’s quantum hardware evolution from Sycamore’s 53 qubits in 2019 to Willow’s 105 qubits in 2024. It examines what the revised qubit estimates mean for Bitcoin’s elliptic curve cryptography, how much cryptocurrency sits in vulnerable wallets, and what timeline researchers project for a viable quantum attack on blockchain networks.

From Sycamore’s 53 Qubits to Willow’s 105: Google’s Quantum Hardware Evolution

Google claimed quantum supremacy in October 2019 with Sycamore, a 53-qubit processor that completed a specific computation in 200 seconds. That same calculation would have taken the world’s most powerful classical supercomputer approximately 10,000 years. The achievement demonstrated quantum advantage but had no practical cryptographic applications.

Willow arrived in late 2024 as Google’s next-generation quantum processor, doubling the qubit count to 105 physical qubits. The chip introduced improvements in error correction that proved critical for future scaling ambitions. Google described Willow as a stepping stone toward fault-tolerant quantum computing, the stage at which quantum machines could tackle real-world cryptographic problems.

The gap between 105 qubits and the estimated 500,000 needed to threaten Bitcoin remains enormous. Current quantum processors operate in what researchers call the Noisy Intermediate-Scale Quantum (NISQ) era, where error rates remain too high for sustained cryptographic computation. Each physical qubit introduces noise that compounds across multi-step calculations.

Google’s October 2026 hardware demonstration of magic state cultivation on Willow cut magic-state errors by approximately 40-fold, achieving 99.99% logical fidelity.

That result, published in Science, moved a purified quantum state from a distance-3 color code into a distance-5 surface code, demonstrating a concrete pathway toward the error correction levels that cryptographic attacks would require.

Why 500,000 Qubits Changes the Bitcoin Security Timeline

The March 2026 Google Quantum AI whitepaper modeled a quantum computer cracking a Bitcoin private key within approximately nine minutes after a transaction exposes the associated public key. That window gives an attacker a 41% probability of completing the theft before a standard 10-minute block confirmation closes, according to the research published alongside the qubit estimates.

Justin Drake of the Ethereum Foundation placed at least a 10% probability on a quantum machine recovering a secp256k1 private key from an exposed public key by 2032. Drake described the optimized circuit as requiring “just 100 million Toffoli gates, which is surprisingly shallow.” He added that logical qubit counts “could plausibly go under 1,000 soonish.”

The underlying paper gives lower estimates of up to 90 million Toffoli gates for a 1,200-logical-qubit system and 70 million for a 1,450-logical-qubit system.

Haseeb Qureshi, managing partner at Dragonfly, argued that such machines could arrive by the end of the decade rather than the mid-2030s. Qureshi called on all blockchains to develop post-quantum transition plans immediately, noting that Google released a zero-knowledge proof rather than its full circuits, which he called “very atypical” and a signal of seriousness.

Conor Deegan, a security engineer whose research was cited in the paper, highlighted how quantum computation could create reusable classical exploits from a one-time computational investment. CoinMarketCap described this as “a one-time cost that produces indefinitely reusable classical exploits.”

He stated that deploying new elliptic curve-based infrastructure is “now indefensible given these resource estimates,” calling for immediate transitions to post-quantum cryptographic standards.

6.9 Million Bitcoin Already Sitting in Quantum-Vulnerable Wallets

The Google whitepaper estimated that approximately 6.9 million Bitcoin (BTC), roughly one-third of total supply, sits in wallets whose public keys are already visible on the blockchain. That exposure includes 1.7 million BTC from Bitcoin’s earliest years, when the original pay-to-public-key format stored keys openly without the hashing protections added in later address formats.

The 2021 Taproot upgrade inadvertently expanded public key exposure by default, adding to the total volume of quantum-vulnerable coins. Glassnode estimated approximately 6.04 million BTC had public key exposure as of May 2026. A separate June 2026 study from Quantus estimated that roughly 2.3 million BTC may prove extremely difficult or impossible to migrate.

Eli Ben-Sasson, co-founder of StarkWare, urged the Bitcoin community to advance Bitcoin Improvement Proposal (BIP) 360, which proposes quantum-resistant wallet formats. A June 2026 study projected that a migration starting in 2026 could reach completion between 2029 and 2031 under its baseline assumptions.

Google stated it is collaborating with Coinbase, the Stanford Institute for Blockchain Research, and the Ethereum Foundation on responsible approaches to the post-quantum transition. The Ethereum Foundation has published a post-quantum research portal backed by eight years of preparatory work, with more than 10 client teams shipping weekly test networks.

Where Bitcoin Security Stands Against the Quantum Computing Timeline

The distance between current quantum hardware and a cryptographically relevant machine remains substantial but is shrinking faster than earlier projections assumed. Google’s Willow holds 105 physical qubits against an estimated requirement of 500,000, meaning the estimated threshold is roughly 4,800 times greater than Willow’s current physical qubit count.

Error correction advancements may compress that timeline further. Google’s October 2026 demonstration of magic state cultivation showed that error-correction techniques can still deliver large step-changes in fidelity, cutting magic-state errors by approximately 40-fold.

Google has yet to demonstrate the technique at a larger scale. If further development succeeds, the question shifts from whether quantum machines will threaten blockchain encryption standards to precisely when they will reach that capability.

Bitcoin currently lacks an approved network-wide deadline for adopting post-quantum signatures. Unlike Ethereum, which has a multi-fork migration roadmap and active test networks, Bitcoin’s governance structure makes coordinated upgrades slower and more politically contentious among its development community.

The practical implication is that investors holding Bitcoin in wallets with exposed public keys face a growing risk that no market mechanism currently prices. State-level actors represent an additional concern that Drake flagged specifically, noting that a blackout in published quantum research would itself be a warning signal worth monitoring.

FAQs

How many qubits does Google estimate are needed to break Bitcoin encryption?
Google’s March 2026 whitepaper estimated fewer than 500,000 physical qubits could break Bitcoin’s elliptic curve cryptography, roughly 20 times below prior estimates.

What is the difference between Google’s Sycamore and Willow quantum chips?
Sycamore launched in 2019 with 53 qubits to demonstrate quantum supremacy, while Willow doubled that count to 105 qubits with improved error correction.

How much Bitcoin is currently vulnerable to future quantum computer attacks?
Approximately 6.9 million Bitcoin sit in wallets with exposed public keys, representing roughly one-third of the total circulating supply on the blockchain.

When could quantum computers realistically threaten Bitcoin’s cryptographic security model?
Justin Drake estimated at least a 10% probability by 2032, while Haseeb Qureshi argued capable machines could arrive by the end of this decade.

What is BIP 360 and why does it matter for Bitcoin quantum resistance?
Bitcoin Improvement Proposal 360 proposes quantum-resistant wallet formats that would protect Bitcoin holdings from future quantum computers capable of cracking current encryption.

Has Google’s quantum processor actually cracked any cryptocurrency encryption yet?
No quantum processor has extracted any cryptocurrency private key to date, as current hardware remains far below the estimated qubit threshold for attacks.

What is quantum error correction and why does it matter for cryptography?
Quantum error correction reduces computational noise that accumulates during calculations, and Google’s October 2026 demonstration of magic state cultivation cut magic-state errors by approximately 40-fold, bringing fault-tolerant quantum computation closer to practical implementation.