QUANTUM VS BITCOIN TRACKER
How close is a quantum computer to breaking Bitcoin?
Today’s best machines against the latest published estimate for breaking one Bitcoin or Ethereum key. The bars are at 0.24% (physical qubits) and 4.0% (error-corrected qubits).
Every number links to its primary source. Last new entry: October 27, 2026. Data: /api/q-day.json (free to reuse with a link).
The gap is closing from both sides
Machines are growing, and the estimates of what it takes keep falling. The orange line is Bitcoin’s curve; grey squares are RSA, which is a different problem.
Qubit records
| Date | Machine | Physical | Logical (error-corrected) | Quality | Source |
|---|---|---|---|---|---|
| 2025-11-05 | Quantinuum Helios | 98 | 48 48 error-corrected logical qubits (94 error-detected) | 99.921% two-qubit gate fidelity | Source |
| 2025-09-24 | Caltech (Endres lab) Tweezer array of cesium atomsARRAY ONLY | 6,100 | An array of qubits, not yet a computer: no entangling gates were run | 99.98% single-qubit accuracy | Source |
| 2024-12-09 | Google Quantum AI Willow | 105 | 1 One error-corrected memory qubit; errors halved at each step from a 3×3 to a 7×7 grid ("below threshold") | — | Source |
| 2024-11-19 | Microsoft + Atom Computing Neutral-atom system | 48 | 24 24 entangled logical qubits encoded in 48 atoms | — | Source |
| 2023-12-04 | IBM Condor | 1,121 | not stated | — | Source |
| 2023-10-24 | Atom Computing Second-generation neutral-atom system | 1,180 | not stated | — | Source |
What it would take: Bitcoin and Ethereum keys (ECC)
Estimates for solving the elliptic-curve discrete log on a 256-bit curve, the maths behind every Bitcoin and Ethereum key. Hardware assumptions differ, so compare with care.
| Year | Paper | Physical | Logical (about) | Time | Assumptions |
|---|---|---|---|---|---|
| 2026 | Computing 256-bit elliptic curve discrete logarithms in 26 days on a fault-tolerant trapped-ion quantum computer with 20,000 qubits Häner, Tripier, Young, Naehrig, … Gamble, Roetteler (IonQ) · secp256k1 (Bitcoin) | 19,397 | 1,450 | About 25.7 days per try, 63% success | Trapped-ion "Walking Cat" architecture with the authors’ new magic-state factory and loss correction; slow but small |
| 2026 | Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations Babbush, Zalcman, Gidney, Broughton, Khattar, Neven, Bergamaschi, Drake, Boneh · secp256k1 (Bitcoin, Ethereum)BAR TARGET | under 500,000 | 1,200 | Minutes | Superconducting chip with planar connectivity, 10⁻³ physical error; under 1,200 logical qubits and 90 million Toffoli gates (or under 1,450 and 70 million) |
| 2023 | How to compute a 256-bit elliptic curve private key with only 50 million Toffoli gates Litinski · 256-bit elliptic curve | 6.9 million (6,000 modules × 1,152) | — | One key every 10 minutes | Active-volume architecture with non-local connections, 10 µs code cycle; a strictly 2D-local chip needs more qubits and takes 38 hours per key |
| 2022 | The impact of hardware specifications on reaching quantum advantage in the fault tolerant regime Webber, Elfving, Weidt, Hensinger · secp256k1 (Bitcoin) | 13 million | — | 1 day (317 million qubits for 1 hour) | Surface code, 1 µs code cycle, 10⁻³ physical gate error |
| 2017 | Quantum resource estimates for computing elliptic curve discrete logarithms Roetteler, Naehrig, Svore, Lauter · 256-bit prime curve (P-256) | — | 2,330 | — | Logical qubits only, from the paper’s bound of 9n + 2⌈log₂n⌉ + 10 qubits for n = 256; no hardware model |
For comparison: RSA-2048 (not used by Bitcoin)
| Year | Paper | Physical | Logical (about) | Time | Assumptions |
|---|---|---|---|---|---|
| 2025 | How to factor 2048 bit RSA integers with less than a million noisy qubits Gidney · RSA-2048 | under 1 million | — | Under a week | RSA only: says nothing about Bitcoin’s elliptic-curve keys |
| 2019 | How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits Gidney, Ekerå · RSA-2048 | 20 million | — | 8 hours | Superconducting surface code, 10⁻³ physical gate error |
Why error-corrected qubits matter
A physical qubit is a single atom, ion or superconducting circuit. Today’s best ones get roughly one operation in a thousand wrong. Breaking a key takes tens of millions of operations in a row, so a raw machine would fail almost at once, no matter how many qubits it had.
