What Google Actually Announced
In December 2024, Google published results from its Willow quantum processor in Nature, and the coverage that followed ranged from accurate to wildly overstated. Headlines suggested Bitcoin was under threat. The reality is more nuanced and, for anyone tracking quantum hardware seriously, more interesting than either the panic or the dismissal.
Willow is a 105-physical-qubit superconducting processor. It did not break Bitcoin. It did not demonstrate anything close to cryptographically relevant computation. What it demonstrated was something technically narrower but strategically significant: below-threshold error correction at scale. Understanding why that specific result matters requires a brief detour into quantum error correction physics.
The Threshold Concept Explained
Quantum computation is inherently noisy. Physical qubits decohere, gate operations introduce errors, and measurement is probabilistic. To run any useful algorithm, including Shor's algorithm against elliptic curve keys, you need logical qubits that behave reliably, not physical qubits that behave noisily. Logical qubits are constructed by encoding one logical qubit across many physical qubits and using error correction codes to detect and correct errors without collapsing the quantum state.
The catch is that error correction only helps if the physical error rate is below a critical value called the fault-tolerance threshold. Above the threshold, adding more physical qubits per logical qubit makes things worse: you are correcting errors with faulty operations, generating more errors than you fix. Below the threshold, adding more physical qubits per logical qubit exponentially suppresses errors. The logical error rate drops as you scale.
This threshold behavior is the central engineering challenge of quantum computing. Many systems have demonstrated error correction. Very few have demonstrated that their error correction actually improves as they scale, which requires operating below the threshold consistently across the whole processor. Willow demonstrated below-threshold operation and showed that logical error rates fell exponentially as the code distance increased. Google showed not just that error correction works on their hardware, but that scaling it up works the way the theory predicts it should.
The 10^25 Benchmark in Context
Google's paper included a benchmark computation that Willow performed in under five minutes, which they characterized as taking a classical supercomputer 10^25 years to complete. This figure traveled widely and generated the most confusion.
The computation in question was a random circuit sampling task: a problem specifically designed to be hard for classical computers and easy for quantum processors. It has no cryptographic relevance. It does not involve factoring large numbers. It does not involve solving discrete logarithms. It is a demonstration of quantum computational advantage on a synthetic benchmark, not evidence that any cryptographic primitive is at risk.
Willow's 105 physical qubits running random circuit sampling says nothing directly about how many physical qubits would be needed to run Shor's algorithm against a 256-bit elliptic curve key. Those are different algorithms with different resource requirements, and the qubit counts involved differ by orders of magnitude.
The Gap Between Willow and Bitcoin-Breaking Hardware
Academic estimates for the logical qubit requirement to run Shor's algorithm against ECDSA-256 in a cryptographically relevant timeframe converge on a range of roughly 4,000 to 10,000 logical qubits. The lower bound of that range comes from optimized algorithm implementations with aggressive parallelism; the upper bound reflects more conservative assumptions about circuit depth and error budget allocation.
Willow operates with physical qubits, not logical qubits. The conversion ratio depends on the error correction code and the physical error rate. At current error rates with surface codes, that overhead is roughly 1,000 physical qubits per logical qubit. Applied to the lower bound estimate of 4,000 logical qubits, you arrive at approximately 4 million physical qubits as a rough requirement for a cryptographic attack using current-generation error correction. Willow has 105. The gap is not a rounding error.
However, this gap is not fixed. Qubit requirement estimates have compressed significantly over the past decade, driven by algorithmic improvements on both the error correction side and the Shor implementation side. The 2012 estimate for breaking RSA-2048 required billions of physical qubits. By 2022, optimized approaches brought that figure down by several orders of magnitude.
How QLDPC Codes Change the Extrapolation
Surface codes, which most near-term error correction research has focused on, require a large physical-to-logical overhead because they only couple neighboring qubits on a two-dimensional grid. Quantum low-density parity-check (QLDPC) codes are a newer family of error correction codes that can achieve much better encoding rates by coupling qubits that are not physically adjacent, using more complex connection graphs.
