Ten days ago, on December 9, Google announced Willow, a 105-qubit quantum processor that achieved something the field has chased for nearly three decades: error rates that fall as the machine gets bigger. The announcement immediately revived the oldest question at the intersection of quantum computing and Bitcoin — is the cryptography securing the network now living on borrowed time? The short answer: Willow is a genuine scientific milestone, and it changes nothing about the practical security of your coins today.
The longer answer is worth nine minutes, because the distance between "milestone" and "threat" is measured in orders of magnitude, and because a specific, identifiable subset of bitcoin is more exposed than the rest. Below we walk through what Willow actually demonstrated, what breaking Bitcoin's elliptic-curve cryptography would require, which coins would be first in line, and what — if anything — a careful holder should change as of December 2024.
What Willow actually demonstrated
Willow is a superconducting quantum chip with 105 physical qubits, built at Google's fabrication facility in Santa Barbara. Google published two headline results, and the less famous one matters far more. The first is below-threshold quantum error correction. Quantum bits are fragile: heat, vibration, and stray electromagnetic noise corrupt them constantly, which is why quantum computers have historically produced errors faster than they produced useful work. The standard fix is to encode one reliable "logical" qubit across many unreliable physical qubits — but that only helps if the physical error rate sits below a critical threshold. Above it, adding qubits adds more noise than it removes.
Willow crossed that line. As Google grew its error-correcting surface code from a 3×3 grid of physical qubits to 5×5, then to 7×7, the logical error rate roughly halved at each step. Below-threshold error correction means that adding more physical qubits to an encoded logical qubit makes the logical error rate fall rather than rise. Researchers have been trying to demonstrate this convincingly since the 1990s. It is real, peer-reviewed progress, and it deserves to be taken seriously.
The second result generated the headlines. Willow completed a random circuit sampling benchmark in under five minutes that, by Google's own estimate, would take one of today's fastest supercomputers about 10²⁵ years. That comparison is Google's framing and should be read as such: random circuit sampling is a task chosen precisely because quantum hardware is naturally good at it and classical hardware is naturally terrible at it. It has no known commercial or cryptographic application. It is a stress test, not a codebreaker.
A benchmark is not Shor's algorithm
The quantum attack that matters for Bitcoin is specific: running Shor's algorithm against secp256k1, the elliptic curve behind every Bitcoin signature, to derive a private key from a known public key. That computation must run on error-corrected logical qubits, for hours, without collapsing under accumulated noise.
Breaking secp256k1 with Shor's algorithm would require on the order of thousands of error-corrected logical qubits, which at realistic error rates translates to millions of physical qubits, per widely cited research estimates. Willow has 105 physical qubits and demonstrated roughly one good logical qubit. The gap is not a product cycle; it is around four orders of magnitude in physical qubit count, plus unsolved engineering problems in cryogenics, control wiring, and manufacturing yield that get harder — not easier — as machines grow.
No credible researcher claims a cryptographically relevant quantum computer exists today, and Google's own published roadmap places large-scale, error-corrected machines several major milestones away. Serious estimates for when quantum computing might reach that scale range from about a decade to several decades to never. Those estimates could compress — the whole point of Willow is that scaling now helps rather than hurts — but any compression would be visible well in advance, because logical-qubit counts are published research results, not secrets.
Which bitcoin would be first in line
Here is the part most coverage skips: a quantum attacker running Shor's algorithm needs your public key, and not every coin exposes one. Bitcoin outputs fall into two broad classes.
- Exposed public keys. The earliest coins — including the roughly one million BTC commonly attributed to Satoshi-era mining — were paid directly to raw public keys (P2PK), which sit on-chain in full view. Every address that keeps a balance after being spent from is exposed too, because the first spend reveals its public key. Taproot outputs likewise place a tweaked public key on-chain by design.
- Hash-guarded outputs. A Bitcoin address that has never been spent from exposes only the hash of its public key, not the public key itself, and Shor's algorithm cannot be aimed at a hash. For these coins the attacker's only opening is the short interval between broadcasting a transaction, which reveals the key, and that transaction confirming — a far harder race against the network.
The exposed class is not small. One widely cited Deloitte analysis estimated that outputs with exposed public keys hold roughly a quarter of all bitcoin, mostly early P2PK coins and reused addresses. If a cryptographically relevant machine ever arrives, those coins — many provably dormant, their owners long gone — are the canary. They would be attacked first, publicly and unmistakably, and the network would have unambiguous warning before hash-guarded coins were touchable.
