TechFlowPost published an article on July 16 by Derrick Cui arguing that quantum computers remain several orders of magnitude away from mounting a practical attack on elliptic curve cryptography, even though the theoretical resource estimates have fallen sharply in recent years. The article’s bottom line is simple: the industry is still nowhere near “Q-Day,” the point at which a quantum computer can realistically break modern public-key cryptography.
The piece focuses on ECC, which is used in TLS, Bitcoin and HTTPS. It says a 2026 paper showed, at least in theory, that breaking ECC on a superconducting quantum computer would require about 1,200 logical qubits linked through roughly 90 million Toffoli gates without error. Under current error-correction assumptions, that translates to about 500,000 physical qubits and a runtime measured in minutes.
Theory has moved fast, machine scale has not
The article says the biggest gains have come from theory rather than hardware scale. Improvements in algorithms and error-correction design have pushed the estimated requirement for breaking ECC from roughly 317 million physical qubits in 2022 to about 9 million in Litinski’s 2023 work, and then to fewer than 500,000 in 2026.
Hardware has improved too. Two-qubit fidelity has risen from about 90% in 2005 to above 99.9% today, while coherence time has stretched from around 1 microsecond to around 1 millisecond. But the metric that matters most is how many usable qubits a single machine can bring to a real algorithm. On that front, the article says progress has been thin: roughly 105 qubits can currently run a genuine algorithm, versus a theoretical requirement of about 500,000.
That gap is why the author says practical attacks remain distant. The article also notes that quantum computing has no clean equivalent to Moore’s law. Theoretical requirements fell by about 600x in four years, but machine scale may have increased only about 10x over the past decade, making any concrete timeline unreliable.
On estimates for “Q-Day,” the article cites Justin Drake as putting the odds at 10% before 2030 and 50% before 2032. It also says the US National Institute of Standards and Technology and the US National Security Agency have set 2035 as the target for phasing out vulnerable cryptography.
Key concepts the article lays out
The piece pauses to define several core terms.
- Physical qubits: the total number of qubits in a quantum computer.
- Logical qubits, or error-corrected qubits: the qubits that remain usable after error correction. One example given is that a distance-5 code uses about 49 physical qubits to store one qubit of information.
- Non-Clifford gates: operations that are hard for classical machines to simulate, including the T gate.
- T gate: a 45-degree phase rotation on a single qubit. In superconducting systems, the effect is induced with microwave pulses.
- Magic states: prebuilt one-time-use qubits that carry the resources needed for non-Clifford operations. Since those gates cannot be applied directly to error-corrected qubits, the computation consumes magic states through entanglement, measurement and correction in a process known as gate teleportation.
- Toffoli gates: three-qubit gates with two control bits and one target bit. The article says they are built from about seven T gates, or four in an optimized construction, plus Clifford gates. On logical qubits, applying one Toffoli gate means consuming one magic state.
- Shor’s algorithm: introduced in 1994 as a method for breaking RSA and ECC by reducing the problem to period finding.
- Syndromes: the stream of outputs produced by check qubits that detect whether data qubits have suffered errors.
- Distillation: the process of combining many noisy magic states into a much cleaner one. The article gives one example in which 15 noisy states are consumed to produce a single improved state.
What the attack pipeline would actually look like
The article frames a quantum attack on ECC as a multi-stage pipeline: place physical qubits on a chip, bundle many of them into error-corrected logical qubits, run the algorithm on those logical qubits while feeding it difficult gates through magic states, then measure the result and let a classical computer do the final post-processing.
Starting with noisy physical qubits
The first challenge is purely physical: getting enough qubits into one machine. That includes control lines, decoder chips, laser beams, wiring and the rest of the engineering stack.
The article lists several milestones. Caltech used optical tweezers to pin 6,100 qubits in 2025, though that was pinning rather than computation. IBM’s Condor chip can host 1,121 qubits, but the noise level is too high for a real algorithm. The largest chip that has actually run a practical algorithm is said to be around 105 qubits, identified in the piece as Google’s Willow in March 2026.
