Quantum computers will eventually break much of today’s encryption, and that includes the signing algorithm of Bitcoin and other cryptocurrencies. Approximately one-quarter of the Bitcoin ($168bn) in circulation in 2022 is vulnerable to quantum attack, according to a study by Deloitte.
Cybersecurity specialist Itan Barmes led the vulnerability study of the Bitcoin blockchain. He found the level of exposure that a large enough quantum computer would have on the Bitcoin blockchain presents a systemic risk. “If [4 million] coins are eventually stolen in this way, then trust in the system will be lost and the value of Bitcoin will probably go to zero,” he says.
Today’s cryptocurrency market is valued at approximately $3trn and Bitcoin reached an all-time high of more than $65,000 per coin in 2021, making crypto the best-performing asset class of the past ten years, according to Gemini’s Global State of Crypto report for 2022. However, Bitcoin’s bumpy journey into mainstream investor portfolios coincides with major advances in quantum computing.
Bitcoin cybersecurity weakness lies in public keys
Most encryption relies on the relationship between public and private keys, which is called asymmetric cryptography. Quantum-vulnerable Bitcoins include those created before 2010 when public keys had not been hashed into a different and safer format. Also at risk are Bitcoin addresses that have been already used once and have therefore become visible on the blockchain. There are four million Bitcoin addresses that could in theory be hacked by a quantum computer large enough to derive the corresponding private key to unlock and transfer the value to another address. This is known as a storage attack.
The second kind of attack – a transit attack – attacks Bitcoin transactions in transit. In contrast to the storage attacks, where only a subset of addresses is vulnerable, all transactions are vulnerable.
In January 2022, a team at Sussex University spin-out company Universal Quantum published research on transit attacks, which calculated that it would require a quantum computer with a 1.9 billion qubit-capacity to break Bitcoin’s encryption in the required ten-minute window (this is the time taken for a Bitcoin to be mined). Even at 317 million qubits it would take an hour and 13 million qubits for a day. For context, IBM’s superconducting quantum computer currently has a 127-qubit processor.
Consensus in the decentralised realm of Bitcoin is hard
Cybersecurity is top of mind for those within the quantum community, but many industry insiders, including Barmes, believe there is not enough communication between the quantum computing community and the Bitcoin community to ensure future cybersecurity on the Bitcoin blockchain. “There are a lot of statements made from either community which indicates a lack of understanding of the other side,” he says.
Barmes believes that as long as cryptocurrencies migrate on time (to post-quantum cryptography) then everything should be fine. “It is not too late to migrate, but such a migration takes time, so waiting until the last moment might turn out to be too late,” he says. “The exact moment when it becomes too late is, of course, unknown.”
The blockchain presents a unique challenge for quantum-safe cryptography because of its decentralised nature and the complications in governance structures that this poses. “Achieving this consensus is extremely difficult, so the governance issues are possibly equal to the complexities of the technical problems – agreement takes much more time than people think,” says Barmes. While not enough is being done on technical solutions, too little attention is also given to governance issues, he adds.
Barmes is advocating awareness of the issues as the first stage in addressing the problem. “Then, very technical people need to come up with published and demonstratable solutions, not just speculation,” he adds.
For investors without a technical background, quantum security is a difficult topic to evaluate. Cryptocurrency projects should be more transparent about their plans to mitigate quantum risk, says Barmes. “That will give investors the information they need in order to make decisions.” The hope is that this transparency could encourage a more robust mitigation strategy.
Savvy investors have already priced in risk
While more mainstream investors may not be aware of the potential security issues arising from quantum computing advances on Bitcoin, Miko Matsumura, general partner at San Francisco-based Cryptos Capital, says most knowledgeable investors have priced in the risk of quantum cybersecurity breaches. He is not concerned about quantum computing risk because attackers have two ways to breach Bitcoin, neither one of which presents a catastrophe for the blockchain.
“You could attack Bitcoin’s signing mechanism, which would create havoc during an attack, but the attack would be very visible,” adds Matsumura. “If such attacks were to take place, Satoshi [Bitcoin’s architect] had a plan, which was simply to hard fork Bitcoin (a complete protocol change leading to divergence from the original) and replace the signing mechanism.”
On the point of consensus, Matsumura is much more buoyant than Barmes. “Satoshi already wrote about what to do in case the signing algorithm was penetrated, so it is likely that the community would just agree to do what Satoshi proposed,” he says.
On this more positive note, Duncan Jones, head of cybersecurity at Cambridge Quantum, says the conversation about risk needs to be more focused on how quantum technologies can enhance digital asset security. “The focus is often on the threat from quantum computers, and yet blockchains face complex and sophisticated threats every day,” he says. “We can strengthen blockchains against some of these risks if we integrate quantum technology into the core of these systems.”
This is a view reiterated by Charles Hayter, CEO and co-founder of CryptoCompare, who believes quantum computing cyber risk is not on the radar of the cryptocurrency investment community. “The optimistic view is that quantum-safe cryptocurrency will solve the problems that arise and that is the reason that the community is not worried,” he says. “It is considered by many in the industry as like having to replace the engine on your car – there is a solution.”
Cryptography has always been a race against hackers and there have always been solutions along the way, says Hayter. As for quantum cybersecurity mitigation strategies on cryptocurrency exchanges, he believes it is far too early for quantum computing to be an issue.
Transitioning to post-quantum algorithms and conversations between the Bitcoin community and the quantum computing community will be key to mitigating the cybersecurity risk to cryptocurrency investment. As always, timelines around quantum computing appear to be vague, but nevertheless the time has come for Bitcoin investors to take note.
