How Many Qubits Does It Actually Take to Break Bitcoin? Google's 2026 Paper Explained

On March 30, 2026, Google Quantum AI and researchers from the Ethereum Foundation and Stanford University published a 57-page whitepaper that did something no prior quantum computing research had done at this level of institutional credibility: it provided a specific, optimized, hardware-referenced engineering specification for breaking Bitcoin's core cryptography.

The number that circulated everywhere afterward was 500,000 physical qubits. But that headline missed both the more precise figure and the more important question, which is how far away from that number we actually are right now.

This post answers the specific question directly: how many qubits does it take to break Bitcoin, what kind of qubits, according to which analysis, under which assumptions, and what the gap between that number and today's best hardware actually looks like.

The One-Minute Background: Why Qubits Threaten Bitcoin at All

Bitcoin's ECDSA signatures rely on the elliptic curve discrete logarithm problem over the secp256k1 curve. The security assumption is that deriving a private key from a public key requires solving a problem that would take a classical computer billions of years.

Shor's algorithm, published by Peter Shor in 1994, is a quantum computing method that can solve this problem efficiently, meaning in polynomial time rather than exponential time. On a classical computer you could run Shor's algorithm too, but it would still take billions of years because you do not have the quantum interference effects that make the algorithm fast. On a quantum computer with enough qubits and reliable enough gates, the runtime collapses from billions of years to minutes.

The question "how many qubits" is therefore asking: how large and reliable does a quantum computer need to be before it can run Shor's algorithm against Bitcoin's specific elliptic curve fast enough to matter?

What Google's March 2026 Paper Actually Said

The paper does not give one number. It gives two circuit designs with different optimization objectives, and the headline figure depends on which hardware model you apply.

Circuit design one minimizes logical qubit count. It requires approximately 1,200 logical qubits and approximately 90 million Toffoli gates (the non-Clifford gate type that dominates fault-tolerant quantum computation cost).

Circuit design two minimizes gate count. It requires approximately 1,450 logical qubits and approximately 70 million Toffoli gates. Both designs target secp256k1 directly, the curve Bitcoin uses, rather than a generic 256-bit elliptic curve.

Under Google's specific hardware architecture and error-correction model, the physical qubit count needed to implement either circuit comes in at fewer than 500,000 physical qubits. The runtime for recovering a private key from an exposed public key is approximately 9 to 12 minutes per key under these specifications.

That 9-minute runtime is what made cryptographers uncomfortable. Bitcoin's block confirmation window is 10 minutes. If a sufficiently powerful quantum computer existed and targeted a transaction in the mempool—a pending transaction where the public key is visible but the block has not yet confirmed—the theoretical attack window and the confirmation window are uncomfortably close. The paper's authors model a real-time mempool attack with a 41% success rate against that window.

The technically precise achievement here is what the paper calls a 10x reduction in spacetime volume compared to the best prior work. Spacetime volume is the product of logical qubits multiplied by gate count, and it is the metric that actually drives how big and how expensive a quantum computer needs to be. Prior work had either achieved a low qubit count at extremely high gate cost, or a low gate count at high qubit cost. Google's team found the sweet spot between these extremes, close to the lowest prior qubit count at close to the lowest prior gate count, and the result is a spacetime volume roughly 10x smaller than either approach independently achieved before.

The Caltech and Oratomic Alternative Estimate

A separate paper published almost simultaneously by researchers from Caltech and quantum startup Oratomic offered a different and in some ways more striking analysis. Under their assumptions, a neutral-atom quantum computer with approximately 26,000 physical qubits could break ECC-256 in approximately 10 days.

That number, 26,000 physical qubits, is dramatically lower than Google's sub-500,000 estimate.

The discrepancy is not an error in either paper. It reflects different hardware architectures and different time-cost tradeoffs. Neutral-atom quantum computers, the type that Oratomic and QuEra are building, can in principle reuse and reconfigure qubits more efficiently than superconducting qubit designs, which is Google's and IBM's primary hardware path. A 26,000-qubit neutral-atom machine running for 10 days is a very different engineering challenge from a 500,000-qubit superconducting machine running for 9 minutes. Both achieve the same result under their respective assumptions. The 10-day runtime on the smaller machine means it would not be useful for mempool attacks, but it would be devastating for any exposed public key that has been sitting on-chain for years.

Estimated requirements for running Shor's algorithm have now fallen five orders of magnitude in two decades, from roughly 1 billion physical qubits in 2012 to about 10,000 to 26,000 today under the most favorable architecture models. That trajectory, not any single paper, is what makes the current moment different from 2015 or 2020.

Original Framework: The Qubit Threshold Gap Table (June 2026)

The gap between the best estimate and the current state of hardware is still large. Approximately 200x by physical qubit count on the Google architecture model. Approximately 10x on the neutral-atom model. Neither gap is closing in one product cycle.

Logical vs Physical Qubits: The Distinction That Matters

The difference between 1,200 logical qubits and 500,000 physical qubits is quantum error correction. Physical qubits are the actual hardware components in a superconducting chip or a trapped-ion device. They are inherently noisy. Errors accumulate. A two-qubit gate on the best available hardware today has an error rate of roughly 0.1% to 0.5% per operation. For an algorithm requiring 90 million Toffoli gates, that error rate is catastrophic without error correction.

