Q-Day progress: how close are quantum computers to breaking crypto?
Qubits needed versus qubits built — every estimate and every measurement labelled and sourced.
In short
“Q-Day” is the day a quantum computer can derive a private key from a public key that secures real money. That has not happened, and nobody can honestly give it a date. What we can track is two numbers moving towards each other: the qubits that published research says an attack would need, which keeps falling, and the qubits on machines that actually exist, which keeps rising. Today the best published estimate for a 256-bit elliptic-curve key is still roughly 450 times the qubit count of the largest superconducting chip in the hardware table below (IBM Condor) — and qubit count alone is not enough; the qubits also have to be good enough to error-correct.
Qubits needed vs qubits built
- Estimated qubits needed — 256-bit elliptic curve
- Same, under much more optimistic (neutral-atom) assumptions
- Estimated qubits needed — RSA-2048
- Qubits on hardware actually built
Physical qubits, logarithmic scale (each gridline is 10× the one below). Estimates use different hardware assumptions — see the table below before comparing two points.
How to read this honestly
- Estimates are not demonstrations.Every orange point is a paper's calculation of what an attack would need. None has been run at full size.
- Estimates depend on assumptions. Error rate, connectivity, clock speed and how long the attacker is willing to wait all change the qubit count. A machine that may take days needs far fewer qubits than one that must finish in minutes.
- Qubit count is not capability. The hardware points count raw physical qubits. A bigger chip with noisier qubits is not closer to breaking anything; error correction is the real milestone.
- The trend is real. Comparable estimates for 256-bit ECC fell from about 13 million physical qubits (2022) to fewer than 500,000 (2026); for RSA-2048 from about 20 million (2019) to fewer than 1 million (2025). Better algorithms, not just better hardware, close the gap.
Published estimates
EstimatePhysical qubits are what the chart plots. Logical qubits are error-corrected qubits made from many physical ones; they are shown only where the paper states them.
256-bit elliptic curve (Bitcoin / Ethereum signatures)
| Date | Paper | Physical qubits | Logical qubits | Runtime | Assumptions | Source |
|---|---|---|---|---|---|---|
| Jan 2022 | Webber, Elfving, Weidt & Hensinger — The impact of hardware specifications on reaching quantum advantage in the fault tolerant regime (AVS Quantum Science) | ~13,000,000 | — | within ~1 day (317 million qubits to do it within 1 hour) | Surface code, 0.1 % gate error, 1 µs cycle, 10 µs reaction time | paper |
| Jun 2023 | Litinski — How to compute a 256-bit elliptic curve private key with only 50 million Toffoli gates Amortised multi-key setting. Google Quantum AI (2026) puts the same approach at about 9 million physical qubits for a single key. | ~6,912,000 | — | one key per ~10 minutes (amortised over many keys) | Photonic, fusion-based architecture with non-local connections; 6,000 modules × 1,152 physical qubits | paper |
| Mar 2026 | Babbush, Zalcman, Gidney, … , Drake & Boneh (Google Quantum AI) — Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities Two circuits: ≤1,200 logical qubits / ≤90M Toffoli, or ≤1,450 logical qubits / ≤70M Toffoli. The circuits are not published; a zero-knowledge proof attests to them. | < 500,000 | < 1,200 | ~18–23 minutes per key (≈ 9 minutes from a pre-computed “primed” state) | Superconducting, surface code, 0.1 % physical error rate, planar degree-4 connectivity, 10 µs reaction time | paper |
| Mar 2026 | Cain, Xu, King, … , Preskill, Huang & Bluvstein — Shor’s algorithm is possible with as few as 10,000 reconfigurable atomic qubits Not directly comparable with the superconducting estimates: far fewer qubits, but runtimes of days instead of minutes. | ~26,000 | — | “a few days” for P-256 with 26,000 qubits (10,000 is the stated minimum, at a longer runtime) | Neutral-atom hardware with high-rate error-correcting codes — much more optimistic assumptions than the superconducting estimates above | paper |
RSA-2048
| Date | Paper | Physical qubits | Logical qubits | Runtime | Assumptions | Source |
|---|---|---|---|---|---|---|
| Oct 2010 | Jones et al. — Layered architecture for quantum computing Figure as tabulated in Gidney & Ekerå (2019), Table 2. | ~620,000,000 | — | ~10 days | Surface code, 0.1 % gate error, planar connectivity | paper · table |
| Aug 2012 | Fowler, Mariantoni, Martinis & Cleland — Surface codes The widely quoted “a billion qubits” figure; tabulated in Gidney & Ekerå (2019), Table 2. | ~1,000,000,000 | — | ~1.1 days | Surface code, 0.1 % gate error, 1 µs cycle, planar connectivity | paper · table |
| Mar 2017 | O’Gorman & Campbell — Realistic magic-state factories Figure as tabulated in Gidney & Ekerå (2019), Table 2. | ~230,000,000 | — | ~3.7 days | 0.1 % gate error, 10 µs cycle, arbitrary connectivity | paper · table |
| May 2019 | Gidney & Ekerå — How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits | ~20,000,000 | — | ~8 hours | Surface code, 0.1 % gate error, 1 µs cycle, 10 µs reaction time, planar nearest-neighbour | paper |
| May 2025 | Gidney — How to factor 2048 bit RSA integers with less than a million noisy qubits 20× fewer qubits than the 2019 estimate, traded for a longer runtime. | < 1,000,000 | — | < 1 week | Same hardware assumptions as Gidney & Ekerå 2019 (0.1 % error, planar grid, 1 µs cycle) | paper |
Logical qubits for a 256-bit ECC key
EstimateFewer logical qubits usually means more gates (and a longer run), so both columns matter. These are not plotted: logical and physical qubits are different units.
