A fault-tolerant quantum computer with roughly 20,000 physical qubits could crack the elliptic-curve cryptography used by Bitcoin in less than a month, according to a recently published resource estimate by IonQ. The US firm plans to launch such a quantum computer, based on trapped-ion technology, in 2028.
“In 2025, I flagged that the Q-Day time horizon was shifting materially earlier – from the 2030s to the 2020s. Major enterprises and the US government now concur,” says IonQ CEO Niccolo de Masi. “We’re on track to produce our fully fault-tolerant 10,000-physical-qubit system in 2027, with significant further advances in our labs, manufacturing and deployments in 2028.” The roadmap on IonQ’s website indicates the 20,000-qubit mark is to be reached in 2028.
IonQ’s researchers calculate that solving the elliptic-curve discrete logarithm problem for secp256k1 would require 19,397 physical qubits and take 25.7 days per attempt. Secp256k1 is the 256-bit elliptic curve used to generate and verify Bitcoin signatures and is also representative of elliptic-curve cryptography used more broadly for authentication.
The end-to-end resource estimate for this problem is the first to compile the complete computation down to the error correction operations that would actually have to run on a physical quantum computer, says IonQ. “This is the first time anyone has taken a utility-scale quantum algorithm and estimated its cost without approximating away the parts that usually dominate a real machine’s runtime. We compiled every operation down to the actual error-correction primitives our architecture runs,” says Chris Ballance, president of quantum computing at IonQ.
There is, however, a caveat. IonQ currently doesn’t have anything approaching a 20,000-qubit fault-tolerant machine: It’s currently at 256 qubits. Scaling up that quickly could present unforeseen obstacles. If the result holds up, it doesn’t mean all 256-bit encryption would become vulnerable. Secp256k1 is an elliptic-curve signature scheme, and the attack uses Shor’s algorithm to derive a private key from its corresponding public key. Symmetric encryption such as AES-256 isn’t covered by the result and would require a different attack vector.