Error correction spreads one logical qubit across many physical ones and keeps checking them, so mistakes are caught and fixed. It only helps once the hardware is good enough (“below threshold”), which Google showed with Willow in December 2024.
That is why this tracker has two bars. A headline about “thousands of qubits” usually means physical qubits. The number that decides Q-Day is how many logical qubits a machine can run, and for how long. Today: 48. Needed: about 1,200.
Timeline
- NIST finalises its migration plan
NIST IR 8547 sets out the move away from quantum-vulnerable algorithms such as ECDSA and RSA. Source
- Bitcoin keys: 19,397 qubits, 26 days
IonQ researchers trade time for size on a trapped-ion design. Source
- Bitcoin keys: under 500,000 qubits
Google Quantum AI, with Ethereum and Stanford researchers, estimates under 1,200 logical / 500,000 physical qubits for secp256k1, running in minutes. Source
- 48 error-corrected logical qubits
Quantinuum’s 98-qubit Helios runs 48 error-corrected logical qubits. Source
- RSA-2048: under a million qubits
Gidney cuts the RSA estimate twentyfold. This is RSA only, not Bitcoin’s keys. Source
- BIP-360 gets its number
The first Bitcoin output-type proposal aimed at quantum attacks is assigned BIP-360. Source
- Google Willow goes below threshold
Adding qubits to an error-corrected qubit now lowers its error rate instead of raising it. Source
- NIST publishes post-quantum standards
FIPS 203 (ML-KEM), 204 (ML-DSA) and 205 (SLH-DSA) are final. Source
- First machine past 1,000 physical qubits
Atom Computing fills 1,180 of 1,225 sites in its neutral-atom array. Source
- Bitcoin key in a day: 13 million qubits
Webber et al. estimate 13 million physical qubits to break a secp256k1 key within a day. Source
- RSA-2048: 20 million noisy qubits
Gidney and Ekerå estimate 8 hours on 20 million physical qubits (RSA, not Bitcoin keys). Source
- First detailed ECC estimate
Microsoft researchers put breaking a 256-bit curve at about 2,330 logical qubits. Source
- Bitcoin starts
Early mining rewards are paid to raw public keys (P2PK), which is why the oldest coins are the most exposed today. Source
Questions
Can a quantum computer break Bitcoin today?
No. The largest working machine has 1,180 physical qubits and the best error-corrected result is 48 logical qubits. The most recent estimates for breaking one Bitcoin key need under 500,000 physical qubits, or about 1,200 logical ones.
What is Q-Day?
The day a quantum computer can derive a private key from a public key for the elliptic curve Bitcoin and Ethereum use (secp256k1), or break RSA. Nobody knows the date; this tracker shows the gap as it stands.
What is the difference between physical and logical qubits?
Physical qubits are the raw hardware and make frequent errors. A logical qubit is an error-corrected qubit built from many physical ones. Breaking a key needs roughly a thousand logical qubits running for millions to billions of steps, which today means hundreds of thousands of physical qubits.
Is the "under a million qubits" figure about Bitcoin?
No. Craig Gidney’s May 2025 estimate of under a million noisy qubits is for factoring RSA-2048. Bitcoin and Ethereum keys use elliptic curves; their own estimates are listed separately here.
Which bitcoins are most at risk?
Coins whose public key is already on the blockchain: old pay-to-public-key outputs (including Satoshi-era coins), addresses that were reused after spending, and Taproot outputs. Coins on a never-spent-from hashed address keep the key hidden until they move.
Why did the estimates fall so fast?
Better algorithms and better error-correction designs. For Bitcoin’s curve the published physical-qubit estimate went from 13 million (2022) to under 500,000 (2026) on similar hardware assumptions, and a trapped-ion design claims about 19,400 qubits if you accept 26 days per key.
How we keep this accurate: every row is checked against the company announcement, paper or BIP before it goes in. New papers and announcements are queued each week and go live only after review.