Theoretical results for QLDPC codes show physical-to-logical overhead ratios that are dramatically better than surface codes, potentially reducing the physical qubit requirement for a cryptographic attack by one to two orders of magnitude. If QLDPC codes are successfully implemented at scale, the 4-million-physical-qubit estimate for breaking ECDSA-256 could compress to tens of thousands of physical qubits. Willow uses surface codes. But the Willow result validates that the underlying physics of error correction scaling works as expected, which is exactly the foundation needed to move to more efficient codes.
IBM's Roadmap in Parallel
IBM has published a multi-year hardware roadmap that provides a useful comparison point. The Heron processor delivered IBM's best qubit quality to date in 2023. The Flamingo architecture introduces modular connectivity between processor chips. Kookaburra aims to combine multiple Flamingo modules into a larger system using quantum communication links.
IBM's approach is explicitly modular: rather than building a single enormous processor, they are building a network of smaller processors connected by quantum interconnects. Google's approach with Willow is monolithic: scale a single die. Both strategies are viable paths toward fault-tolerant hardware, and both are making progress faster than most public commentary has recognized. Neither company is treating fault-tolerant quantum computing as a distant theoretical goal. Both are publishing concrete milestone roadmaps with target dates measured in years, not decades.
Timeline Scenarios: When Does the Gap Close?
Projecting from current hardware trajectories to Bitcoin-breaking capability requires assumptions about error correction progress, algorithmic efficiency gains, and engineering execution. Three scenarios bracket the reasonable range:
- Conservative scenario: Physical error rates improve slowly, QLDPC codes take a decade to implement at scale, and no major algorithmic breakthroughs occur. Bitcoin-breaking hardware arrives in the 2040s or later.
- Moderate scenario: Current progress rates continue. QLDPC codes reduce physical overhead significantly by the early 2030s. Bitcoin-breaking hardware arrives in the 2030 to 2035 range.
- Aggressive scenario: QLDPC codes are implemented at scale within five years. Algorithmic improvements continue to compress logical qubit requirements. A cryptographically relevant system exists by the late 2020s.
The Quantum Threat Calculator lets you model your own exposure against these timeline scenarios based on your specific address type and holding horizon.
Why Willow Matters Even Though It Cannot Break Bitcoin
The strategic significance of Willow is not what it can do today. It is what it proves about the physics. Before Willow, a reasonable skeptic could argue that below-threshold operation at scale was still unproven, that the error correction theory might not translate into hardware results. Willow removed that skeptical position from the table. The scaling physics work. Error rates fall as the theory predicts when you add more physical qubits per logical qubit. That is the prerequisite for everything that follows.
This changes the risk calculus for anyone holding cryptocurrency with exposed public keys. The uncertainty is no longer about whether fault-tolerant quantum computing is physically achievable. The uncertainty is about the timeline for achieving it at the scale needed for cryptographic attacks, and that timeline is compressing.
What Crypto Holders Should Take From This
Willow is a milestone on a road that leads to cryptographically relevant quantum hardware. The destination is not here yet, but the path is validated. For Bitcoin holders, the practical implications depend on address type.
Holders with funds in exposed public key addresses, including P2PK outputs from early Bitcoin history and any address that has ever sent a transaction, are accumulating risk with every passing year of hardware progress. Holders in fresh, never-spent bech32 addresses have more time, but not unlimited time.
The architectural answer to this problem is not address hygiene alone. It is building on infrastructure where public keys are never placed on-chain in the first place. TADEQS implements atomic key rotation on every spend, ensuring no key material persists on-chain for a quantum adversary to harvest. Willow is the clearest public signal yet that the hardware side of this threat is progressing on schedule. The question now is whether the cryptographic infrastructure will keep pace.
