How Many Qubits Do You Need to Break Bitcoin? The Latest Estimates
The short answer
Bitcoin signs transactions with elliptic curve schemes on the secp256k1 curve (ECDSA, and Schnorr signatures in Taproot). The threat is Shor's algorithm (arXiv:quant-ph/9508027), which a large quantum computer could use to work out a private key from a public key. Researchers have published resource estimates for that attack, and they have fallen over time. The latest numbers are about 1,200 to 1,450 logical qubits, or under half a million physical qubits on a fast superconducting design. Nobody has built a machine of that kind. Read will quantum computers break Bitcoin and Solana for the wider picture.
Logical qubits vs physical qubits
A physical qubit is the hardware qubit, which is noisy. A logical qubit is an error corrected qubit built from many physical qubits, and it is what an algorithm like Shor's needs. The ratio depends on how noisy the hardware is and which error correcting code is used. See what a quantum error-correcting code is and logical vs physical qubits.
The estimates so far
| Source | Logical qubits | Other numbers |
|---|---|---|
| Roetteler et al., 2017 | At most 9n + 2 log2(n) + 10, which is 2,330 for n = 256 | At most 448 n^3 log2(n) + 4,090 n^3 Toffoli gates |
| Google Quantum AI whitepaper, 30 March 2026 | At most 1,200, or at most 1,450 | At most 90 million or 70 million Toffoli gates. On superconducting hardware with 0.1% physical error rates, minutes of running time and fewer than half a million physical qubits |
| IonQ authors, ePrint 2026/1916, September 2026 | About 1,450 | About 40 million Toffoli gates, 19,397 physical trapped ion qubits, about 25.7 days, estimated success probability 63% |
The Google authors include Justin Drake of the Ethereum Foundation and Dan Boneh of Stanford. They did not publish the circuits: to avoid handing out an attack recipe they used a zero-knowledge proof to validate the results. They separate "fast-clock" hardware (superconducting, photonic) from "slow-clock" hardware (neutral atom, ion trap). The IonQ paper shows the trade-off: fewer physical qubits, far more time. For more detail see the 2026 elliptic curve estimates.
How does that compare with today's machines?
Today's best chips have on the order of a hundred high quality physical qubits, such as Google's 105 qubit Willow. IBM has published a target of a machine with 200 logical qubits by 2029, which is a plan, not a delivered system. The estimates above need about six times as many logical qubits, running tens of millions of gates. So the answer to "how many qubits to break Bitcoin" is: many more than anyone has built, with error rates that have not been demonstrated at that scale. For the hardware side see IBM's roadmap and Google's Willow.
Which bitcoin would be at risk first?
A signature reveals the public key. Coins at addresses whose public keys are already visible on chain are the easiest targets, because an attacker would not have to race a pending transaction. The Google whitepaper also describes "on-spend" attacks on transactions waiting in the public mempool, which fast hardware could make possible, and it discusses "abandoned" coins whose owners cannot move them. See exposed public keys and Bitcoin proposals BIP 360 and 361.
Does this mean Bitcoin will be broken, and when?
None of these papers gives a date. They are theoretical resource estimates, and they depend on hardware that does not yet exist reaching scale, speed and error rates assumed in each paper. What they do show is that the estimates have been falling: Roetteler's 2,330 logical qubits in 2017 became about 1,200 to 1,450 in 2026, and a separate 2025 result by Craig Gidney cut the estimated cost of breaking 2048 bit RSA to under a million noisy qubits. That trend is why NIST finalised post-quantum standards in 2024 and why chains are studying migration. See what a quantum-resistant cryptocurrency is and blockchain vs quantum computing.
What about QNT?
QUANTUM (QNT) is a token on Solana, which signs with Ed25519, another elliptic curve scheme. It would face the same class of threat as other Solana assets and would depend on Solana's own upgrades. Estimates for secp256k1 do not translate directly to Ed25519, which has its own cost. This is not a prediction about any token's price, and QNT does not perform quantum computation.
Sources and further reading
- Babbush et al., Google Quantum AI (30 March 2026): Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations
- IonQ authors (received 8 September 2026): Computing 256-bit elliptic curve discrete logarithms in 26 days on a fault-tolerant trapped-ion quantum computer with 20,000 qubits (IACR ePrint 2026/1916)
- Roetteler et al. (2017): Quantum resource estimates for computing elliptic curve discrete logarithms (arXiv:1706.06752)
- Shor: Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer (arXiv:quant-ph/9508027)
- Gidney (2025): How to factor 2048 bit RSA integers with less than a million noisy qubits (arXiv:2505.15917)
- Google: Meet Willow, our state-of-the-art quantum chip
- IBM Quantum blog: large scale fault tolerant quantum computing (10 June 2025)
- NIST: first three finalized post-quantum encryption standards (13 August 2024)
Checked 2026-10-12. Estimates are theoretical and company figures are the companies' own claims, so check the primary sources. This is education, not investment or security advice. QUANTUM (QNT) is an independent community token on Solana and is not affiliated with Quantinuum (Nasdaq: QNT) or Quant Network (QNT on Ethereum).
Frequently asked questions
How many qubits are needed to break Bitcoin?
Published estimates say roughly 1,200 to 1,450 logical (error corrected) qubits. Google's March 2026 whitepaper says that could run in minutes on fewer than half a million physical superconducting qubits.
Can any quantum computer break Bitcoin today?
No. Today's best chips have on the order of a hundred high quality physical qubits, and no machine with the needed error corrected scale exists.
What is the difference between logical and physical qubits?
A physical qubit is the noisy hardware qubit. A logical qubit is an error corrected qubit built from many physical qubits.
When will quantum computers break Bitcoin?
Nobody knows, and the estimates do not give a date. They show that the required machine has been getting smaller on paper, which is why post-quantum upgrades are being studied.
Next read
Will Quantum Computers Break Bitcoin and Solana?A calm, factual look at the quantum threat to Bitcoin, Solana and other blockchains, what is safe now, and what could change.Read nextAlso useful: Elliptic Curve vs Quantum: The 2026 Estimates From Google, IonQ Authors and Others | Blockchain vs Quantum Computing: What Is Actually at Risk | What Is a Quantum-Resistant Cryptocurrency? Plain English Guide
Educational content, not financial advice. QUANTUM (QNT) is independent of Quantinuum (Nasdaq: QNT) and Quant Network (QNT on Ethereum). Live chart | Token facts