Quantum threat to encryption is closer than earlier thought

欧洲刑警组织警告：量子计算或成加密货币钱包重大安全漏洞

2024年10月7日，欧洲刑警组织（Europol）发布两份报告，警告未来的量子计算机可能会破坏保护加密货币钱包的密码学算法。尽管目前尚无法确定此类机器何时会出现，但该机构敦促相关组织立即开始准备。

这一警告紧随Google Quantum AI团队在9月经过同行评审的研究成果之后。该研究发现，针对比特币背后椭圆曲线密码学的攻击，所需硬件资源比早期研究预估的要少得多。目前，没有任何量子计算机能够破解比特币或以太坊的私钥，但当前技术与具备危险能力的机器之间的距离在理论上已缩短。与此同时，IBM和IonQ等公司在纠错这一主要工程障碍方面已取得进展。

关键数据概览

• 单次攻击电路所需的逻辑量子比特数：≤ 1,200个
• 建模架构中所需的物理量子比特数：＜ 500,000个
• 公钥暴露的比特币数量：约604万枚（据Glassnode估算，欧刑警组织引用数据）
• 实现所有比特币输出量子安全的模拟停机时间：76天

钱包被视为薄弱环节，迁移成本高昂

The Europol report distinguishes two parts of blockchain security. Wallets rely on cryptographic technology to protect private keys, which is where their exposure risks lie. In contrast, hash functions that link blocks and ensure mining security are considered to be more resilient.

The agency predicts that the transition to quantum-resistant systems will be complex and slow. One estimate cited in the report pointed out that based on research assumptions, making each bitcoin output quantum secure may require a cumulative network outage of 76 days or more. It should be noted that this is a simulated migration cost estimate, not a planned actual shutdown.

Algorithm differences: Impact of Shor algorithm and Grover algorithm

The private key of Bitcoin or Ethereum is a number, while the public key is a point calculated based on the secp256k1 curve. Classical computers cannot reverse this process at any real time. However, the Shor algorithm can achieve this goal if it runs on a fault-tolerant quantum computer-a computer that can correct its own errors efficiently enough to complete long calculations.

Hash functions face weak quantum threats and are mainly affected by Grover's algorithm. Although the algorithm accelerates brute force searches, it still leaves attackers with an unrealistic workload. This is the theoretical basis for Europol to make the above distinction.

Exposure surface analysis

Type Function Quantum threat assessment Digital Signature (ECDSA) 保护钱包中的私钥 高风险：Shor算法可能从可见的公钥推导出私钥 哈希函数 链接区块、保障挖矿并将公钥隐藏在地址后 较强抵抗力：Grover算法仅提供有限的加速效果

暴露程度取决于公钥是否可见。仅接收资金的地址显示的是密钥的哈希值。一旦所有者进行支出，密钥就会出现在链上，而最早的比特币输出直接发布了公钥。欧洲刑警组织的报告引用Glassnode的数据，指出约有604万枚比特币（约占供应量的30%）的公钥已暴露；另有估算接近690万枚，包括可能属于中本聪或丢失密钥持有者的早期硬币。“已暴露”并不等同于“可立即被盗”。

谷歌将攻击所需的物理量子比特降至50万个以下

与Google Quantum AI相关的研究人员于3月31日发布了新的资源估算，PRX Quantum于8月发表了经过同行评审的论文。一项提议的攻击电路不需要超过1,200个逻辑量子比特（即用于计算的经纠错单元）。在一个建模架构中，这相当于少于500,000个物理量子比特。

The paper also estimates that some superconducting designs may eventually complete the attack in 10 minutes. At this speed, transactions awaiting confirmation will become theoretical targets because their public keys will be visible before the block is mined. These numbers describe future machines and do not represent any attacks that have been carried out.

Comparison of industry progress

IBM and the University of Chicago: 70 logical qubits

IBM and the University of Chicago announced on July 30 that they had completed a computing task that took about 15 minutes on 70 logical qubits. IBM said the task is beyond the actual capabilities of leading classic simulation methods. Compared with Google's estimated 1,200 logical qubits required for the attack, there is a gap of about 17 times in the number of logical qubits alone, and the longer computing time required for the attack has not yet been calculated.

IonQ: Solving different bottlenecks

IonQ's results solve different bottleneck problems. Its decoder handles a benchmark circuit that simulates up to 408 logic qubits and more than 31.5 million quantum operations, increasing execution time by only 0.02%. Testing was performed on analog circuits rather than on physical machines of this size.

DARPA Phase C

DARPA Phase C, which IBM reached on October 7, evaluates the feasibility of building industrial-grade fault-tolerant computers. It verifies a plan, not a finished machine.

Recent Milestone Schedule

• March 31:Google Quantum AI reduces resource estimates for attack secp256k1
• July 30:IBM and the University of Chicago completed the calculation of 70 logic qubits in about 15 minutes
• September 22:IonQ tests real-time error correction decoder on a circuit that simulates up to 408 logic qubits
• October 7:IBM enters Phase C of DARPA's Quantum Benchmarking Initiative
• October 7: Europol released two reports pointing out that cryptocurrency wallets are the main vulnerability.

Ethereum researcher Justin Drake proposed a "worst-case" hypothesis.

Ethereum Foundation researcher Justin Drake pointed out on October 7 that The same signature scheme (ECDSA) may even collapse without any quantum hardware. His concern is that AI systems currently solving long-term mathematical problems may find a classic way to recover private keys on conventional hardware, such as large GPU clusters. In his worst-case scenario, this could happen within months.

Threat Comparison

Threat Type Required conditions Current Status Quantum attack Fault-tolerant quantum computer running Shor algorithm Resource estimates exist, no machines available AI-assisted classic attack A new mathematical method to recover keys on traditional hardware Hypothetical exists, no verified algorithm

Drake does not provide such a method, nor does it disclose an algorithm for verification. His practical advice is similar to quantum coping strategies: gradually move large amounts of assets to addresses where transactions have never been signed, avoid reusing exposed keys, and stay calm. For Ethereum, he hopes to introduce hash-based signature schemes such as SPHINCS in advance.

Today, I call on the blockchain industry to calmly start planning a "fortress model." My personal recommendation is to drive a controlled mass migration of assets to new addresses, namely those where the public key is still hidden behind the hash. Holders, especially large holders...

BIP-361 forces Bitcoin to decide where to go for unmoved coins

Bitcoin developers currently have two proposals on the table. BIP-360 introduces output types designed to reduce quantum exposure, while BIP-361 establishes phased migration and limits on fragile outputs. Ethereum researchers are working on post-quantum cryptography, with a reported target year of 2029.

Funding and institutional attention followed. Galaxy Digital committed up to $5 million in grants in July for quantum readiness research, and Coinbase established a Cryptography Advisory Committee to review quantum risks faced by blockchain.

For holders, immediate consequences are limited to address hygiene management: funds in addresses that have never been signed remain hashed. For Bitcoin, the more difficult decisions lie within BIP-361, because limiting fragile exports means that decisions must be made about where coins that have never been moved (including dormant early holdings) will go. This is a governance issue, and Bitcoin has no mechanism to quickly resolve such issues.