Bitcoin, Ethereum and crypto wallets

Also Signal, SSH and WireGuard logins: all use the same 256-bit curves

2028

Needed today19,397 physical qubitsSep 2026 paper · also 835 logical qubits

Since the first estimatedown 85%from 126,133 in Feb 2023

Machine announced20,000 by 2028IonQ, enough for this attack

How many qubits an attack needs, over time

Each dot is a published attack. Lower means an easier attack, so a falling line is bad news.

Physical qubits needed

The real qubits in a machine.

Best today: 19,397, down 85% since Feb 2023

Logical qubits needed

Error-corrected qubits, each made from many physical ones.

Best today: 835, down 64% since Jun 2017

Where you meet it

secp256k1 (ECDSA) Bitcoin, Ethereum and most other blockchains
P-256 (secp256r1) HTTPS, passkeys, many corporate systems
Curve25519, X25519 and Ed25519 SSH keys, Signal, WireGuard, modern HTTPS key exchange, Tor

If it breaks

Bitcoin and Ethereum A broken curve lets an attacker derive the private key from a public key and move the coins. Coins with an exposed public key are at risk, and many sit in old or lost wallets that can never be moved to safe addresses.
Messaging and connections Signal, iMessage, browsers and OpenSSH already add post-quantum key exchange. Signatures and logins on these curves could still be forged.

How much is exposed

about 6.3 million BTC in outputs whose public key is already visible Source
about 2.3 million BTC dormant and unlikely to ever move to safe addresses Source
50 to 65% of all ETH has an exposed key at rest, by one estimate Source

Replacements exist: NIST standardised post-quantum schemes in 2024. The risk is systems that have not switched yet.

Machines big enough

Announced plans from vendors. Not delivered machines.

IonQ

202820,000 physical / 1,600 logical qubitsCould break: 256-bit curves

2029200,000 physical / 8,000 logical qubits

20302 million physical / 80,000 logical qubits

Source

The papers (6)

Newest first. A red change is a new low: how much smaller than the best figure before it.

Date	Paper	Physical qubits	Logical qubits	Run time
Oct 2026	Shor's algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 daysarXiv 2610.37839	29,588	n/a	1.03 hours
Sep 2026	Computing 256-bit elliptic curve discrete logarithms in 26 days on a fault-tolerant trapped-ion quantum computer with 20,000 qubitsarXiv 2609.05625	19,397down 85%	n/a	25.7 days
Jul 2026	Quantum Algorithm for Elliptic Curve Discrete Logarithms with Space-Efficient Point AdditionarXiv 2607.13816	n/a	835down 30%	n/a
Mar 2026	Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and MitigationsarXiv 2603.28846	n/a	1,200down 48%	9 minutes
Feb 2023	Performance Analysis of a Repetition Cat Code Architecture: Computing 256-bit Elliptic Curve Logarithm in 9 Hours with 126133 Cat QubitsarXiv 2302.06639	126,133	n/a	9 hours
Jun 2017	Quantum resource estimates for computing elliptic curve discrete logarithmsarXiv 1706.06752	n/a	2,330	n/a

The paper behind the smallest figure

4 Sep 2026 · arXiv 2609.05625

Computing 256-bit elliptic curve discrete logarithms in 26 days on a fault-tolerant trapped-ion quantum computer with 20,000 qubits

All results and optimizations combined, we conclude that a trapped-ion quantum computer based on our architecture can solve the ECDLP on secp256k1 in approximately 25.7 days using 19,397 physical qubits with an estimated success probability of 63%.

Read the paper