Bundling them into reliable logical qubits
The 2026 paper requires about 90 million Toffoli gates to be linked in sequence, with every one succeeding. That pushes the logical error rate per operation below about 1/90,000,000. In practice, the article says, the “north star” target is a logical error rate near 10⁻⁹ or lower.
Google presented one notable result in 2024. A single logical qubit built from 101 physical qubits, a distance-7 code, showed an error rate 2.14x lower than a distance-5 code built from 49 physical qubits. That distance-5 code, in turn, was 2.14x lower than a distance-3 code built from 17 physical qubits. The article treats this as evidence that adding more physical qubits can keep pushing the error rate down.
It also says the system is still nowhere near the level needed for ECC attacks. The error rate for the 101-qubit distance-7 logical qubit was 1.4×10⁻³ per cycle, about a million times above the target.
Keeping error correction alive long enough
Even with logical qubits, the machine has to keep error correction running continuously. Otherwise the quantum information dies before the computation finishes. The difficulty is that decoding must scale with the system.
In superconducting machines, the article says, a new round of syndrome data arrives roughly every 1 microsecond. The classical decoder has to process each full round in less than about 1 microsecond, and it has to do that continuously.
Riverlane’s local clustering decoder, published in Nature Communications in December 2025, is described as the first adaptive hardware decoder on FPGA to get below 1 microsecond per round. Google’s AlphaQubit 2, in March 2026, reportedly performed real-time neural decoding below 1 microsecond per cycle out to distance 11, and simulations suggested one TPU could reach distance 25. That is still far short of a 500,000-qubit-scale machine.
Producing and consuming magic states
Every hard gate in the ECC attack, meaning every Toffoli gate, consumes one magic state. Since the attack needs about 90 million Toffoli gates, creating, purifying and routing enough magic states becomes a major throughput bottleneck.
The article explains that a distillation factory is effectively a block of logical qubits plus routing channels. Those resources sit unavailable for other work while the computation runs. At scale, these factories usually consume about 2% to more than 10% of all physical qubits in the machine.
It also lists a few advances. Magic-state cultivation in 2024 cut the cost per magic state substantially. QuEra, also in 2024, demonstrated logical-level distillation using only five logical qubits.
Measurement and classical post-processing are not the bottleneck
The final step is not where the real challenge sits. Measuring logical qubits and running the classical post-processing pipeline from outcomes to period to private key is already well understood and relatively cheap, according to the article.
Research fronts the author says he did not cover in detail
The article names a long list of areas without going deep into them: fast-clock and slow-clock architectures, modular and multi-chip systems, below-threshold error-correcting codes, surface codes and qLDPC codes, magic-state cost, magic-state routing and compilation, coherence time, running storage and computation on qubits, cryogenic control electronics, and leakage and correlated errors.
It specifically says IBM’s qLDPC work was left out because the company has so far demonstrated stored qubits rather than computation on top of them.
What this means for Bitcoin
The article then turns to Bitcoin. Its central point is that Shor’s algorithm can recover a private key k when the public key Q is known. Once that happens, the attacker is effectively the owner. They can sign a transaction that moves the coins to their own address, and that transaction is fully valid.
Bitcoin addresses, though, are not public keys. They are hashes of public keys, first through SHA-256 and then through RIPEMD-160. Hashing is a different mathematical operation, and the article says Shor’s algorithm does not break it.
The risk appears once a transaction reveals the public key. To authorize a Bitcoin payment, the sender has to expose Q, and that public key remains on-chain forever. That means any address that has ever sent bitcoin to another address could become vulnerable if quantum attacks turn practical. Modern wallets reduce that exposure by moving the full balance to a fresh address every time coins are sent.
The article puts the amount of already exposed bitcoin at about 6.7 million BTC, which it says could in principle be stolen by quantum computing.
It also mentions Justin Drake’s discussion of a narrower threat: stealing a private key inside Bitcoin’s 10-minute block interval. A paper he cited suggested this could be done in 9 minutes. The author says that issue is less serious than the risk attached to the 6.7 million BTC that are already exposed.
