Satoshi-era bitcoin faces a bigger quantum threat after Google’s new Willow breakthrough

What it is

Google's Science paper on "cultivation" for Willow, a way to prepare magic states with about 40x fewer errors. CoinDesk frames it as one input to the Bitcoin quantum-risk timeline. The paper itself is not an attack result.

How it works

Cultivation starts with a rough magic state, checks it for errors and discards flawed attempts. The aim is clean states using less hardware than older methods. The 99.99% fidelity applies only to states that passed inspection, and about 8% of attempts survived the checks.

Preconditions / Affected

• Coins with permanently exposed public keys are the most exposed, since an attacker works from data already on-chain. The page says some of Bitcoin's oldest holdings have been exposed since they were mined.
• Lost coins are a hard case. Moving to stronger spending protections requires the existing keys, so if those are lost the owner cannot migrate, and the exposed public key stays available to a future attacker.
• Hash-hidden keys reveal the public key only on spend. An attacker would need to recover the secret fast enough to interfere with that payment.

Caveats

• The 40x gain does not stack on earlier estimates. Google's March estimate (under 500,000 physical qubits) already assumed efficient magic-state production. The experiment tests part of that engineering approach and does not cut attack cost another 40-fold.
• The March model's roughly nine-minute attack, run after a public key becomes available, needs about 500,000 sufficiently reliable magic states per second. That throughput is the figure to compare against future hardware.
• Open work listed by the researchers: running at much larger scale, keeping states useful through longer calculations, real-time operation, and moving states into stronger error-correcting setups.
• Shor's algorithm has never been demonstrated at an attack-relevant scale.
• A September result cut the workload of one core calculation in the attack. It covered one component and not the full attack or hardware costs.
• Old-coin movements (100.02 BTC dormant since July 2010 moved Oct. 7, about $8.5M; 553.59 BTC from six wallets dormant since 2011–2014 moved in August, about $40M) do not establish a quantum-driven response. The page notes they could be wallet changes, reorganizing or preparing to sell.

The page gives no mitigation commands or timelines. For key-exposure policy, the useful point is that exposed-key outputs are the ones where an attacker has no deadline.