A new Google quantum report has highlighted new quantum vulnerabilities for Bitcoin, Ethereum, and other networks. The report also highlighted efforts by the XRP Ledger (XRPL), which could help guard against these quantum threats.
Google Quantum Report Acknowledges XRP Ledger’s Efforts
In its latest quantum crypto whitepaper, Google noted that the XRP Ledger and other networks, such as Solana, have made early experimental deployments of post-quantum protocols in a bid to achieve post-quantum security for crypto assets.
The Google quantum report further highlighted how the XRPL recently deployed post-quantum ML-DSA signatures on the testnet as part of the efforts to tackle these vulnerabilities. This comes just as Ripple revealed efforts to boost the XRPL’s security, including integrating AI across the development cycle.
The report noted that blockchain networks such as Ethereum, Solana, TRON, and the XRP Ledger make long-term exposure of quantum-vulnerable public keys inevitable. However, Google suggested that TRON and XRPL can better handle this vulnerability as they support native, protocol-level key rotation. Modern Ethereum and Solana accounts support key rotation, but legacy accounts remain at risk.
Bitcoin At Risk Of An On-Spend Attack
The Google quantum report noted that the Bitcoin network is now at greater risk of an on-spend attack due to advances in quantum technology. In a blog post, Google Research stated that it estimates two quantum circuits implementing Shor’s algorithm for ECDLP-256 (256-bit elliptic curve discrete logarithm problem) can be executed on “a superconducting qubit CRQC with fewer than 500,000 physical qubits in a few minutes.”
They noted that this is around a 20x reduction in the number of physical qubits that a quantum computer requires to solve ECDLP-25. The ECDLP-256 is what top-layer 1 networks such as Bitcoin rely on for critical aspects of their security.
In Bitcoin’s case, it is at risk of an on-spend attack, as the average block time is 10 minutes. Meanwhile, the Google quantum report estimates that it could take 9 minutes for a superconducting qubit CRQC (cryptographically relevant quantum computer) to derive private keys from public keys in the mempool and then forge a transaction, thereby stealing the BTC.
Google currently estimates a 41% success rate under the most idealized assumptions. This would involve the attacker artificially creating network congestion by possibly offering higher fees to miners, giving them enough time to obtain the private keys and have their forged transactions frontrun the original spender.
Ethereum Faces A Different Kind Of Quantum Threat
The Google quantum report noted that Ethereum’s quantum security posture is very different from Bitcoin’s, as the former has an average block time of 12 seconds, and most transactions are processed in less than a minute. As such, it is unlikely for the network to face an on-spend attack.
However, the report noted that the main quantum threat against Ethereum lies in various at-rest attacks. It is worth noting that Ethereum’s co-founder, Vitalik Buterin, had previously mapped quantum risks to the network, highlighting four areas of vulnerabilities, including consensus-layer BLS signatures.
Google stated that Ethereum has three prominent features that differentiate it from Bitcoin, and that these also give it five types of quantum vulnerabilities. These features include the account model, smart contracts, and validators, which create vulnerabilities in account, admin, code, consensus, and data availability.
Google recently shifted the quantum threat timeline to 2029, aiming to transition to post-quantum cryptography (PQC) by then. The research report noted that migrating these networks to PQC involves many complexities, but that networks such as the XRP Ledger have shown that it is possible.