Is Quantum Computing Real? What 2026 Hardware Actually Proves

Is Quantum Computing Real?

Skeptics have questioned quantum computing for decades. They have a point: the field has a long history of promises that outpaced delivery. But in 2024 and 2025, several concrete milestones shifted the debate. The question is no longer whether quantum computers work. It is how fast they are improving and what that means for cryptography.

Yes, quantum computing is real. Google, IBM, and Quantinuum have all demonstrated quantum advantage on specific tasks. No quantum computer can break Bitcoin or RSA today, but NIST has already published post-quantum standards precisely because governments consider the long-term threat credible and the preparation timeline urgent.

What the 2024-2025 Hardware Actually Showed

Google Willow: Below-Threshold Error Correction

In December 2024, Google published results from its Willow processor in Nature. The paper documented something the field had been chasing for years: below-threshold error correction. This means that as Google added more physical qubits to its error-correction code, the logical error rate fell rather than rose.

Earlier systems had the opposite problem. More qubits meant more opportunities for errors to compound. Willow demonstrated for the first time that scaling up can actually improve logical performance. The chip completed a random circuit sampling benchmark in under five minutes. The same computation would take a classical supercomputer an estimated 10 septillion years.

That benchmark does not translate directly to breaking cryptography. Random circuit sampling is a deliberately chosen task that highlights quantum strengths. But below-threshold error correction is a genuine precondition for fault-tolerant quantum computing, which is the regime where cryptographic attacks become feasible. Willow proved that precondition is achievable.

IBM Heron: Low Error Rates at 100+ Qubits

IBM's Heron r2 processor, released in 2024, achieved a two-qubit gate error rate of approximately 0.1 percent. That is a five-fold improvement over IBM's Eagle chip from 2021. Heron uses a fixed-frequency transmon architecture on a heavy-hex connectivity lattice, and its T1 relaxation time reaches roughly 300 microseconds.

For context, running Shor's algorithm on a real encryption key requires millions of fault-tolerant logical operations. Each logical operation requires many physical operations, each of which must succeed. At 0.1 percent two-qubit error rates, running long circuits without error correction still produces garbage output. But IBM's trajectory of improvement is measurable and consistent.

Quantinuum: 94 Logical Qubits in 2025

Quantinuum, the joint venture between Honeywell and Cambridge Quantum, announced 94 error-corrected logical qubits in 2025. Logical qubits are more valuable than physical qubits. Each logical qubit is encoded across many physical qubits specifically to detect and correct errors. Ninety-four logical qubits represent a significant step toward running meaningful fault-tolerant algorithms.

Quantinuum's platform uses trapped-ion technology, which benefits from all-to-all qubit connectivity and lower native gate error rates than superconducting platforms. Its H-Series systems have posted the highest quantum volume numbers of any commercial platform.

Microsoft's Topological Qubit

In February 2025, Microsoft published a paper in Nature describing what it called a topological qubit based on Majorana zero modes in a hybrid semiconductor-superconductor system. Microsoft claims topological qubits are inherently more stable than conventional transmon qubits, potentially reducing the overhead needed for error correction.

The announcement was significant but also contested. Independent verification of topological qubit claims has historically been difficult. Microsoft's approach, if it works at scale, could change the resource requirements for fault-tolerant computation. The scientific community is watching closely.

Common Myths About Quantum Computing

Myth 1: Qubits Are Just Faster Bits

Classical bits are either 0 or 1. Qubits use quantum superposition to exist in a combination of states until measured. But superposition alone does not make computation faster. The power comes from quantum interference, where algorithms are designed so that wrong answers cancel out and correct answers reinforce. Grover's and Shor's algorithms exploit interference in specific ways. Quantum computers are not universally faster. They are faster for a narrow set of problem types.

Myth 2: D-Wave Solved Everything

D-Wave builds quantum annealers, not gate-based quantum computers. Annealers are designed to find low-energy states of optimization problems. They use a process called adiabatic quantum computation. This approach cannot run Shor's algorithm or Grover's algorithm. D-Wave systems cannot break cryptographic keys. They are useful for certain logistics and machine learning optimization tasks, but they are a fundamentally different technology from the gate-based systems that threaten public-key cryptography.

Myth 3: Quantum Computers Already Broke RSA

No quantum computer has broken RSA or any elliptic-curve cryptographic key used in practice. The largest RSA key factored by a quantum computer to date involves numbers with fewer than 50 bits. RSA-2048 uses a 617-digit number. Breaking RSA-2048 with Shor's algorithm requires millions of error-corrected logical qubits running for hours. No system close to that specification exists yet. Estimates from researchers at MIT, Google, and NIST place the arrival of a cryptographically relevant quantum computer somewhere between the early 2030s and the late 2030s, depending on assumptions about error correction overhead.

