The Number Everyone Cited Is Now Out of Date
For the past several years, the most widely cited figure for breaking Bitcoin's elliptic curve cryptography was roughly 317 million physical qubits. That number comes from a 2022 paper by Mark Webber and colleagues at the University of Sussex, which calculated the quantum resources needed to attack secp256k1 within a ten-minute Bitcoin transaction window using surface code error correction.
In October 2026, researchers at Alice & Bob published an analysis showing the actual requirement is closer to 29,588 physical qubits. That is a reduction of more than 99.9 percent. Understanding why that number changed so dramatically is critical for anyone assessing blockchain security timelines.
Why the Earlier Figure Was So High
The 317 million figure was not wrong given its assumptions. It calculated how many physical qubits would be needed under the error correction parameters of early-era surface code implementations, running Shor's algorithm against a 256-bit elliptic curve key within a strict ten-minute window.
Two assumptions drove that number up dramatically:
- Physical error rate: The 2022 paper assumed a physical qubit error rate of roughly 10^-3. Modern superconducting qubits from IBM, Google, and others now routinely achieve 10^-4 or better, reducing the number of physical qubits needed per logical qubit significantly.
- Time constraint: Attacking a Bitcoin transaction within the ten-minute confirmation window is an extremely demanding target. A more realistic adversarial scenario involves attacking exposed public keys — addresses that have already signed a transaction — where there is no such time limit. Removing that constraint allows the attacker to run the computation over hours or days, dramatically reducing the required parallelism.
What Alice & Bob's October 2026 Analysis Changed
The Alice & Bob paper applied three advances that substantially reduced the qubit count:
1. Improved Surface Code Overhead
Surface code error correction requires many physical qubits to protect each logical qubit. The ratio depends on the physical error rate and the desired logical error rate. At a physical error rate of 10^-4, the overhead per logical qubit drops from roughly 1,000:1 to around 200:1 or less, depending on the code distance chosen.
2. Magic-State Distillation Efficiency
Shor's algorithm requires non-Clifford gates, which surface codes cannot run natively. These gates are implemented via magic-state distillation, a resource-intensive subroutine. Recent improvements to distillation protocols, including those by Gidney and Ekera, have cut the magic-state overhead by over an order of magnitude compared to earlier estimates.
3. The Regev Algorithm Refinements
The Regev algorithm, introduced in 2023 as a quantum factoring improvement, reduces the circuit depth for elliptic curve discrete logarithm problems. Alice & Bob applied subsequent refinements to this approach that further compress the space-time volume needed for the attack.
Combining these three advances yields a resource estimate of approximately 29,588 physical qubits to factor a 256-bit elliptic curve key without a strict time constraint.
Comparison of Published Estimates
| Paper / Source | Year | Physical Qubits Required | Key Assumptions |
|---|---|---|---|
| Webber et al. (Sussex) | 2022 | 317 million | 10-min window, error rate 10^-3, early surface code |
| Banegas et al. | 2021 | ~2,330 logical qubits | No time constraint, logical qubit count only |
| Gidney & Ekera | 2021 | ~4,000 logical qubits | RSA-2048, improved distillation protocols |
| Alice & Bob | 2026 | ~29,588 physical qubits | No time constraint, error rate 10^-4, modern surface code + Regev refinements |
The table illustrates that the physical qubit count is not a fixed property of the problem but a function of hardware quality and algorithmic efficiency. As hardware improves and algorithms are refined, the count falls.
What This Means for Bitcoin's Exposed Addresses
Bitcoin addresses fall into several categories with different quantum exposure profiles:
- P2PK addresses (Pay-to-Public-Key): The public key is directly on-chain. These are fully exposed today. Roughly 1.7 million BTC sits in P2PK addresses, many from the early Satoshi era.
- P2PKH addresses that have spent: Once a P2PKH address signs a transaction, its public key is revealed in the witness data. Any address that has previously sent funds has an exposed public key. Estimates suggest this covers a substantial fraction of all circulating BTC.
- P2PKH addresses that have never spent: These reveal only the hash of the public key. Attacking these requires first breaking HASH160 (SHA256 + RIPEMD160), which is a Grover-class problem requiring far more quantum resources and a different attack model.
- Taproot / P2TR: Uses Schnorr signatures over secp256k1. Provides no additional quantum resistance. Public key is still exposed on spend.
The practical implication is that the most liquid and actively-traded Bitcoin addresses are precisely the ones with already-exposed public keys, making them the highest-priority targets once a capable quantum computer is available.
Does 29,588 Qubits Exist Today?
No. IBM's current largest processor is in the range of 1,000+ physical qubits, but with error rates that remain too high for fault-tolerant computation at the scale required. The 29,588 figure assumes physical qubit quality at approximately 10^-4 error rate operating within a surface code. Current best-in-class physical error rates are approaching this threshold on individual qubits but have not been demonstrated at the necessary scale in a fully integrated processor.
However, the trajectory matters. IBM's roadmap targets fully error-corrected logical qubits at useful scale within this decade. PsiQuantum's silicon photonics approach aims for fault-tolerant operation at CMOS manufacturing scale. Google's Willow chip demonstrated below-threshold error correction in late 2024.
The relevant question is no longer "can a quantum computer break Bitcoin?" but "when will one be able to?" And October 2026's revised estimates move that question significantly closer to the present.
Implications for Blockchain Security Architecture
Any blockchain relying on secp256k1 ECDSA for transaction signing must now treat quantum migration as a near-term engineering problem, not a theoretical future concern. The 29,588-qubit threshold is within plausible reach of current hardware roadmaps on a five-to-ten year horizon.
For a detailed technical treatment of the full qubit requirement analysis, including logical qubit counts, code distances, and timeline projections, see our guide: How Many Qubits to Break Bitcoin's secp256k1.
QuanChain was built from genesis with ML-DSA (CRYSTALS-Dilithium) and SLH-DSA signatures, replacing secp256k1 entirely. No public key material is exposed on-chain, eliminating the attack surface that makes exposed Bitcoin addresses vulnerable. The prior analysis in our original qubit estimate post used the 2022 figures and should be read in context of this update.
What Should Crypto Holders Do Now?
Three practical steps apply regardless of timeline uncertainty:
- Audit address exposure. If you have BTC in addresses that have previously sent transactions, your public key is already on-chain. The cost of moving to a fresh address today is a transaction fee. The cost of not doing so could be your entire balance.
- Monitor the hardware trajectory. IBM, Google, PsiQuantum, and QuEra publish regular updates on qubit counts and error rates. When physical qubit counts at 10^-4 error rates cross the 30,000-qubit threshold in an integrated system, the threat becomes executable.
- Evaluate quantum-native alternatives. For new infrastructure, blockchains built with post-quantum signatures from the start avoid the migration problem entirely.