As for mitigation, the article is blunt. The only real fix is to move everyone to quantum-safe keys, which it says already exist, and later destroy the bitcoin that was never migrated. Getting the Bitcoin community to agree to that, the author writes, would be difficult.
Ethereum faces the same cryptographic break, but a different exposure model
Ethereum uses the same curve as Bitcoin, secp256k1, and the same signature scheme, ECDSA. So the underlying break is the same: given the public key, Shor’s algorithm recovers the private key and hands control of the account to the attacker.
The difference is the account model. Ethereum uses persistent accounts, so addresses get reused. The article says that if quantum attacks were possible today, every wallet that had ever sent a transaction could be taken over.
Replacing ECDSA is technically straightforward, in the author’s view. The harder part is that post-quantum signatures are much larger than ECDSA signatures, which means nodes have to store more data in memory. The article says that is one reason Ethereum is moving toward zk while changing its signature scheme.
Ethereum also faces the same migration problem. Users have to actively move from old keys to new ones, and any accounts that do not migrate would need to be destroyed so attackers cannot seize them.
Why quantum computing threatens public-key cryptography at all
The article then steps back to first principles. Public-key cryptography exists so two people can communicate securely over an untrusted network such as the public internet without sharing a secret in advance.
It mentions several common protocols, including Diffie-Hellman key exchange, ECDSA signatures and RSA encryption. Their hard problems are discrete logarithms, elliptic-curve discrete logarithms and factoring. The author’s summary is that the mathematical bottleneck that defeats classical machines is periodic structure, and the practical mathematical trick quantum computers are good at is finding periods.
What ECC is
The article describes ECC as built on a one-way street. Start from a public point G on a curve and “jump” forward k times to reach another point Q. Moving forward is fast. Given only G and Q, recovering the number of jumps is infeasible on a classical machine.
The jump count k is the private key and Q is the public key. Everyone can see the start and end points. Only the key holder knows the number of steps in between.
Its mathematical explanation runs as follows:
- An elliptic curve is the set of points over a finite field satisfying y² = x³ + ax + b.
- G is the base point, public and fixed by the standard.
- For a private key k, the public key is Q = kG.
- Computing Q from k through double-and-add takes O(log k) group operations.
- Recovering k from (G, Q) is the elliptic-curve discrete logarithm problem, or ECDLP. Classical methods amount to trial and error, so they are extremely slow.
- Shor’s algorithm solves ECDLP in polynomial time by reducing it to period finding in the group generated by G.
The article gives a toy example on the curve y² ≡ x³ + 7 (mod 17). The curve, the base point G and the endpoint Q are all public. The secret is k = 6, the number of jumps from G to Q. In that tiny space, you can count the jumps by hand. Real ECC uses a modulus space on the order of 2²⁵⁶.
How Shor’s algorithm breaks ECC
The article reduces the attack to the function f(x, y) = xG + yQ, where G is the public generator and Q is the target public key. Since Q = kG, that becomes f(x, y) = (x + ky)G.
That immediately creates a repeating structure. Shifting the inputs by (k, -1) leaves the output unchanged because (x + k) + k(y - 1) = x + ky. In other words, the function repeats along parallel diagonals in the input grid, and the direction of those diagonals encodes the private key k.
A classical computer would need to brute-force collisions to uncover that direction. A quantum computer changes the game by:
- evaluating f over all input pairs (x, y) at once in superposition, so the whole grid exists in the machine simultaneously;
- still not letting you inspect the pattern directly, because measurement collapses the state to a random point and reveals nothing useful about the direction;
- applying a Fourier transform so that everything except the repeating direction interferes away, leaving a frequency peak;
- using ordinary classical math at the end to recover k.
One diagram in the article marks each gold square as an input pair (x, y) that produces the same output point. Those squares repeat with a fixed step, right by k and down by 1, so the private key is encoded in the diagonal direction. The toy illustration uses k = 2 and n = 13. At real size, the grid would have 2²⁵⁶ columns, and a classical machine can inspect only one cell at a time, which is why the pattern is effectively invisible in practical ECC.