The fix exists; migration is the hard part
Post-quantum cryptography is no longer theoretical. In August 2024, NIST finalized its first three post-quantum standards — FIPS 203, 204, and 205 — covering key encapsulation and digital signatures designed to resist quantum attack. Bitcoin could adopt a quantum-resistant output type through a soft fork, the same upgrade path that delivered SegWit and Taproot.
The genuinely hard problems are practical, not mathematical. Post-quantum signatures are large — kilobytes, against roughly 70 bytes for a secp256k1 signature — which strains block space. Migration requires every holder to move coins to new output types, a coordination exercise across tens of millions of participants. And the millions of coins whose keys are lost can never migrate at all, which will eventually force an uncomfortable community decision: leave them as a quantum bounty, or freeze them at the protocol level. These are governance questions, and governance moves slower than mathematics. That is the honest argument for paying attention early — not panic, but lead time.
What Willow changes about how you hold keys: nothing, and that is the point
As of this writing, the threats that actually cost people bitcoin are unchanged: phishing, seed-phrase theft, malware on online devices, custodial failure, and plain loss. A sober reading of Willow leaves your security checklist exactly where it was — though it is worth noticing that good key hygiene and good quantum hygiene are largely the same list:
- Do not reuse addresses. Reuse leaks your public key permanently and moves your coins into the exposed class for whatever hardware exists decades from now. Modern wallets rotate addresses by default; let them.
- Keep keys offline. Whatever the far future holds, today's attacks arrive over the network. Ownbit's cold-wallet workflow turns a spare phone into an air-gapped signer that exchanges unsigned transactions and signatures purely by QR code, and our security model is built so that recovery never depends on Ownbit's servers.
- Remove single points of failure. One seed phrase is one theft, one house fire, or one confused heir away from total loss — a risk that is real every single day, unlike Shor's algorithm.
One honest caveat belongs here. No key-management scheme changes the underlying curve: multisig, MPC, and hardware wallets all settle to signatures verified by the same elliptic-curve mathematics on-chain, a point we also made in our MPC vs MultiSig comparison. What Ownbit MultiSig changes is everything that threatens you before any quantum machine exists: it splits control across independent, standard BIP39 seed phrases, so no single device compromise or lost backup can move funds. And because it is built on open standards with open-source contracts, it sits on the same upgrade path as the rest of the ecosystem when post-quantum signature types eventually arrive.
Frequently asked questions
Did Google's Willow chip break Bitcoin's encryption?
No. Willow demonstrated below-threshold error correction on 105 physical qubits and ran a sampling benchmark with no cryptographic use. Breaking Bitcoin's secp256k1 curve would require running Shor's algorithm on thousands of error-corrected logical qubits — millions of physical qubits by widely cited estimates — which no machine on Earth can do today.
How many qubits would it take to break Bitcoin's cryptography?
Published research estimates put the requirement on the order of thousands of logical qubits, which at realistic error rates means millions of physical qubits working in concert. Willow has 105 physical qubits and demonstrated roughly one high-quality logical qubit, leaving a gap of about four orders of magnitude before the engineering challenges are even counted.
Which bitcoins are most vulnerable to quantum computing?
Coins whose public keys are already visible on-chain: early pay-to-public-key (P2PK) outputs, balances on reused addresses, and taproot outputs. A widely cited Deloitte analysis put this exposed class at roughly a quarter of all bitcoin. An address that has never been spent from reveals only a hash, which Shor's algorithm cannot attack directly.
Should I move my bitcoin to a new address because of Willow?
There is no urgency — no machine capable of the attack exists or is close. The sensible habits are the ones that already apply: avoid address reuse, keep keys offline, and eliminate single points of failure. If a cryptographically relevant machine ever approaches, exposed dormant coins would be attacked first and the ecosystem would have years of visible warning to migrate.
Willow is a reason to pay attention, not a reason to panic — and the best preparation looks exactly like ordinary good custody. If you want to remove the single points of failure that matter today, Ownbit's MultiSig lets you split control across independent seed phrases on your own devices, and our security overview explains how the design keeps recovery in your hands, with or without our servers.