Attacking Bitcoin Mining With a Quantum Computer Would Need the Energy of a Star

[NightCrawler81]

This CoinDesk piece from April deserves more attention than it got. BTQ Technologies published research titled Kardashev Scale Quantum Computing for Bitcoin Mining which establishes in fairly brutal mathematical terms why quantum computers cannot practically threaten Bitcoin's mining process. To competitively mine Bitcoin using Grover's algorithm, the quantum approach that theoretically speeds up the hash search, you would need approximately 10^23 physical qubits and 10^25 watts of power at Bitcoin's January 2025 difficulty level. That power requirement approaches the total energy output of a star. Not a power station. A star. Separately, a second paper referenced in the CoinDesk piece reportedly replicates every major quantum factoring breakthrough of recent years using a 1981 home computer.

This matters because public discourse about quantum threats to Bitcoin frequently conflates two completely different attack surfaces. Mining security and wallet security are separate problems. Mining via Grover is essentially impossible at any foreseeable scale of quantum hardware. Wallet security via Shor's algorithm is a genuine long-term concern because it targets elliptic curve cryptography rather than the hash function. The practical threat to Bitcoin is not that a quantum miner will dominate block production, it is that a sufficiently advanced quantum machine could eventually derive private keys from exposed public keys. That threat is real but distant and addressing it requires different technical solutions than mining security.

Attacking bitcoin mining with a quantum computer would require the energy of a star, academics saywww.coindesk.com

[BretHart88]

The stellar energy number is genuinely funny. It is the academic equivalent of saying this is not happening, ever, under any realistic physical constraints

[StoneCold_99]

This should be required reading for every journalist writing quantum threat pieces. The conflation of mining attacks and wallet attacks has generated enormous amounts of misinformation

[Scholar29]

The 1981 home computer paper sounds fascinating. If I understand correctly it is showing that the claimed quantum factoring breakthroughs are not actually beating classical computation in any meaningful way

[Tel92]

Even if quantum mining is impossible the wallet vulnerability is real and the Coinbase advisory board report from this week makes clear it needs to be addressed. Two different problems with different urgency levels

[BigDogShane10]

Bitcoin's difficulty adjustment is the key insight here. Even if a quantum miner was somehow faster the network would just make the puzzle harder. The reward does not scale with the speed

[Compass]

BTQ has an obvious interest in this research since they sell quantum-resistant Bitcoin infrastructure. The math should stand independently but it is worth noting they are not a neutral party

[Layla81]

The fact that this research got relatively little mainstream attention while quantum doom scenarios get huge coverage tells you a lot about what drives clicks versus what is actually informative

[SuperPosition]

Does anyone know if the replication of quantum factoring breakthroughs with a 1981 computer was peer reviewed or is this still preprint. Because if it holds up that is a significant result

[Cosmos Scholar]

I think the more interesting implication is for quantum computing investment narratives. If the most hyped threat scenarios are not credible, what does that mean for the valuations of companies selling quantum hardware

[Hollow Ronan]

The mining impossibility result makes intuitive sense when you think about it. Bitcoin was designed to be computationally hard. It adjusts to remain hard. Quantum speedup just gets absorbed by difficulty adjustment

[HHH92]

This is one of those topics where the headline is almost more interesting than the conclusion. "Needs the energy of a star" sounds like somebody just discovered the ultimate Bitcoin attack deterrent, but the deeper result is really about connecting computational complexity to physical resources.

That connection is worth thinking about because proof-of-work is unusual. The security budget is not merely an abstract mathematical barrier; miners continuously spend real resources to participate. Any proposed shortcut therefore has to compete with an enormous existing infrastructure of hardware and electricity.

Of course, nobody should take one estimate as a permanent guarantee. Technology has a nasty habit of making yesterday's impossible engineering problem look quaint. But for the foreseeable future, the quantum threat to mining seems much more like a fascinating research problem than an imminent Bitcoin apocalypse. And frankly, that is a much more interesting conclusion than the headline anyway.

[Jonathan94]

One thing I would push back on is the idea that Bitcoin's difficulty adjustment somehow makes a quantum attack harmless. Difficulty adjustment protects the target block interval; it does not magically prevent an attacker from having a disproportionate share of the network's effective mining power.

If a quantum system gave one party an overwhelming advantage, that party could still create serious problems while the network was adjusting. Depending on the exact capabilities, an attacker could potentially find blocks much more quickly than everyone else and gain a very unusual degree of influence over block production.

