The ‘9-Minute Attack’ Paper: What It Really Says

01What the Paper Actually Claims

Bitcoin secures funds with ECDSA on the secp256k1 curve. The hard problem underneath it, recovering a private key from a public key, is the kind of problem Shor’s algorithm solves on a quantum computer. That part isn’t new. It’s been understood since the 1990s.

What’s new is the price tag. Google’s circuits put the cost of breaking secp256k1 at fewer than 500,000 physical qubits, roughly a 20x drop from the prior leading estimate. And the number keeps falling as the engineering improves.

The practical response does not wait on the hardware: store rather than spend, keep long-term coins in addresses you have never spent from, and stop reusing addresses. The full routine is in How to Protect Your Crypto From Quantum Computers and Address Reuse: The New Quantum Security Flaw.

02Where “9 Minutes” Comes From

The 9 minutes rests on a stack of assumptions. The paper models a superconducting, fault-tolerant machine with quantum gates firing at microsecond speeds. Optimized circuits and parallel execution bring a full run down to tens of minutes. Then comes the trick: a large share of the work can be done in advance, before the attacker ever sees the target key. Strip that precomputed work out, and the time tied to one specific key drops to roughly 9 minutes.

The figure grabbed attention for one reason. Bitcoin’s average block time is about 10 minutes. So in theory, an attacker who sees your public key the moment it hits the mempool could recover your private key before your transaction confirms, then broadcast a competing transaction that spends the same coins to themselves.

03The Precondition Almost Everyone Skips

The attack needs an exposed public key. This is the line that gets cut from the headlines.

Your Bitcoin public key isn’t visible while your coins sit in a modern, unused address. It becomes visible when you spend, as soon as your signature is broadcast. So the “9-minute” scenario is a race that only starts once you reveal the key, and only against the transaction in flight. Reused addresses and old pay-to-public-key outputs are worse off, because their keys have been sitting in the open for years. Those don’t need a 9-minute sprint. An attacker can take all the time they need.

Want to know where your own coins sit on that list? How to Check if Your Bitcoin Address Has an Exposed Public Key walks through classifying each address and moving exposed balances.

04What It Doesn’t Prove

The paper is a cost model. No quantum computer ran this. Today’s largest processors hold on the order of 1,000 physical qubits, and none are error-corrected at anything close to the scale the attack assumes. The gap to 500,000 stable, fault-tolerant qubits is enormous, and closing it depends on error correction, real-time decoding, and control systems that don’t exist yet.

Google even withheld the actual circuits, committing to them with a hash so outside parties can verify the resource bounds without seeing the attack itself. That’s a careful way to publish a dangerous result. Building the machine that runs it is another matter.

05What It Means for Holders

Our read of the timelines is to treat the next decade as the planning window, not the panic window. Google has set its own migration deadline at 2029. The UK’s NCSC flags 2028, 2031 and 2035. The Global Risk Institute’s 2025 survey rates a cryptographically relevant quantum computer within 10 years as “quite possible.” No single one of them names a confirmed Q-Day. Together they point the same way: start the work now, because cryptographic migration runs in years, not quarters.

By qLABS’ quantum vulnerability index, Bitcoin holds around 71% of the quantum-exposed capital across the top 20 chains, and it has no formal migration plan. That’s why it sits at the bottom of the index. Cardano, by contrast, scores far better.

06The Bottom Line

The “9-minute attack” is real math aimed at hardware nobody has built yet, and only at a key you expose when you spend. The runtime was never the point. The cost of breaking secp256k1 keeps falling while the migration work that would blunt it has barely begun. That’s the gap worth watching.

“

The “9-minute attack” is real math aimed at hardware nobody has built yet, and only at a key you expose when you spend. The runtime was never the point.

---

This article is educational and does not constitute security or investment advice.

// FAQ

Did Google break Bitcoin?

No. The paper is a 57-page cost estimate, not an attack. No quantum computer ran it, and Google withheld the actual circuits behind a hash so others can verify the numbers without reproducing the attack.

Can someone steal my coins in 9 minutes today?

No. The 9 minutes is a modeled runtime on a fault-tolerant machine with around 500,000 stable qubits, which does not exist. The largest processors today hold about 1,000 qubits and are not error-corrected at that scale.

What does the "9 minutes" actually measure?

The time to recover a private key from one specific public key once most of the work is precomputed. It only matters after you expose your key by spending, and it maps to Bitcoin’s roughly 10-minute block time.

How do I protect myself now?

Stop reusing addresses and keep long-term funds in addresses whose public key has never been broadcast. Chain-level upgrades and post-quantum signature schemes are the longer-term fix.