Quantum error correction encodes a single logical qubit across many physical qubits, so that errors affecting individual physical qubits can be detected and corrected without disturbing the logical qubit's state. The most mature error correction approach, the surface code, typically requires somewhere between 1,000 and 2,000 physical qubits per logical qubit at current physical error rates, though this ratio improves as physical error rates fall. Google has published data showing their Willow chip achieving error rates low enough that the surface code overhead starts to shrink noticeably as you add more qubits.

This is the key reason the physical qubit number falls as hardware improves even before you add more qubits. Better error rates mean each logical qubit costs fewer physical qubits to protect.

Where Hardware Actually Stands in June 2026

IBM's best publicly available processor as of this writing has 156 physical qubits (Heron r2). Google's Willow chip, announced in December 2024, has 105 physical qubits and demonstrated error correction that scales correctly, meaning adding more qubits reduces rather than increases the logical error rate. Microsoft is pursuing a topological qubit approach that could in theory achieve lower physical qubit overhead than surface codes, but no large-scale fault-tolerant topological processor exists yet. Neutral-atom systems from QuEra and Atom Computing have demonstrated reconfigurable arrays of up to a few hundred qubits.

The best publicly known machines in June 2026 have roughly 2,000 to 2,500 physical qubits. The threshold for breaking Bitcoin's ECDSA-256 under the Google architecture model is fewer than 500,000 physical fault-tolerant qubits. Under the neutral-atom model it is approximately 26,000. No current machine is fault-tolerant at scale. Most estimates from hardware teams place a machine capable of fault-tolerant computation at the 500,000 qubit scale somewhere in the 2030s, with the neutral-atom path potentially shorter but still not imminent.

ARK Invest's March 2026 report concluded that quantum computing is still at Stage 0, meaning quantum computers exist but lack any commercially relevant capability. The most optimistic hardware projections do not place us at 500,000 fault-tolerant physical qubits before 2033 to 2035.

Why the Compression of Estimates Matters More Than Any Single Number

These are not isolated research papers from Google. They are sequential signals from an organization that builds quantum hardware, develops quantum algorithms, and runs global technology infrastructure that depends on the cryptographic primitives being analyzed. In May 2025, Google published an RSA-2048 estimate showing fewer than 1 million qubits on their architecture. In early 2026 they announced a 2029 internal PQC migration deadline. In March 2026, they published the ECDLP-256 estimates discussed above. Each paper compresses the prior estimate by a factor of 10 to 20.

No one can tell you exactly when a cryptographically relevant quantum computer arrives. What the data shows clearly is the direction: the engineering specification for a machine that breaks Bitcoin is becoming simpler, smaller, and cheaper with each published iteration. The blockchain industry's response, migrating from ECDSA to post-quantum standards like ML-DSA (FIPS 204), has a fixed cost paid once. Waiting until the hardware exists to act is not a strategy, it is a gamble on the other side of a one-way door.

Internal Links

Frequently Asked Questions

Q: How many qubits does it take to break Bitcoin?

A: According to Google Quantum AI's March 2026 whitepaper, breaking Bitcoin's secp256k1 ECDSA-256 requires approximately 1,200 to 1,450 logical qubits and fewer than 500,000 physical qubits under their superconducting architecture model. A Caltech and Oratomic analysis published simultaneously estimated that approximately 26,000 physical qubits on a neutral-atom machine could accomplish the same attack over 10 days. The best publicly known quantum hardware in June 2026 has roughly 2,500 physical qubits.

Q: What is the difference between logical qubits and physical qubits?

A: Physical qubits are the actual hardware components. They are noisy and error-prone. Quantum error correction encodes one reliable logical qubit across many physical qubits to detect and fix errors. Under current surface code models, roughly 1,000 to 2,000 physical qubits are needed per logical qubit. This is why 1,200 logical qubits translates to fewer than 500,000 physical qubits in Google's estimate.

Q: When will quantum computers be able to break Bitcoin?

A: No credible estimate puts a capable machine in production before 2033 at the earliest under optimistic hardware projections. ARK Invest's March 2026 report placed quantum computing at Stage 0. The direction of progress, however, is clear: the qubit requirement has fallen five orders of magnitude over two decades.

Q: What did Google's March 2026 paper actually say?

A: It presented two optimized quantum circuit designs targeting secp256k1. One minimized qubit count (1,200 logical qubits, 90 million Toffoli gates). The other minimized gate count (1,450 logical qubits, 70 million Toffoli gates). Under Google's hardware model, either circuit runs in approximately 9 to 12 minutes per key on fewer than 500,000 physical qubits. This is a 20x reduction in physical qubit requirements versus 2019 estimates.

Q: Does this mean Bitcoin is about to be broken?

A: No. The paper defines what a machine would need to achieve, not that such a machine exists. The current hardware gap is 10x to 200x depending on architecture. The significance is that the engineering target is now specific enough that hardware teams can measure progress against it, and it is shrinking faster than expected.

Q: What is Shor's algorithm?

A: Shor's algorithm is a quantum computing method published in 1994 that efficiently solves the discrete logarithm problem underpinning Bitcoin's ECDSA signatures. A classical computer solving this problem would need billions of years. A quantum computer with sufficient qubits running Shor's algorithm could do it in minutes.

Reference Links