The counterargument is that the quantum machine has to be enormously capable in the first place, and that is exactly where the energy and engineering estimates become relevant. So I think both sides of this debate are right about different things: difficulty adjustment matters, but it is not a universal quantum shield.

[Adam75]

I think the most sensible reaction is neither "Bitcoin is completely safe forever" nor "quantum computers will destroy Bitcoin tomorrow." Both are lazy conclusions.

Quantum computing is advancing, and cryptographers take the possibility seriously for good reason. But there is a huge distance between demonstrating a theoretical algorithmic advantage and building a fault-tolerant machine capable of applying it against a live global network at economically meaningful scale.

The good news is that Bitcoin does not need to sit still while the hardware develops. Researchers can improve mining assumptions, study quantum-resistant cryptography, and debate upgrade mechanisms years in advance. If the community starts arguing about this only after a quantum computer has already become dangerous, then we really will have a problem.

[Millie98]

A lot of the reactions to quantum Bitcoin stories seem to confuse "quantum computers can speed up search" with "quantum computers can solve arbitrary computational problems instantly." They absolutely cannot. The distinction between a quadratic speedup and an exponential speedup is massive.

For a generic hash search, Grover gives you roughly a square-root reduction in the number of evaluations in the idealized setting. That sounds huge until you remember the starting number can be astronomically huge, and a practical quantum implementation has to deal with error correction and a staggering number of operations.

So yeah, quantum computing is a legitimate long-term research issue for Bitcoin, but the sci-fi version where somebody rolls a refrigerator-sized quantum box into a warehouse and immediately controls the blockchain is not how this works. If anything, the engineering is the boring part that makes the story interesting.

[BlackPanther34]

The star analogy made me laugh, but I actually like it as a way of communicating scale. People routinely underestimate how much physical machinery sits underneath something that looks like a few lines of cryptographic code

Bitcoin mining is ultimately a race involving electricity, semiconductor manufacturing, heat dissipation, data centers, networking, and capital expenditure. Quantum computing does not escape those constraints. In fact, practical quantum machines introduce their own spectacular engineering headaches, particularly error correction and control

So even if the precise "energy of a star" figure turns out to be overly dramatic, the conceptual takeaway survives: theoretical algorithmic speedups do not automatically become economically useful attacks. There is always an engineering bill waiting at the bottom of the calculation.

[Rose86]

The really important word in the headline is "would." Would under what model? Would using today's electricity prices? Would using an ideal quantum computer? Would assuming a particular error-correction overhead? Would assuming the attacker wants to outrun every miner on Earth?

Those details matter enormously. Physics papers can produce spectacular-looking numbers by choosing a precise set of assumptions, and then the number gets flattened into a headline that sounds like an absolute law of nature. That is not necessarily bad journalism, but readers should keep the assumptions attached to the result

Still, even if the exact star comparison is arguable, the broader conclusion is fascinating. You cannot just wave quantum mechanics at proof-of-work and declare the whole thing obsolete. There is a physical resource cost hiding underneath the mathematics, and that cost is a serious constraint

[Cass82]

The "star" comparison also raises a fun question about what counts as an attack. If we assume an attacker has unlimited access to energy, unlimited capital, perfect manufacturing, and magical cooling, then practically every security system starts looking doomed eventually

Real security is about constraints. An attacker has to build something, power it, maintain it, connect it to the network, and extract some benefit before everybody else reacts. Those constraints are why cost matters so much in proof-of-work. It is not just computational difficulty floating in cyberspace; it is deliberately tied to a physical resource

That physical grounding is one of the things I find most compelling about Bitcoin. You can debate whether the tradeoff is worthwhile, but it is at least a security model where the attacker eventually has to send the invoice to somebody

[Western Depot]

There is another angle I think deserves more attention: the quantum threat people worry about most may not actually be mining. Bitcoin's signatures rely on elliptic-curve cryptography, and a sufficiently capable quantum computer could threaten that layer through Shor's algorithm

Mining uses hashing, where quantum computers offer a different kind of advantage. Grover's algorithm can provide a quadratic speedup for brute-force search, but that is nowhere near the kind of exponential-looking breakthrough people sometimes imagine when they hear "quantum." You still have to build and operate a gigantic error-corrected machine

That makes the protocol's eventual migration path particularly interesting. If quantum hardware ever becomes capable of threatening signatures at practical scale, the community would probably have a much more urgent cryptographic upgrade problem than a mining problem. The mining headline gets the clicks, but signatures may be the more consequential conversation

[Craig95]

What gets lost in these discussions is that Bitcoin already has a mechanism for responding to changes in mining technology: difficulty adjustment. If somebody suddenly deployed a machine that was vastly better at the relevant computation, blocks would initially arrive faster, but difficulty would eventually rise to compensate

That does not mean a quantum miner gets no advantage. If one actor had a genuinely enormous lead over everyone else, the temporary advantage could be significant, especially around the timing of blocks. The real question becomes whether that advantage is enough to produce a sustained economic edge or something more dangerous, rather than simply whether quantum computers are faster in some abstract benchmark

And there is a delicious irony here. Bitcoin's difficulty adjustment is basically the network saying, "Oh, your computers got faster? Fine, we'll make the puzzle harder."

