Google Quantum AI Demonstrates 20-Fold Reduction in Qubits Needed to Break Elliptic Curve Cryptography, Accelerating Post-Quantum Migration Timeline
A Google Quantum AI whitepaper shows fewer than 500,000 qubits could break elliptic curve cryptography in minutes, a 20-fold improvement over prior estimates that accelerates the post-quantum migration timeline.
The Paper
Google Quantum AI published a whitepaper on March 30 presenting optimized quantum circuits for solving the 256-bit elliptic curve discrete logarithm problem (ECDLP-256), the mathematical foundation of the digital signatures used by Bitcoin, Ethereum, and most modern cryptographic systems. The research, authored by Ryan Babbush, Director of Research for Quantum Algorithms, and Hartmut Neven, VP of Engineering at Google Quantum AI, describes two circuit implementations of Shor’s algorithm with dramatically reduced resource requirements.
The first circuit uses fewer than 1,200 logical qubits and approximately 90 million Toffoli gates. The second trades qubit count for gate efficiency, requiring fewer than 1,450 logical qubits and roughly 70 million Toffoli gates. Both can be executed on a superconducting quantum processor with fewer than 500,000 physical qubits in a matter of minutes, according to the paper.
This represents an approximately 20-fold reduction in the number of physical qubits compared to previous best estimates. The most widely cited prior benchmark, from a 2023 paper by Litinski, placed the requirement at roughly 9 million physical qubits.
Three Papers in Three Months
The Google result is the third major downward revision of quantum resource estimates in under a year, a trend that has prompted researchers to describe the quantum threat timeline as accelerating significantly.
In May 2025, Craig Gidney of Google Quantum AI demonstrated that RSA-2048 could be broken with fewer than 1 million physical qubits, down from a 2019 estimate of 20 million. That reduction came entirely from algorithmic advances including approximate residue arithmetic and magic state cultivation, requiring no hardware improvements.
In February 2026, Iceberg Quantum published a follow-up showing that quantum low-density parity-check (QLDPC) codes could bring the RSA-2048 figure below 100,000 qubits, though with caveats about qubit connectivity requirements that have not yet been validated on hardware.
The elliptic curve attack described in Google’s March paper requires 70 to 90 million Toffoli gates, compared to approximately 6.5 billion for the RSA attack, making it substantially less computationally expensive at the gate level.
Disclosure Method
The paper is notable for its disclosure approach. Rather than publishing the full optimized circuits, the authors released a zero-knowledge proof that allows other researchers to verify the claimed resource reductions without providing a step-by-step implementation guide. The team engaged with the U.S. government prior to publication.
The paper’s co-authors include Justin Drake of the Ethereum Foundation, who called the result “a monumentous day for quantum computing and cryptography,” and Dan Boneh, a cryptography professor at Stanford University.
Industry and Regulatory Context
No quantum computer with 500,000 physical qubits exists today. Current state-of-the-art processors operate in the range of roughly 1,000 to 1,200 qubits. However, the narrowing gap between theoretical requirements and projected hardware roadmaps has intensified calls for migration to post-quantum cryptographic standards.
Google has set an internal 2029 deadline for transitioning its own systems to post-quantum cryptography. The U.S. National Security Agency’s CNSA 2.0 suite requires quantum-safe systems by January 2027, and NIST finalized its first post-quantum cryptography standards in August 2024. The FBI, NIST, and CISA have designated 2026 the “Year of Quantum Security,” urging organizations to begin cryptographic inventories and pilot deployments of PQC algorithms.
For the cryptocurrency sector specifically, the results underscore the urgency of proposals like Bitcoin’s BIP-360, which would introduce quantum-resistant address formats. One analysis cited in the paper suggests a 41 percent probability that a sufficiently powerful quantum computer could derive a Bitcoin private key before a transaction is confirmed on the network, given Bitcoin’s average 10-minute block time and the paper’s estimated runtime of approximately 9 minutes for the attack.
What Remains Uncertain
The paper’s estimates assume standard hardware capabilities for a fault-tolerant superconducting quantum processor that does not yet exist. The Iceberg Quantum result, while more aggressive in qubit reduction, relies on QLDPC codes with connectivity requirements that go beyond nearest-neighbor qubit grids and have only been validated through simulation. The timeline for when hardware will reach the scale necessary to mount such attacks remains a subject of active debate among researchers.