Warnings that quantum computers could soon crack Bitcoin have returned, but the article by Derrick Cui reaches a much cooler conclusion: practical attacks on BTC and other systems that rely on elliptic curve cryptography are still several orders of magnitude away, with the earliest realistic window pushed out to around 2035.
The piece says the biggest progress has come from theory, not from machine scale. In 2022, a theoretical attack on ECC required about 317 million physical qubits. By 2026, new circuit designs and preprocessing methods had cut that figure to below 500,000. Hardware quality has improved too. Two-qubit fidelity rose from roughly 90% in 2005 to above 99.9% now, while coherence times stretched from around 1 microsecond to around 1 millisecond.
But the metric that matters most for a real attack has barely moved: the number of qubits in a single machine that can actually run a real algorithm. The article puts that number at about 105 today, versus a theoretical requirement of roughly 500,000.
How the article frames “Q-Day”
The piece labels the moment quantum computers can break widely used cryptography as “Q-Day” and points to a few estimates that shape current debate.
- Justin Drake puts the odds at 10% before 2030 and 50% before 2032.
- The US National Institute of Standards and Technology and the National Security Agency have set 2035 as the target for retiring vulnerable cryptography.
Even so, the article says no one can give a clean timetable. Quantum computing has no equivalent to Moore’s Law. Required resources have dropped by about 600x in four years, while machine scale may have grown only 10x over the past decade. Those curves do not move together, so the real schedule remains uncertain.
What it takes to break ECC
The article opens the technical section with a set of definitions.
Physical qubits are the total qubits present in a quantum computer.
Logical qubits, or error-corrected qubits, are the qubits that can actually be used for computation after error correction. One example in the article is a distance-5 code, where about 49 physical qubits are used to store the information in one qubit.
Non-Clifford gates are operations that are hard for classical machines to simulate. T gates are one example.
T gates apply a 45-degree phase rotation to a single qubit. In superconducting systems, microwave pulses induce that effect.
Magic states are pre-prepared, one-shot qubit resources used to apply non-Clifford gates indirectly. Since those gates cannot be applied directly to error-corrected logical qubits, the machine consumes magic states through entanglement, measurement, and correction in a process the article calls gate teleportation.
Toffoli gates act on three qubits and can be built from about seven T gates, or four in an optimized version, plus Clifford gates. In an error-corrected machine, the article says the only way to apply a Toffoli gate is to consume a magic state.
Shor’s algorithm, first introduced in 1994, is the quantum method used to break RSA and ECC through period finding.
Syndromes are the output streams produced by check qubits that detect errors in data qubits.
Distillation is the process of combining noisy magic states to produce a cleaner one. One example given in the article consumes 15 noisy states to produce a better output state.
The 2026 paper and its resource estimate
According to the article, a 2026 paper introduced new circuit design and preprocessing for Shor’s algorithm that cut the computation needed to break ECC. The paper describes a theoretical path for attacking ECC on a superconducting quantum computer.
The estimated requirements are:
- around 1,200 logical qubits,
- about 90 million Toffoli gates linked sequentially without error,
- roughly 500,000 physical qubits at current error-correction levels,
- and a runtime measured in minutes.
The article notes that if such a machine existed, the impact would not stop at Bitcoin or Ethereum. SSH, TLS, and HTTPS would also be exposed because they rely on ECC.
Where the bottlenecks are now
1. Fitting enough qubits into one machine
The first problem is still physical scale. Control lines, decoder chips, laser beams, and wiring all limit how many qubits can be packed into a usable system.
The theory improved fast. The article traces the resource estimate from about 317 million qubits in 2022 to about 9 million in Litinski’s 2023 work, then to 500,000 in 2026.
Hardware progress is real, but much smaller. Caltech used optical tweezers to pin 6,100 qubits in 2025, though the article says that was pinning rather than computing. IBM’s Condor chip can hold 1,121 qubits, but it is too noisy to run real algorithms. The largest chip that has actually run a real algorithm is put at about 105 qubits, identified as Google Willow in March 2026.
2. Turning noisy qubits into reliable logical qubits
Quantity alone is not enough. Error correction remains a hard gate. The article says the 2026 paper requires around 90 million Toffoli gates in sequence, each of them successful. That implies a logical error rate below roughly 1/90,000,000 per operation. The more practical “north star” target is a logical error rate around 10⁻⁹ or lower.
Google showed in 2024 that one logical qubit built from 101 physical qubits, a distance-7 code, had an error rate 2.14x lower than one built from 49 physical qubits at distance 5. That distance-5 result was itself 2.14x lower than a distance-3 setup built from 17 physical qubits. The article treats that as proof that errors keep dropping as physical qubits are added.
Still, the gap remains large. The distance-7, 101-qubit result had an error rate of 1.4×10⁻³ per cycle, which the article says is still about a million times above the target needed for this kind of attack.
3. Keeping error correction running in real time
Error correction must run continuously while the machine operates. In superconducting systems, a round of syndrome data arrives roughly every 1 microsecond. A classical decoder has to process each round in under about 1 microsecond, and it has to keep doing that as the machine scales.