A full worked example on a small curve
The article then walks through a complete miniature example. Take the curve y² = x³ + 2x + 2 over the integers mod 17. This system has n = 19 points, and G = (5, 1) generates all of them. Suppose the public key is Q = (0, 6). The task is to find k such that Q = kG. The article gives the answer as k = 7, because the sequence G, 2G, 3G and so on reaches (0, 6) on the seventh step after passing through (5,1), (6,3), (10,6), (3,1), (9,16) and (16,13).
It then breaks the quantum procedure into stages.
Setup
Prepare two count registers, one for x and one for y, each holding values from 0 to 18. A work register holds a curve point. The article says this differs from the factoring case: for RSA, the period r is unknown, so the register has to be oversized and the resulting peaks are approximate. Here n = 19 is public, so QFT can be done exactly in mod-19 arithmetic, producing perfectly sharp peaks.
Stage 1: Initialization
Reset everything and set the work register to the identity point O, the “zero” of the curve.
Stage 2: Superposition
Apply a Hadamard-style superposition to the two count registers. They now hold all 19 × 19 = 361 pairs of (x, y) at the same time.
Stage 3: Point addition and entanglement
First compute the constants 2ʲG and 2ʲQ classically for each bit position j. Then, controlled by the count-qubit bits, add the corresponding constants into the work register. After the full sequence, the work register contains xG + yQ and is entangled with each input pair.
The complete quantum state is the large entangled sum Σ |x⟩|y⟩|xG + yQ⟩ over all 361 pairs. Because Q = 7G, the work register really stores (x + 7y mod 19)G, so only 19 distinct values appear. Grouping the state by the work-register value gives:
- all pairs with x + 7y ≡ 0 (mod 19), tensor |O⟩;
- all pairs with x + 7y ≡ 1 (mod 19), tensor |(5, 1)⟩;
- all pairs with x + 7y ≡ 2 (mod 19), tensor |(6, 3)⟩;
- and so on, 19 groups in total with 19 pairs each.
The secret k = 7 is now encoded in the slope of those diagonal families. But direct measurement would only give a random pair, not the slope itself.
Stage 4: Inverse QFT and measurement
Applying inverse QFT to the two count registers concentrates the amplitude onto exactly the 19 pairs (u, v) satisfying v ≡ k·u (mod 19). The article describes this as taking the slope of a line in ordinary space and turning it into a slope in frequency space. A measurement returns one random member of those 19 pairs.
Then the classical post-processing happens off-chip. The article gives three examples:
- If the measurement is (u, v) = (3, 2), then k = 2 · 3⁻¹ mod 19 = 2 · 13 = 26 ≡ 7. Check: 7G = (0, 6) = Q.
- If the measurement is (u, v) = (5, 16), then k = 16 · 5⁻¹ mod 19 = 16 · 4 = 64 ≡ 7.
- If the measurement is (u, v) = (0, 0), then it contains no information and the computation must be rerun. Any result with u ≠ 0 works, so the success rate is 18/19.
The article’s point is that recovering k means recovering the private key. Once you have it, there is no difference between the attacker and the legitimate owner when it comes to signing.
Types of qubits in the field today
The article closes with a quick survey of hardware approaches. In broad terms, it says, any system that can probabilistically exist between 0 and 1 in its output can be used to build qubits.
- Superconducting circuits: used by Google, IBM, Rigetti and IQM, based on LC circuits that behave like “artificial atoms.”
- Trapped ions: used by IonQ and Quantinuum, where single ionized atoms are placed into superposition with lasers and read out optically.
- Neutral atoms: used by QuEra, Pasqal and Atom Computing, where uncharged atoms are held by optical tweezers and read through internal states.
- Photonic qubits: used by PsiQuantum and Xanadu, where horizontal or vertical polarization, or one of two paths, carries the information.
- Silicon spin qubits: pursued by Intel, Diraq and Quantum Motion, where the electron spin state carries the qubit.
The article ends by saying the author has included a homework exercise from a cryptography course he took several years ago, along with his own solution, as an exercise for readers.