| Date | Paper | Logical qubits | Toffoli gates | Source |
|---|---|---|---|---|
| Jun 2017 | Roetteler, Naehrig, Svore & Lauter — Quantum resource estimates for computing elliptic curve discrete logarithms From the paper’s bound of 9n + 2⌈log₂ n⌉ + 10 qubits at n = 256 (NIST P-256). | < 2,330 | ~1.3 × 10¹¹ | source |
| Mar 2026 | Google Quantum AI (low-gate circuit) | < 1,450 | ≤ 70 million | source |
| Mar 2026 | Google Quantum AI (low-qubit circuit) | < 1,200 | ≤ 90 million | source |
| 2026 | Chevignard, Fouque & Schrottenloher — Reducing the number of qubits in quantum discrete logarithms As reported in the Google Quantum AI whitepaper (Section II.B): fewest logical qubits, but an impractically large gate count. | ~1,100 | > 100 billion | source |
Hardware actually built
Measured| Announced | Device | Physical qubits | What it has shown | Source |
|---|---|---|---|---|
| Oct 2019 | Google Sycamore | 53 | Superconducting processor used for the 2019 “quantum supremacy” sampling experiment. | source |
| Dec 2023 | IBM Condor | 1,121 | First superconducting chip past 1,000 qubits — a scale and yield demonstration, not error-corrected computation. | source |
| Dec 2024 | Google Willow | 105 | Showed “below threshold” error correction: errors fell as the protected logical qubit grew from 3×3 to 7×7. | source |
| Sep 2025 | Caltech 6,100-atom tweezer array | 6,100 | Reported in Nature as the largest qubit array to date: qubits held in superposition and controlled individually, but not yet entangled to run computations. | source |
Largest elliptic-curve keys actually broken
MeasuredKey size in bits, not qubits — so these are not on the chart. A real Bitcoin or Ethereum key is 256 bits; each extra bit doubles the number of possible keys.
| Date | Key size | By | Hardware | Context | Source |
|---|---|---|---|---|---|
| Sep 2025 | 6-bit | Steve Tippeconnic | IBM 133-qubit processor (cloud) | Reported as the first public break of an elliptic-curve key with Shor-type circuits on quantum hardware. | source |
| Apr 2026 | 15-bit | Giancarlo Lelli (Project Eleven Q-Day Prize) | Publicly accessible cloud quantum computer, ~70 qubits | A search space of 32,767 keys — trivial for an ordinary computer. Significant as a demonstration, not as a threat. | source |
Methodology
- Estimates are taken from the paper itself. Older RSA-2048 figures (2010–2017) come from the comparison table in Gidney & Ekerå (2019), which restates them under each paper's own assumptions; those rows link to both.
- “< X” means the paper gives an upper bound (“fewer than” / “at most”); the chart plots X. “~X” means an approximate figure.
- The trend line connects estimates with broadly comparable superconducting or photonic assumptions. The 2026 neutral-atom estimate is shown as a separate hollow point because its assumptions (and multi-day runtime) are very different.
- Hardware points are qubit counts as announced by the builder or reported in the cited publication. They are a selection of milestones, not a complete list of every device.
- Last verified against all sources: . This page is updated by hand when a significant paper or device appears.
Related reading
FAQ about Q-Day progress
Common questions about this page
- How many qubits does it take to break Bitcoin's encryption?
- The most recent published estimate (Google Quantum AI, March 2026) is fewer than 500,000 physical qubits — about 1,200 to 1,450 error-corrected logical qubits — running for roughly 18 to 23 minutes per key on superconducting hardware with 0.1% error rates. A March 2026 preprint argues 10,000 to 26,000 neutral-atom qubits could do it over a few days, under more optimistic hardware assumptions. In 2022 the comparable estimate was about 13 million. These are estimates, not demonstrations.
- How many qubits do today's quantum computers have?
- Announced processors range from about 100 to just over 1,000 physical qubits: Google's Willow has 105, IBM's Condor 1,121. A Caltech research array has held 6,100 neutral-atom qubits, but has not yet entangled them to run computations. Raw qubit count is not the whole story — the qubits also have to be good enough to error-correct.
- What is the largest elliptic-curve key a quantum computer has broken?
- A 15-bit key, recovered in April 2026 on a publicly accessible cloud quantum computer (about 70 qubits) and awarded Project Eleven's Q-Day Prize. The previous public record was 6 bits, in September 2025. Bitcoin and Ethereum use 256-bit keys, and a 15-bit key has only 32,767 possibilities — an ordinary laptop solves it instantly.
- When is Q-Day?
- Nobody knows, and this page does not forecast a date. What can be measured is the trend: published estimates of the qubits needed have fallen by more than an order of magnitude in a few years, while built hardware has grown. Because exposed public keys stay on a blockchain forever, the gap matters before it closes — see harvest now, decrypt later.
- What is the difference between physical and logical qubits?
- A physical qubit is one hardware qubit, and it is noisy. A logical qubit is an error-corrected qubit built from many physical ones. Algorithms are designed in logical qubits; hardware is counted in physical qubits. The chart on this page uses physical qubits on both sides so the two can be compared.