Breaking the elliptic curve that protects Bitcoin takes fewer than 1,200 error-corrected "logical" qubits, according to a March 2026 paper by Google Quantum AI and co-authors. On a superconducting machine that comes to fewer than 500,000 physical qubits, and the attack would take minutes.
No such machine exists. The largest fault-tolerant benchmark so far ran on 8 logical qubits. Below, every serious estimate sits next to what has actually been built, with a link to each source.
What a quantum computer would attack
Bitcoin signs payments with elliptic-curve cryptography (ECC). The Bitcoin wiki puts it plainly: "Currently Bitcoin uses secp256k1 with the ECDSA algorithm." secp256k1 is a 256-bit elliptic curve, which is why the estimates below speak of "ECC-256" or "ECDLP-256": the elliptic curve discrete logarithm problem on a 256-bit curve.
Your private key signs a payment. Your public key lets everyone check the signature. Working back from the public key to the private key is practically impossible for an ordinary computer. A large quantum computer running Shor's algorithm could do it.
Two kinds of qubit matter here. A physical qubit is one piece of hardware, such as a single atom or a tiny superconducting circuit, and it makes mistakes. A logical qubit is a group of physical qubits that works as one reliable qubit, because the group keeps correcting its own errors. Think of a choir holding one note: single singers drift, the choir does not. Our RSA-2048 article explains this in more detail.
How the estimate fell, 2017 to 2026
| Year | Who, and what they estimate |
|---|---|
| 2017 | Roetteler, Naehrig, Svore and Lauter: at most 9n + 2⌈log₂ n⌉ + 10 logical qubits for an n-bit curve. For n = 256 that works out to 2,330. They also found that elliptic curves need fewer qubits than RSA at a comparable security level (arXiv:1706.06752) |
| 2021 | Webber, Elfving, Weidt and Hensinger: 13 million physical qubits to break a Bitcoin key in one day, about 317 million to do it within an hour (arXiv:2108.12371) |
| 2023 | Litinski: one key every 10 minutes with 6,000 modules of 1,152 physical qubits each, about 6.9 million in total, if modules can link to distant modules; a strictly flat chip would need more qubits and take 38 hours per key (arXiv:2306.08585) |
| 2026 | Google Quantum AI with co-authors (Babbush, Gidney, Boneh, Drake and others): fewer than 1,200 logical qubits and 90 million Toffoli gates, or fewer than 1,450 logical qubits and 70 million; fewer than 500,000 physical qubits; minutes (arXiv:2603.28846, March 2026) |
| 2026 | Cain, Preskill, Bluvstein and others (Caltech, UC Berkeley, Oratomic): 26,000 atoms, "just a few days" for the P-256 curve (arXiv:2603.28627, March 2026) |
| 2026 | Häner, Roetteler and others (IonQ): about 1,450 logical qubits, 19,397 physical qubits, 25.7 days, with a 63% chance of success, on IonQ's own trapped-ion design (IACR ePrint 2026/1916, September 2026) |
A Toffoli gate is one basic step of the calculation. Google describes its result as "an approximately 20-fold reduction" in physical qubits (Google Research blog). The Cain paper uses P-256, a different 256-bit curve than Bitcoin's; the math problem is the same kind.
The pattern is the same as for RSA: fewer qubits usually means a slower attack. Google's design runs in minutes on half a million qubits. The two designs around 20,000 qubits take days or weeks.
Why speed matters for Bitcoin
For Bitcoin, how fast an attack runs is not a detail. Some public keys are already visible on the blockchain, for example on addresses that have sent coins before. An attacker has years to work on those. Other keys only become visible when the owner spends, and stay at risk until the payment is confirmed.
The Google paper separates "fast-clock" from "slow-clock" machines. It warns that the first fast machines could attack transactions while they wait in the public queue. A design that needs 25 days is no threat to a payment in flight, but it is a threat to a key that has been public for years. Which addresses fall in which group is in which Bitcoin addresses are exposed.
What exists today
The best measurement of fault-tolerant computing comes from a benchmark by Sandia National Laboratories, with Quantinuum and NVIDIA, published in September 2026. On Quantinuum's Helios-1, with 98 physical qubits, the team ran error-corrected programs on up to 8 logical qubits. The paper says computing power must grow by "5 orders of magnitude", a factor of 100,000, before machines reach useful quantum computation (arXiv:2609.12146).
The largest collection of physical qubits is an array of 6,100 atoms built at Caltech in 2025. The team still plans to link the qubits together; until then the array stores, but does not compute (Caltech).
On October 19, 2026, Quantinuum reported a logical error rate of five per million operations on Helios, about ten times better than its own September record. The company did not give a number of logical qubits for this result (Quantinuum press release). Better qubits shrink the overhead per logical qubit, but this does not change the count needed.
So the gap is roughly 8 logical qubits measured against about 1,200 needed: a factor of 150. For physical qubits, the gap is smaller in the atom designs, but those machines would take days.
What we do not know
Whether the hardware assumptions will hold. The Google estimate assumes one error per thousand operations on every physical qubit, at the scale of half a million qubits. No one has built that.
Whether the Google circuits are right. Google did not publish its circuits, to keep attack details from bad actors. Instead it offers a zero-knowledge proof, a way for others to check the resource counts without seeing the circuits. Outsiders can check the numbers, not the method.
Whether the estimates will fall further. They have fallen in every round so far. There is no law that says they will keep falling, and none that says they will stop.
When. None of these papers gives a date. Forecasts with dates, each with who makes it, are in our Q-Day timeline, and the Q-Day countdown runs to the earliest of them.
What this means for you
Coins on an address whose public key has never appeared on the blockchain are in the safest position: a quantum computer has nothing to work from until you spend. Avoid reusing addresses. The longer-term fix is a change to Bitcoin itself, to signatures that a quantum computer cannot break; our Bitcoin and the quantum threat covers that debate. Nothing on this page is investment advice.