The “9-Minute Attack” Paper: What It Really Says
Google’s quantum team did not break Bitcoin. It published a 57-page resource estimate, released on March 30, 2026 with researchers from the Ethereum Foundation and Stanford, that answers a narrower question: if someone built a large enough quantum computer, how much would it cost to crack the elliptic curve cryptography behind Bitcoin and Ethereum, and how fast would it run?
The headline number, “9 minutes,” got detached from every assumption that makes it true. Here’s what it found, and what it didn’t.
What the Paper Actually Claims
Bitcoin secures funds with ECDSA on the secp256k1 curve. The hard problem underneath it, recovering a private key from a public key, is the kind of problem Shor’s algorithm solves on a quantum computer. That part isn’t new. It’s been understood since the 1990s.
What’s new is the price tag. Google’s circuits put the cost of breaking secp256k1 at fewer than 500,000 physical qubits, roughly a 20x drop from the prior leading estimate. And the number keeps falling as the engineering improves.
Where “9 Minutes” Comes From
The 9 minutes rests on a stack of assumptions. The paper models a superconducting, fault-tolerant machine with quantum gates firing at microsecond speeds. Optimized circuits and parallel execution bring a full run down to tens of minutes. Then comes the trick: a large share of the work can be done in advance, before the attacker ever sees the target key. Strip that precomputed work out, and the time tied to one specific key drops to roughly 9 minutes.
The figure grabbed attention for one reason. Bitcoin’s average block time is about 10 minutes. So in theory, an attacker who sees your public key the moment it hits the mempool could recover your private key before your transaction confirms, then broadcast a competing transaction that spends the same coins to themselves.
The Precondition Almost Everyone Skips
The attack needs an exposed public key. This is the line that gets cut from the headlines.
Your Bitcoin public key isn’t visible while your coins sit in a modern, unused address. It becomes visible when you spend, as soon as your signature is broadcast. So the “9-minute” scenario is a race that only starts once you reveal the key, and only against the transaction in flight. Reused addresses and old pay-to-public-key outputs are worse off, because their keys have been sitting in the open for years. Those don’t need a 9-minute sprint. An attacker can take all the time they need.
What It Doesn’t Prove
The paper is a cost model. No quantum computer ran this. Today’s largest processors hold on the order of 1,000 physical qubits, and none are error-corrected at anything close to the scale the attack assumes. The gap to 500,000 stable, fault-tolerant qubits is enormous, and closing it depends on error correction, real-time decoding, and control systems that don’t exist yet.
Google even withheld the actual circuits, committing to them with a hash so outside parties can verify the resource bounds without seeing the attack itself. That’s a careful way to publish a dangerous result. Building the machine that runs it is another matter.
What It Means for Holders
Our read of the timelines is to treat the next decade as the planning window, not the panic window. Google has set its own migration deadline at 2029. The UK’s NCSC flags 2028, 2031 and 2035. The Global Risk Institute’s 2025 survey rates a cryptographically relevant quantum computer within 10 years as “quite possible.” No single one of them names a confirmed Q-Day. Together they point the same way: start the work now, because cryptographic migration runs in years, not quarters.
By qLABS’ quantum vulnerability index, Bitcoin holds around 71% of the quantum-exposed capital across the top 20 chains, and it has no formal migration plan. That’s why it sits at the bottom of the index. Cardano, by contrast, scores far better.
Holders aren’t helpless while the chains catch up. Stop reusing addresses. Keep long-term funds in addresses whose public keys have never been revealed on-chain. And the post-quantum signature schemes NIST standardized in 2024 are the basis for the next layer of defense, whether it arrives through chain-level upgrades like Bitcoin’s BIP-360 debate or through holder-side tools such as qVAULT, which adds a Falcon (FN-DSA) lock on top of a standard wallet so funds can’t move on a broken ECDSA key alone.
The Bottom Line
The “9-minute attack” is real math aimed at hardware nobody has built yet, and only at a key you expose when you spend. The runtime was never the point. The cost of breaking secp256k1 keeps falling while the migration work that would blunt it has barely begun. That’s the gap worth watching.