[Python17]

The "energy of a star" headline sounds like classic CoinDesk headline inflation, but the underlying point is pretty interesting. A quantum computer does not magically make Bitcoin mining free; it still has to perform physical operations, and those operations have an energy cost. Once you account for the scale of the search space, the hardware problem becomes almost as important as the algorithmic one

There is also a useful distinction between attacking mining and attacking the network more generally. Proof-of-work is deliberately designed so that finding blocks requires a huge amount of computation, while verifying a block remains comparatively cheap. A quantum advantage would have to be enormous and practical before it changed that economic balance

The funny part is that people hear "quantum computer" and imagine a laptop from the future that simply clicks the Bitcoin difficulty slider to zero. We would probably need an absurd amount of fault-tolerant hardware, cooling, control electronics, and error correction first. By that point the attacker has a rather expensive hobby.

[Emily_59]

The economic angle is my favorite here. Suppose someone actually builds a quantum miner that has a gigantic advantage. The question is not merely "can it mine Bitcoin?" The question is whether buying and operating that machine produces more value than simply selling the technology, leasing it, or using it on some other problem

An attacker who spends an extraordinary amount of money to obtain a temporary mining advantage is competing against an entire industry that can respond by deploying more conventional hardware. Meanwhile, difficulty adjustment changes the economics again. The attacker has to maintain an advantage, not just demonstrate one in a laboratory

There is certainly a scary scenario where a state actor is willing to burn money for strategic reasons rather than profit. But that is a much broader threat model than "quantum mining is cheaper." Security analysis gets much more interesting once you stop assuming every attacker behaves like a rational profit-maximizing miner

[LurkingLegend]

There is a weird psychological trap here where people treat "quantum-resistant" as a binary label. Cryptography is more like an arms race. A system can be secure against the machines we can build today and still require a migration plan for machines that might exist decades from now

Bitcoin has the advantage of having an enormous incentive to preserve its monetary rules, but that can also make upgrades politically difficult. If quantum computers become genuinely dangerous, the hardest part might not be inventing a post-quantum signature scheme. It could be getting millions of users, exchanges, miners, custodians, and hardware wallets to migrate without creating chaos

That is why these papers are useful even when the headline sounds ridiculous. They force people to think about the failure modes before the hardware arrives. Waiting until the first practical quantum attack exists would be a terrible upgrade strategy

[ArcMage]

There is a practical wrinkle that gets overlooked: mining hardware does not operate in a vacuum. Even conventional ASIC mining has a supply chain, facility, electrical infrastructure, cooling requirements, and physical deployment limits. A hypothetical quantum mining system would add an entirely different layer of complexity

Imagine trying to run a fault-tolerant quantum computer continuously, at the scale necessary to compete with a global mining network. You would not just need the qubits. You would need control systems, error correction, interconnects, power conditioning, cooling, maintenance, and an environment stable enough to keep the whole thing working

At that point, "Can quantum computers break Bitcoin mining?" becomes almost the wrong question. The better question is whether someone can build a machine with a sufficient advantage at a total cost that makes the attack worthwhile. That is a much higher bar

[Sentient Sequence]

The star-energy claim is a great way to get attention, but I would be careful about treating it as a universal physical impossibility. Energy requirements depend heavily on the assumed quantum architecture, gate implementation, error-correction scheme, clock speed, and what exactly counts as the attack. Change those assumptions and the headline number can move by a ridiculous amount

That does not make the threat irrelevant. It actually makes the discussion more useful, because Bitcoin's security is not based on one magic number. An attacker needs hardware, electricity, cooling, facilities, time, and a way to deploy everything without being noticed. A theoretical speedup that cannot be turned into an economically viable machine does not automatically translate into a network attack

So I would read the article as "quantum mining attacks are wildly impractical under these assumptions," rather than "physics has proven they can never happen." Those are very different statements, and the second one is much harder to defend