Google Willow Cuts Quantum Errors 40-Fold as Bitcoin Prepares

Google Willow’s 40-fold result measures state quality

Magic states are consumed when a quantum computer performs certain operations. Preparing sufficiently reliable supplies is one obstacle to running useful computations with errors kept under control. Cultivation checks a prepared state and discards attempts when errors are detected.

The authors’ experimental preprint reports that the high-fidelity result retained 8% of attempts. That qualification separates the quality of accepted states from the proportion of attempts that successfully supply one.

A lower error rate can improve a component without establishing the cost, speed or reliability of a complete computer. The 40-fold figure cannot simply be applied to the number of machines, qubits or dollars needed to attack a Bitcoin key.

There is also an important timing distinction. The arXiv submission history dates the experimental manuscript to December 15, 2025. Google’s October announcement says the work is now published in Science. The current news is the publication and renewed attention, rather than the first public appearance of every underlying result.

That history limits claims that the announcement suddenly invalidates all previous security planning. The paper’s introduction says cultivation had already influenced resource estimates. A hardware demonstration helps test assumptions; calculating a revised attack budget requires a separate analysis.

The same paper discusses much lower state-error targets for some demanding applications. Its RSA-2048 example is a different cryptographic problem from Bitcoin’s elliptic-curve signatures, so that target should not be presented as a Bitcoin attack specification.

Bitcoin quantum risk turns on signatures and exposure

Google’s March cryptocurrency research modeled future machines attacking 256-bit elliptic-curve cryptography with fewer resources than earlier estimates. It described logical qubits, error-corrected information units built from physical hardware, and the operations required to perform the calculation.

Those modeled requirements and Willow’s state-quality measurement answer different questions. Combining them into a single readiness score would conceal assumptions about scale, error correction and the full computation. The new result alone supplies no date when a Bitcoin attack becomes practical.

Bitcoin’s BIP-360 draft distinguishes attacks against keys exposed for long periods from attacks that would have to finish while a transaction awaits confirmation. An exposed public key gives a future attacker more time to attempt key recovery.

The proposal would introduce Pay-to-Merkle-Root outputs, removing a direct key-spending route found in Taproot. Its authors say protection against short-exposure attacks may require post-quantum signatures, which are a further step beyond this output design.

That distinction is relevant to holders evaluating claims that one proposal solves the entire problem. Reducing key exposure and replacing a vulnerable signature system address related but different risks. BIP-360 is still a draft, rather than an activated migration instruction.

Custodians face operational questions as well. Coinbase’s October 13 discussion favors early preparation, flexible spending designs and staged migration, while leaving treatment of inaccessible or abandoned funds open. The company describes its paper as input to discussion, rather than a final position.

Its Bitcoin migration priorities also show how hardware progress can affect planning before it enables an attack: wallet software, custody systems and network rules would need coordinated changes. That preparation has a different timetable from a laboratory demonstration.

Bitcoin migration has no Google-set deadline

Google’s 2029 post-quantum migration timeline is a corporate security target announced in March. It does not establish a Bitcoin consensus deadline or certify that a cryptographically capable quantum machine will arrive in that year.

There are already standardized alternatives to vulnerable cryptography. NIST’s post-quantum project identifies finalized standards for key establishment and digital signatures, including ML-DSA and SLH-DSA. They are software-based cryptographic tools designed to resist future quantum attacks.

Availability of standards does not automatically select a Bitcoin implementation. A network still needs to evaluate transaction size, verification costs and how users move existing funds. Coinbase’s discussion specifically calls for Bitcoin-focused measurements rather than importing rankings from other applications.

Broader sentiment eased as that work continued. Alternative.me’s Bitcoin Fear & Greed Index read 55 on October 17, versus 63 the previous day. It is a market-sentiment indicator, rather than a measure of quantum-computer capability.

Source: Alternative.me, checked around 12:03 UTC on October 17.

The next substantive tests are larger cultivation demonstrations, resource estimates that explicitly incorporate measured hardware performance, and concrete Bitcoin migration proposals with implementation evidence. Google’s announcement advances the experimental record, while the scale and timing of a machine capable of attacking Bitcoin signatures remain unresolved.