The article highlights two advances:
- Riverlane’s local clustering decoder, published in Nature Communications in December 2025, described as the first adaptive FPGA hardware decoder to reach under 1 microsecond per round.
- Google’s AlphaQubit 2, in March 2026, which achieved real-time neural decoding below 1 microsecond per cycle up to distance 11. Simulations suggest a single TPU could reach distance 25.
Even here, the article says the field remains far from the 500,000-qubit scale.
4. Producing enough magic states
In an error-corrected architecture, hard gates consume magic states, and an ECC attack needs about 90 million Toffoli gates. That makes magic-state production and purification a major throughput bottleneck.
Distillation factories are built from logical-qubit blocks plus routing channels. They often sit idle during parts of computation, yet still absorb a large share of resources. At scale, the article says those factories typically take around 2% to more than 10% of all physical qubits.
There has been progress here as well. Magic-state cultivation in 2024 cut the cost per magic state sharply, and QuEra demonstrated logical-level distillation in 2024 using only five logical qubits.
5. Measurement and classical post-processing are not the main problem
The article says this part is well understood and relatively cheap. Once logical qubits are measured, classical post-processing can turn those measurement outcomes into the period and then into the private key.
Research fronts the author did not unpack in detail
The article also lists several areas it does not explore at length but identifies as active frontiers:
- fast-clock and slow-clock architectures,
- modular and multi-chip designs,
- below-threshold error-correcting codes,
- surface codes and qLDPC codes,
- magic-state cost,
- magic-state routing and compilation,
- coherence time,
- running storage and computation on qubits,
- cryogenic control electronics,
- and leakage plus correlated errors.
On IBM’s qLDPC work, the author says it was left out because IBM has so far shown qubit storage rather than computation on top of it.
What the risk looks like for Bitcoin
The Bitcoin section is specific. Shor’s algorithm lets an attacker recover a private key k when the public key Q is known. Once that happens, the attacker effectively becomes the owner. They can sign a transaction that sends the coins elsewhere, and the protocol will accept it as fully valid.
But a Bitcoin address is not a public key. It is a hash of the public key, first through SHA-256 and then through RIPEMD-160. The article says hashing is a different mathematical problem, and Shor’s algorithm does not break it.
The actual exposure appears when a user spends coins and reveals the public key on-chain. That public key stays on the ledger permanently. So any address that has already sent BTC to another address could be attacked in the future. Modern wallets reduce that risk by moving the full balance to a fresh address whenever BTC is sent.
The article’s estimate is that about 6.7 million BTC are already exposed and could potentially be stolen through quantum attacks.
Justin Drake also wrote about a separate risk: stealing a private key inside Bitcoin’s 10-minute block interval. The paper he cited suggests that could be done in 9 minutes. The author of this article considers that less severe than the risk attached to the already exposed 6.7 million BTC.
As for mitigation, the article gives one direct answer: everyone would have to move to quantum-safe keys, and after some period the BTC that were not migrated would need to be destroyed. The technology exists. The hard part would be getting the Bitcoin community to agree.
Why Ethereum faces a similar but more immediate exposure
Ethereum uses the same secp256k1 curve as Bitcoin and the same ECDSA signature scheme, so the cryptographic break works the same way: given a public key, Shor’s algorithm recovers the private key, and the holder of that private key controls the account.
The difference is the account model. Ethereum uses persistent accounts, which means addresses are reused. The article says that if practical quantum attacks existed today, every wallet that had ever sent a transaction could potentially be taken over.
Replacing ECDSA is described as straightforward in protocol terms. The harder issue is that post-quantum signatures are much larger than ECDSA signatures, so nodes must store more data in memory. The article says this is also why Ethereum is moving toward zk while changing its signature scheme.
There is also a migration problem. Every user would need to move from old keys to new keys, and accounts that do not migrate would have to be destroyed so attackers cannot claim them later.
Why quantum machines can break ECC at all
The back half of the article gives a longer technical explanation. Public-key cryptography allows two parties to communicate securely over an untrusted network such as the public internet without sharing a secret in advance.
Different protocols rest on different hard problems. Diffie-Hellman key exchange relies on discrete logarithms. ECDSA relies on the elliptic-curve discrete logarithm problem. RSA relies on factoring. The article says the common classical obstacle behind them is periodic structure, while the concrete mathematical task quantum computers excel at is finding that period.
What ECC is doing
The article describes ECC as a one-way street. Start from a public point G on a curve and “jump” forward k times to reach a new point Q. Going forward is easy. If all someone gives you is the start point G and the endpoint Q, recovering the number of jumps is believed to be classically intractable.
Here, the jump count k is the private key and the endpoint Q is the public key. The article writes it out this way:
- an elliptic curve is the set of points over a finite field satisfying y² = x³ + ax + b,
- G is the public base point fixed by the standard,
- for private key k, the public key is Q = kG,
- computing Q from k takes O(log k) group operations using double-and-add,
- recovering k from (G, Q) is the elliptic-curve discrete logarithm problem, where classical methods are effectively trial and error and very slow,
- Shor’s algorithm solves ECDLP in polynomial time by reducing it to period finding in the group generated by G.
