Can a Quantum Computer Mine Zcash?

Every few months a headline claims quantum computers will end crypto mining. Most of the replies are equally unhelpful, insisting quantum computers cannot mine at all. Both are wrong, and the truth is more interesting than either.

Grover's algorithm genuinely applies to Zcash mining. Mining is unstructured search, which is precisely the problem Grover was designed for, and the quadratic speedup is real. Zcash mining is nonetheless safe from it, for two structural reasons that no amount of hardware progress fixes.

What Zcash mining actually asks a machine to do

Zcash uses Equihash, specifically the (200,9) parameter set, as its proof-of-work algorithm. It has been Zcash's PoW since launch and remains so today. The current parameters:

• Target block time: 75 seconds, since the Blossom upgrade (ZIP 208)
• Block reward: 1.5625 ZEC, following the second halving in November 2024
• Network difficulty: 210,507,987 at block height 3,421,096
• Practical hardware: Equihash ASICs. An Antminer Z15 Pro does roughly 840 KSol/s at about 2,780 W

A miner searches for a nonce whose Equihash solution meets the difficulty target. There is no shortcut, no structure to exploit, no way to be clever. You try, you fail, you try again. That is what "unstructured search" means, and it is exactly the shape of problem Grover's algorithm addresses.

Grover's algorithm, honestly stated

Classically, finding one marked item among N candidates takes about N/2 attempts on average. Grover's algorithm finds it in about the square root of N operations. For a search space of 2⁸⁰, that is 2⁴⁰ instead of 2⁸⁰. Stated that way it sounds like the end of mining.

It is not, and the first reason is a result from 1999 that almost never makes it into the headlines.

Reason one: Grover does not parallelise

This is the part that matters most, and it is a proven limitation rather than an engineering gap.

Christof Zalka proved that Grover's algorithm is exactly optimal, and that quantum search cannot be parallelised any better than by splitting the search space between independent machines. Split the work across Q quantum computers and you get a speedup of the square root of Q. Not Q. The square root of Q.

Classical mining has no such limitation. Brute-force search is embarrassingly parallel: two ASICs are twice as fast as one, a thousand ASICs are a thousand times faster. That difference compounds brutally.

Read the last row carefully. A million quantum computers buy a thousandfold improvement. A million ASICs buy a millionfold improvement. Mining is a race that scales with machine count, which is the single problem shape Grover handles worst. The gap does not close as quantum hardware improves. It widens, because both sides scale and only one of them scales linearly.

Reason two: Equihash was built memory-hard, and that is poison for a quantum oracle

The second reason is specific to Equihash, and it is why Zcash is in better shape here than Bitcoin.

Grover does not search a list. It repeatedly calls an oracle, a reversible circuit that recognises a correct answer, and every call must run the entire Equihash computation in superposition. So the question becomes: what does it cost to build Equihash as a reversible quantum circuit?

Equihash is deliberately memory-hard. It is built on Wagner's algorithm for the generalised birthday problem, which needs O(2^n/(k+1)) memory, and Equihash's designers chose parameters specifically so that memory, not raw computation, is the bottleneck. In practice:

• Equihash (200,9) needs roughly 50 MB minimum, and runs properly at about 144 MB
• That is not incidental. Cutting the working list by a factor of q raises computation by O(q^k/2), a deliberately steep time-memory tradeoff
• Bitmain's Equihash ASICs carry roughly 144 MB of on-chip memory for exactly this reason

Now translate that requirement into qubits. A quantum oracle cannot use ordinary RAM, because the intermediate state has to remain in superposition and coherent. Fifty megabytes is 400 million bits. Building a reversible Equihash oracle means holding on the order of hundreds of millions of coherent logical qubits, each one built from many physical qubits once error correction is accounted for.

The largest machines available to the public today are measured in the tens to low hundreds of qubits. On the list prices published by quantum cloud providers, the widest generally available processors are Rigetti's 108-qubit Cepheus, QuEra's 256-qubit Aquila and Pasqal's 100-qubit FRESNEL. The gap between 256 and several hundred million is not a gap that better engineering closes soon.

The third cost nobody mentions: fault-tolerant gates are slow

Even granting a machine large enough, Grover's iterations are serial by construction. You cannot overlap them, because each one depends on the amplitude state the previous one produced.

And fault-tolerant logical operations are not fast. The expensive gates in this kind of circuit require magic-state distillation, a process that consumes many physical qubits and many cycles to produce one usable logical operation. Practical estimates put logical gate rates in the kilohertz range, not the gigahertz range an ASIC operates at. So a quantum miner would run a far smaller number of far slower steps, in sequence, against an opponent running trillions of operations per second in parallel.

How to check the claim yourself, for about the price of a coffee

You do not have to take any of this on faith, and that is the useful part. Grover's algorithm is small enough to run at toy scale on real hardware, and quantum computing as a service platforms now rent that hardware by the shot.

The quantum cloud provider Zero Kelvin Simulation Foundry publishes a full walkthrough of Grover's search algorithm with the circuit and a live run, which is the cheapest way to see the quadratic speedup and its limits with your own numbers. Their quantum computing cost calculator prices eight different QPUs against a fixed budget, which is a faster sanity check than any vendor roadmap. A sample of the published rates:

At those rates $20 buys somewhere around 46,000 shots on the Rigetti machine. A meaningful toy Grover run costs a few dollars, and simulation costs less than a cent. Compare that against what it costs to learn the same lesson by buying an ASIC.

One warning if you do run it. A toy Grover demo flatters the quantum machine enormously, because a three-qubit oracle is a few hundred gates while a real Equihash oracle is astronomically larger, and because simulators run noiseless logical gates rather than slow distilled ones. Extrapolating from a toy run to "quantum computers will mine Zcash" is the single most common error in this subject. The demo shows the algorithm works. It says nothing about the scale.

What this means for your mining operation

Practically, nothing. There is no action to take, no hardware to replace, and no timeline to plan against. Your Z15 Pro is not competing with a quantum computer this decade or plausibly any decade, and the reason is structural rather than a matter of waiting for better qubits.

The genuine quantum risk to Zcash holders sits somewhere else entirely: not in mining, but in the elliptic curve cryptography protecting addresses and in the privacy of shielded transactions. Those are real, they are worth understanding, and they have nothing to do with your hashrate.

The short version

• Does Grover apply to Zcash mining? Yes, genuinely. Mining is unstructured search and the quadratic speedup is real.
• Does that threaten Equihash mining? No, for two structural reasons. Grover gives only a square-root gain from parallelism while ASICs gain linearly, so the gap widens as both scale. And Equihash's deliberate memory-hardness demands hundreds of millions of coherent qubits for a single oracle call.
• Will better quantum hardware change this? The parallelism limit is a proven theorem, not an engineering problem. Better hardware does not repeal it.
• Should miners do anything? No. The real quantum questions for Zcash are about keys and privacy, not proof-of-work.