Myth 4: Quantum Computing Is Just Hype With No Real Progress

This is the skeptic overcorrection. Below-threshold error correction (Google Willow), 94 logical qubits (Quantinuum), and sub-0.1% two-qubit gate error rates (IBM Heron) are measurable, peer-reviewed results. The progress is real. The timeline to cryptographic relevance is genuinely uncertain, but the direction of travel is not.

Quantum Advantage vs. Cryptographically Relevant Quantum Computing

These two terms describe very different things, and conflating them causes most of the confusion in public discussions.

The demonstrated quantum advantages so far involve tasks chosen to be hard for classical computers and easy for quantum systems. Random circuit sampling (Google's benchmark) has no obvious commercial application. It is a proof-of-concept for quantum hardware capability, not a production workload.

For more on this distinction, see our dedicated post on quantum supremacy vs. quantum advantage.

Why NIST Published Post-Quantum Standards Now

In August 2024, NIST finalized three post-quantum cryptography standards: FIPS 203 (ML-KEM, for key encapsulation), FIPS 204 (ML-DSA, for digital signatures), and FIPS 205 (SLH-DSA, for stateless hash-based signatures). A fourth standard is in progress.

NIST does not publish cryptographic standards for threats that are purely hypothetical. The agency began the post-quantum standardization process in 2016, ran eight years of global cryptographic competition and analysis, and selected algorithms based on their resistance to both classical and quantum attacks. The standards exist because government agencies, defense contractors, and financial infrastructure operators need 10-15 years of lead time to migrate legacy systems.

The calculation is straightforward. If a CRQC arrives in 2035, migration processes that require a decade must begin no later than 2025. NIST's 2024 finalization is the formal starting gun for that migration. Read our analysis of how NIST FIPS 204/205/206 affect blockchain security for a detailed breakdown of each standard.

The Harvest Now, Decrypt Later Threat Is Active

The most immediate quantum threat to blockchain users does not require a CRQC to exist today. The harvest now, decrypt later (HNDL) strategy works like this: an adversary records encrypted communications or blockchain transaction data today, stores it cheaply, and decrypts it once a CRQC becomes available.

For blockchain specifically, the attack surface is every public key that has ever appeared in a transaction. Bitcoin and Ethereum permanently record public keys on-chain. Every wallet that has sent a transaction has exposed its public key to the public ledger. That data will exist forever. If a CRQC arrives in 2035, adversaries will have 2035's computing power applied to data that is already collected and stored.

This is why the threat is not theoretical even though no CRQC exists today. For a specific analysis of how many qubits would be needed to execute an attack, see our post on how many qubits it would take to break Bitcoin.

How to Evaluate Quantum Computing Claims Critically

Not all quantum computing announcements are equal. Use these filters when reading coverage of new results.

First, check whether the result is peer-reviewed. Google Willow's below-threshold error correction appeared in Nature. Microsoft's topological qubit results appeared in Nature. Results announced only in press releases without peer review deserve more skepticism.

Second, check whether the benchmark is relevant to cryptography. Random circuit sampling and quantum volume are useful benchmarks for hardware quality. They do not directly translate to cryptographic capability. Look for results that specifically address Shor's algorithm implementation or logical qubit counts with error rates.

Third, check the qubit type. Superconducting qubits (IBM, Google), trapped ions (IonQ, Quantinuum), photonic (PsiQuantum), and topological (Microsoft) all have different error characteristics, connectivity constraints, and scaling challenges. A claim about qubit count from one architecture does not transfer directly to another.

Fourth, distinguish physical qubits from logical qubits. The path from physical qubits to logical qubits involves large overhead ratios. Current estimates suggest that breaking RSA-2048 requires roughly 4,000 logical qubits, but those logical qubits might require anywhere from 1,000 to 10,000 physical qubits each, depending on the error rate of the underlying hardware. At today's error rates, the total physical qubit requirement is in the millions.

What This Means for Blockchain Security Today

The evidence points to a consistent conclusion. Quantum computers are real, advancing measurably, and on a trajectory toward cryptographic relevance within the next 10-20 years. The exact date is unknown. The direction is not.

For blockchain networks, this creates a specific planning challenge. Migrating a live blockchain's cryptographic primitives requires coordination across validators, wallet providers, users, and application developers. That coordination takes years. Bitcoin's Taproot upgrade, a relatively modest change, took years to propose, debate, activate, and see meaningful adoption.

A post-quantum migration is orders of magnitude more complex. Networks that begin planning now, while quantum timelines are still uncertain, have more options. Networks that wait for a CRQC to arrive before beginning will not have time to complete a migration before user funds are at risk.