Google Cut Quantum Errors 40x. Bitcoin's Migration Clock Just Got Louder.

The most important quantum news for crypto this year isn't a machine that breaks encryption. It's a chip that fixes its own mistakes about 40 times better than the last generation did. That's the unglamorous engineering that makes the scary version possible.

Google says Willow can prepare the special quantum states needed for advanced calculations with around 40 times fewer errors. No private key fell. No wallet drained. But the announcement moves a number that bitcoin has spent a decade treating as a rounding error.

Error Rate Is the Whole Ballgame

Here's the part most crypto people skip. Building a quantum computer that can run Shor's algorithm against secp256k1 isn't a qubit-count problem in the way headlines suggest. It's an error problem.

Physical qubits are noisy. They decohere. To run a real calculation you bundle thousands of them into one logical qubit that behaves well enough to be useful. The cleaner your physical qubits, the fewer you need per logical one. Cut the error rate 40x and the overhead curve bends hard in your favor.

Willow has 105 qubits. That's tiny. But it demonstrated below-threshold error correction, meaning adding more qubits made the system better instead of worse. That's the first time the curve pointed the right way.

Now stack that against the attack requirement. Estimates for breaking a single bitcoin key have ranged from roughly 1,500 logical qubits on the optimistic end to a 2023 paper that put it near 317 million physical qubits for a one-hour crack. Those numbers sound unbridgeable. They also sounded unbridgeable when the field had 5 qubits.

And the exposure isn't theoretical. Roughly 1.7 million BTC sit in pay-to-public-key outputs where the public key is already visible on chain. Add reused addresses. Add Taproot spends, where the key shows up in the output. Satoshi's coins sit in exactly that category.

Public key to private key is a one-way street today. It's a two-way street with the right hardware.

The Case for Doing Nothing

Steelman the other side, because it's not stupid.

Quantum hardware is still a cryostat the size of a closet, running at millikelvin temperatures, with gate fidelities that would embarrass a 2015 GPU. A 40x error improvement on state preparation is one metric, not a scaling law you can extrapolate to 2030. The gap between 105 physical qubits and millions remains five orders of magnitude, and nobody has a manufacturing roadmap that closes it on a schedule.

Then there's the migration cost. Post-quantum signatures are enormous. An ML-DSA-44 signature runs about 2,420 bytes against ECDSA's roughly 71. Public keys balloon from 33 bytes to over 1,300. Bolt that onto bitcoin's block limits and you either shrink transaction throughput by an order of magnitude or you fight a blocksize war all over again.

So the conservative argument goes: bitcoin's ossification is a feature, the threat is a decade out at minimum, and panicking now produces bad consensus changes that are worse than the risk. That's a real position.

It's also the position of people who don't have to explain the transition plan to anyone.

My Verdict: The Clock Is Real

I'll take the other side. Google's own stated goal is migrating its internal systems to post-quantum crypto by 2029. NIST finalized its first PQC standards in August 2024. The company most likely to build the hardware is treating the timeline as urgent enough to restructure its own infrastructure. Crypto treating it as a 2040 problem is wishful thinking dressed as patience.

Here's the hot take. The dangerous coins aren't the ones in cold storage with fresh addresses. They're the 1.7 million BTC in legacy outputs, and no consensus rule can save them. You can't fork a chain and seize private keys you don't have. You can't freeze those coins without breaking the property rights that make the asset worth anything. The only fix is voluntary migration, and there's no economic incentive to migrate until it's too late.

So who's liable when the coins that never moved get drained? Ask a custodian. Ask an exchange holding client BTC in reused addresses. Ask the family office that bought in 2013 and never touched it.

Second take, and this one will annoy people. Most "quantum-resistant" L1 marketing is noise. Swapping a hash function doesn't make you safe. What matters is signature agility, meaning the ability to rotate schemes without a hard fork that strands users, plus wallet tooling that makes migration a two-click operation instead of a research project.

Almost nobody has that. The projects shouting loudest have the least of it.

The good news is we're early. The bad news is that early is a description of the hardware, not a plan. Error correction compounding at 40x a generation won't break bitcoin next year. It will break the assumption that nobody has to do anything.

If agents have wallets, who holds the keys? Same question for humans. Right now the answer is a keypair that a sufficiently large quantum computer can solve. That's a plumbing problem, and crypto's plumbing has never been great at deadlines it didn't set itself.