Pierre-Luc Dallaire-Demers and colleagues at BTQ Technologies present the first end-to-end cost analysis of fault-tolerant hardware needed to use Grover’s algorithm for Bitcoin mining. The open-source estimator considers the entire attack surface, from reversible oracles to fleet logistics and energy consumption, revealing a key transition point where the required resources escalate sharply. The study shows that while a quantum advantage exists in theory, practical quantum mining rapidly becomes unsustainable, demanding astronomical qubit counts and energy levels, potentially reaching Kardashev Type II civilisation scales, to achieve even minimal consensus effects.
Bitcoin mining necessitates stellar-scale quantum computing resources
A quantum computer capable of mining Bitcoin at January 2025 difficulty levels would demand approximately (10^{23}) qubits and consume around (10^{25}) watts of power. This energy consumption places it on the Kardashev scale, alongside civilizations harnessing the energy output of stars. Such a requirement represents a dramatic increase compared to the most favourable partial-preimage setting. A superconducting surface-code fleet still requires about (10^8) physical qubits and around (10^4) MW at this level. At this higher difficulty level, practical quantum mining becomes unsustainable due to the astronomical resource demands, far exceeding current or foreseeable technology.
Current leading superconducting surface-code fleets, even at a more favourable partial-preimage setting, necessitate around (10^8) physical qubits and approximately (10^4) megawatts of power, a load comparable to a large national grid. The analysis details that tightening the difficulty to match the Bitcoin mainnet in January 2025 causes an exponential increase in resource demands, exceeding any present or foreseeable technological capabilities. Estimates account for reversible oracles, fault-tolerant non-Clifford operations, and the logistical demands of operating such a vast quantum fleet; even optimistic projections of power efficiency per qubit do not alter the conclusion.
Quantifying resource expenditure for practical quantum attacks on Bitcoin mining
To move beyond theoretical vulnerabilities, an open-source estimator was developed to carefully map the entire quantum attack surface for Bitcoin mining. This estimator does not simply calculate speedups, but thoroughly costs every component, starting with “reversible oracles”, quantum versions of the cryptographic hash functions used in Bitcoin, and extending to the logistical demands of operating a vast “fleet” of quantum computers. Fault-tolerant hardware, central to this costing, creates multiple copies of data to correct errors and dictates the number of physical qubits needed for reliable calculations. The estimator accounts for building and maintaining these error-correcting components, revealing that a superconducting surface-code fleet requires approximately (10^8) physical qubits and (10^4) MW of power at a favourable setting. Increasing Bitcoin’s mining difficulty to January 2025 levels escalates this to (10^{23}) qubits and (10^{25})W.
Superconducting surface-code costs define a quantum mining hardware benchmark
Establishing the sheer scale of quantum mining hardware offers a key benchmark for assessing the long-term viability of Bitcoin. The analysis deliberately focuses on the superconducting surface-code, a prominent quantum architecture, providing a concrete basis for costing. This choice introduces a tension, as alternative quantum computing approaches, such as trapped ions or photonic systems, may present drastically different cost-benefit ratios. The paper acknowledges these alternatives, leaving open the possibility that a different technological pathway could circumvent some of the identified limitations.
It is vital to acknowledge this reliance on a specific quantum architecture, as other approaches to building quantum computers may prove more efficient or less resource-intensive for mining purposes. This analysis establishes definitive physical constraints on utilising quantum computers to mine Bitcoin, moving beyond purely theoretical assessments of speed increases. A fleet capable of impacting Bitcoin’s consensus requires resources comparable to those of an advanced civilisation, with gate fidelity increasing five-fold as qubit and power demands escalate. By carefully costing every component, from quantum hash functions to the logistical challenges of operating a large-scale quantum computer fleet, the open-source estimator provides a new benchmark for evaluating quantum threats.
The research determined that quantum mining of Bitcoin, even with optimistic assumptions about superconducting surface-code technology, demands an impractical scale of resources. Specifically, impacting Bitcoin’s mining consensus at January 2025 difficulty levels would require approximately 10 23 qubits and 10 25 Watts of power, comparable to the energy consumption of a large nation. This suggests that, given current projections for quantum hardware, a practical quantum attack on Bitcoin mining is unlikely due to the sheer physical cost of building and maintaining such a system. Future work could explore alternative quantum computing architectures or investigate methods to reduce the resource demands of quantum hash functions.
🗞 Kardashev scale Quantum Computing for Bitcoin Mining
🧠 ArXiv: https://arxiv.org/abs/2603.25519
The necessity of fault tolerance fundamentally dictates the massive scaling of qubit requirements. Physical qubits do not directly implement logical quantum operations; instead, they are grouped into complex structures, such as surface codes, to encode a single protected logical qubit. These codes perform continuous parity checks, detecting and correcting errors caused by decoherence or environmental noise. The overhead involved in these Quantum Error Correction (QEC) schemes means that maintaining computational reliability requires hundreds, if not thousands, of physical qubits for every single functional logical qubit used in the algorithm.
Furthermore, the performance of any quantum computation is limited by gate fidelity—the accuracy with which quantum gates are applied. Achieving the high gate fidelity required for running Grover’s algorithm on cryptographically large inputs is a monumental engineering hurdle. Current leading architectures struggle with maintaining coherence times long enough to execute the millions of sequential gates needed for a full mining attempt. This necessitates not only high qubit counts but also sophisticated cryogenic control electronics and precise microwave pulse sequencing far beyond current industrial capabilities.
From a cryptographic perspective, the target functions like SHA-256 are not merely simple hashes; they involve complex non-linear mixing layers. While Grover’s algorithm offers a quadratic speedup, the constant factors and the underlying structure of these functions impose significant circuit depth. The resource estimates therefore must model the repeated execution of these complex, multi-gate circuits, a depth that rapidly escalates the demand for computational time and associated energy.