The article includes a toy example using mod 17: the curve is y² ≡ x³ + 7 (mod 17), and the secret is k = 6, meaning it takes six jumps to go from G to Q. In a real system, the modulus is around 2²⁵⁶.
How Shor’s algorithm turns the key into a slope
The attack is reduced to a function f(x, y) = xG + yQ, where G is public and Q is the target public key. Since Q = kG, that becomes f(x, y) = (x + ky)G.
That creates a repeating pattern. If you shift the input by (k, -1), the output stays the same because (x + k) + k(y - 1) = x + ky. So the same output repeats along parallel diagonals in the (x, y) grid, and the direction of those diagonals encodes the private key k.
A classical computer would need to search for collisions between different input pairs that lead to the same output. A quantum computer does something different:
- it evaluates f for all (x, y) pairs at once in superposition,
- direct measurement still collapses the state to a random point and does not reveal the pattern,
- but a Fourier transform cancels everything except the repeating direction, producing a frequency peak that can be turned into k through classical arithmetic.
In the article’s illustration, each gold square is an input pair (x, y) that produces the same output point. The pattern repeats by a fixed step, right by k and down by 1, so the private key is encoded in the slope of those diagonals. The toy example uses k = 2 and n = 13. At real scale, the grid would have 2²⁵⁶ columns, which is why the structure is invisible to classical inspection.
A worked example with n = 19
The article then gives a fuller example on the curve y² = x³ + 2x + 2 over integers mod 17. It calls the setup easy only because it lives in mod 17; real systems operate around mod 2²⁵⁶. In this example the curve has n = 19 points, G = (5, 1) generates them all, and the target public key is Q = (0, 6). The task is to find k such that Q = kG. The answer is k = 7.
The quantum procedure is broken into stages:
- Setup: two counting registers, one for x and one for y, each storing values from 0 to 18, plus one work register that holds curve points. The article notes that unlike RSA, n = 19 is public here, so the QFT can be performed exactly in mod-19 arithmetic.
- Stage 1 — Initialization: reset everything and set the work register to the identity point O.
- Stage 2 — Superposition: apply Hadamard-like superposition to both counting registers, so they simultaneously hold all 19 × 19 = 361 pairs (x, y).
- Stage 3 — Point addition and entanglement: precompute the constants 2ʲG and 2ʲQ classically, then add those constants into the work register under the control of the counting qubits. The work register ends up holding xG + yQ entangled with each (x, y).
- Stage 4 — Inverse QFT and measurement: apply the inverse QFT to the two counting registers. Amplitudes concentrate on the pairs satisfying v ≡ k·u (mod 19), and a measurement returns one of those 19 pairs at random.
The article writes the full stage-3 state as the sum over all 361 pairs, Σ |x⟩|y⟩|xG + yQ⟩. Since Q = 7G, the work register really holds (x + 7y mod 19)G, so there are only 19 distinct work-register values. Each one gathers 19 input pairs into a diagonal family. The secret k = 7 is encoded in the slope of those families.
Three classical post-processing examples are given:
- if the measurement yields (u, v) = (3, 2), then k = 2 · 3⁻¹ mod 19 = 2 · 13 = 26 ≡ 7,
- if the measurement yields (u, v) = (5, 16), then k = 16 · 5⁻¹ mod 19 = 16 · 4 = 64 ≡ 7,
- if the measurement yields (u, v) = (0, 0), it gives no information and the run must be repeated. Any result with u ≠ 0 works, so 18 out of 19 runs are usable.
The article closes this section with a simple point: the reason to care about recovering k is that k is the private key. Once an attacker has it, the protocol no longer distinguishes them from the original owner.
Main qubit architectures listed in the article
The piece ends by summarizing several approaches to building qubits. In the author’s framing, qubits can be built from any system that probabilistically exists between output states 0 and 1.
- Superconducting circuits: used by Google, IBM, Rigetti, and IQM, based on LC circuits and often described as “artificial atoms.”
- Trapped ions: used by IonQ and Quantinuum, where lasers create superposition and readout captures the state.
- Neutral atoms: used by QuEra, Pasqal, and Atom Computing, relying on optical tweezers to hold uncharged atoms.
- Photonic qubits: used by PsiQuantum and Xanadu, based on single-photon polarization or path.
- Silicon spin qubits: used by Intel, Diraq, and Quantum Motion, based on electron spin up or spin down.
The article’s bottom line
The central argument is not complicated. In theory, the resources needed to break the ECC used by BTC and ETH have fallen sharply in the last few years. In practice, the hardest pieces, hardware scale, error correction, decoding, and magic-state throughput, are still far from the levels required for a working attack. Current machines can run real algorithms with only about 105 qubits, compared with the roughly 500,000 physical qubits discussed in the 2026 attack estimate.
That is why the article points to 2035 at the earliest rather than to an immediate threat. The short-term story is not that Bitcoin private keys are about to be vacuumed up overnight. The longer-term story is that exposed Bitcoin public keys, Ethereum’s address reuse, and the governance burden of moving to post-quantum signatures are no longer problems the industry can postpone forever.