By Daniel Okafor

Google's Willow quantum chip has reduced errors roughly 40-fold when preparing "magic states," the consumable resource a quantum computer would need to sustain a theoretical attack on bitcoin wallets. The peer-reviewed result landed in Science this week and touches a bottleneck that rarely headlines the bitcoin quantum debate: not how big an attacking machine must be, but how much of it gets burned just getting ready to calculate.

The experiment reached about 99.99% fidelity among magic states that passed inspection. The catch: only around 8% of preparation attempts survived the checks, and Google's researchers say substantial scaling challenges remain before the method supports real-time operations on larger machines.

Why do Satoshi-era coins carry more risk?

A bitcoin wallet pairs a secret key with a public key. Spending usually reveals the public key; some older payment formats exposed it from the start. A machine large enough to run Shor's algorithm — the method mathematician Peter Shor published in 1994 — could theoretically work backward from an exposed public key to the secret key and sign transactions the network would accept as genuine. Nobody has demonstrated it.

Newer payment formats hash the public key, hiding it until the owner spends. An attacker targeting a hidden key would need to wait for exposure and recover the secret fast enough to interfere with a live payment. Coins whose public keys have sat in the open since they were mined give a future attacker unlimited time.

That's why lost coins are the hard case. Bitcoin can adopt stronger spending protections, but moving old holdings into them requires the existing keys. If those keys are gone, the exposed public key stays on-chain for any sufficiently capable future machine.

Old coins have been moving anyway. On Oct. 7, 100.02 BTC untouched since July 2010 shifted after more than 16 years, worth about $8.5 million. In August, six wallets dormant since 2011–2014 moved another 553.59 BTC, roughly $40 million at the time. The transfers don't prove holders are reacting to quantum risk — moving coins can mean reorganizing wallets or preparing to sell.

What did Willow actually solve?

Quantum computers store information in fragile qubits that heat, vibration and stray signals corrupt. Engineers bundle many physical qubits into error-correcting groups that behave as single logical qubits. Certain operations then require specially prepared "magic states," each consumed on use, so the machine must manufacture them continuously — hardware devoted to making them can't do other work.

Google's method, called cultivation, starts from a rough state, checks it for errors and discards flawed attempts, aiming to produce clean states with less hardware than older approaches. The reported 99.99% fidelity covers only states that passed inspection, with the roughly 8% yield measured across preparation and measurement.

How does this fit earlier attack estimates?

In March, Google estimated that a future superconducting quantum computer with fewer than 500,000 physical qubits could break the wallet cryptography used by Bitcoin and Ethereum, under specific hardware assumptions. That March paper also modeled an attack lasting about nine minutes after a public key becomes available, requiring roughly 500,000 sufficiently reliable magic states every second.

In September, CoinDesk reported on researchers cutting the workload of a core calculation in that attack — a software-side gain covering one component, not the full attack or its physical running costs.

One point deserves care: the gains don't multiply. Google's March estimate already assumed efficient magic-state production, so Willow's 40-fold improvement tests part of that engineering approach rather than making a bitcoin attack 40 times cheaper. The next hurdles are running cultivation at scale and keeping states useful as they feed longer calculations.

For bitcoin holders, the operational takeaway is narrow but real: coins with long-exposed public keys remain the segment most exposed to any future machine, and protocol-level protections only help those who still hold their keys to move them.