Google Willow Cuts Quantum Error Rate 40x, Tightening Bitcoin's Post-Quantum Clock

Google's new magic-state-cultivation result is not a Bitcoin-breaking event, but it chips away at the one resource estimate that made "millions of qubits needed" feel comfortably distant.

Key takeaways

• Google's Willow processor achieved a ~40-fold reduction in errors when preparing "magic states," the key computational resource for fault-tolerant quantum computing, in a paper published in Science on October 15, 2026.
• The result is not an immediate threat: the error rate achieved (roughly 1 in 10,000) is still about a million times too noisy to crack Bitcoin's elliptic curve keys, and only ~8% of preparation attempts passed inspection.
• Roughly 6.7-6.9 million BTC behind exposed public keys, including ~1.1 million BTC in Satoshi-era P2PK outputs with public keys permanently on-chain, are one hardware generation closer to being in a quantum attacker's reach.

Google Quantum AI published a paper in Science on October 15, 2026 demonstrating that its 105-qubit Willow processor can prepare "magic states," a specialized quantum resource required for advanced error-corrected computation, with roughly 40 times fewer errors than uncultivated states. That single result attacks the most expensive line item in every blueprint for a machine capable of cracking Bitcoin's cryptography.

The experiment used at most 54 of Willow's 105 qubits and achieved a T-state logical fidelity of 99.99% among the ~8% of preparation attempts that passed all quality checks. Google researchers Emma Rosenfeld and Craig Gidney co-authored the accompanying Google Quantum AI blog post. Rosenfeld had previously described the scope of the problem, noting that magic state generation can consume up to 95% of a quantum computer's total capacity.

The Bottleneck That Just Got Smaller

Magic state generation has historically consumed 90-95% of a fault-tolerant quantum computer's total qubit budget under traditional distillation methods. The cultivation technique demonstrated here targets that overhead directly. It does not make a Bitcoin attack 40 times cheaper today, but it chips away at the resource estimate that made the "millions of qubits needed" framing feel so comfortable as a buffer.

The gap to cryptographic relevance is still enormous. Cracking RSA-2048, or Bitcoin's ECDSA keys, would require magic-state error rates of roughly 1 in 10 billion. Google achieved approximately 1 in 10,000. That is still about a million times too noisy. Google's own projections note that halving Willow's hardware noise would reduce magic-state errors to roughly 2 in 100,000, because errors shrink with the cube of the chip's noise level. Each hardware generation compounds.

The cultivation theory was proposed in 2024 by Google researchers Craig Gidney, Noah Shutty, and Cody Jones. The October 15 paper is the first physical hardware demonstration of it. That distinction matters: moving from theory to demonstrated hardware is the kind of milestone that tends to compress projected timelines.

Who Actually Has Skin in This Game

Not every Bitcoin address carries equal quantum risk, and the delta is significant.

P2PK outputs, used almost universally in Satoshi-era mining from 2009 onward, expose the public key permanently on-chain from the moment coins are received. No spend is required. Roughly 1.1 million BTC widely attributed to Satoshi Nakamoto sit in exactly these outputs. Those keys are already visible to any future attacker with a sufficiently capable machine. Migration is impossible without moving the coins, and if the private keys are lost, migration is impossible, period.

Beyond P2PK, any address that has ever sent a transaction has its public key permanently on-chain. Europol flagged this exposure profile in an October 7, 2026 warning, estimating roughly 6.9 million BTC at addresses with public keys already exposed and urging phased post-quantum migration across the industry. A range of estimates from Europol, Fireblocks, and Google's own whitepapers puts the total between 6.7 and 6.9 million BTC. Modern bech32 addresses that have never sent a transaction are meaningfully safer, but they still require migration before a cryptographically relevant machine exists.

The Quantum Alliance, a coalition of nine companies that formed earlier this year specifically around the exposed-address problem, put a public number on the exposure: roughly 6 million BTC facing direct quantum attack surface. Coinbase has since backed post-quantum migration efforts at the protocol level.

Bitcoin's protocol response, most notably BIP-360, proposes a new address type that keeps public keys off-chain longer. BIP-360 is a draft proposal and has not been activated on mainnet. Any deployment requires a soft fork and broad consensus. That process is deliberate by design. This result is an argument for treating that deliberateness as a constraint with a real deadline, not a virtue with infinite patience.

What to Watch

Google's stated next step is scaling the cultivation technique to larger qubit counts. If that attempt fails to replicate the 40x error reduction at scale, or if the 8% acceptance rate proves impractical at the volumes required for a real attack, this result stays a significant lab demo with limited near-term Bitcoin implications and the timeline pressure eases. If the scaling holds, the gap between "interesting milestone" and "actionable threat" closes faster than most current projections assume. The falsifiable question is whether cultivation's error gains survive the transition from 54 qubits to the hundreds of thousands required for a cryptographically relevant machine.

Sources

• Google Quantum AI blog post, Emma Rosenfeld and Craig Gidney, Oct. 15, 2026
• "Magic state cultivation on a superconducting quantum processor," Science, Oct. 15, 2026
• Europol quantum warning, Oct. 7, 2026 (europol.europa.eu; exact report URL not yet retrieved)