How Many Qubits to Break Bitcoin's secp256k1? The 2026 Numbers

TL;DR: Breaking Bitcoin's secp256k1 elliptic curve with Shor's algorithm requires an estimated 317 million physical qubits in one hour, or 13 million physical qubits given a full day of computation, according to the most-cited academic estimate (Webber et al., AVS Quantum Science, 2022). Under current error correction overhead, this corresponds to approximately 4,000 error-corrected logical qubits. IBM's most capable 2026 hardware has fewer than 200 physical qubits at production fidelity. The gap is large, but the trajectory is the variable that matters for long-term planning.

How Many Qubits Does It Take to Break Bitcoin?

Breaking Bitcoin's secp256k1 elliptic curve key using Shor's algorithm requires approximately 317 million physical qubits in one hour, or 13 million physical qubits given one day, according to Webber et al. (2022). Under optimistic surface code error correction assumptions, this maps to roughly 4,000 logical qubits. No quantum computer announced or roadmapped for the 2026 timeframe approaches this scale. Current estimates place a cryptographically relevant attack in the 2030-2035 window at the earliest.

This number — 317 million physical qubits — comes from the most widely cited quantitative analysis of the quantum threat to Bitcoin: "The impact of hardware specifications on reaching quantum advantage in the fault-tolerant regime" by Mark Webber and colleagues, published in AVS Quantum Science in 2022. The paper modeled the resources required to run Shor's algorithm against secp256k1 using surface code error correction, accounting for physical gate error rates, qubit connectivity, and the required circuit depth for the elliptic curve point addition operations that Shor's algorithm performs.

Understanding this number requires understanding the difference between physical qubits and logical qubits, the role of error correction, and why the Bitcoin-specific scenario creates a tighter time constraint than a generic elliptic curve attack.

Physical Qubits vs Logical Qubits: The Key Distinction

Physical qubits are the actual quantum bits in a quantum processor — noisy, fragile, and prone to errors. Logical qubits are error-corrected virtual qubits built from many physical qubits. Shor's algorithm requires logical qubits because the algorithm's circuit depth means physical qubit errors accumulate catastrophically without correction. Under current surface code estimates with physical error rates of ~0.1%, roughly 1,000 physical qubits are required per logical qubit — meaning 4,000 logical qubits requires 4 million physical qubits.

The surface code is the most widely studied quantum error correction scheme for superconducting qubits. It encodes one logical qubit by arranging many physical qubits in a 2D grid, using neighboring physical qubits to detect and correct errors in a given qubit. The ratio of physical to logical qubits depends on the physical error rate: the lower the error rate, the fewer physical qubits needed per logical qubit.

Physical error rate	Physical qubits / logical qubit	Total physical qubits for secp256k1 attack	Attack duration
0.1% (current best)	~1,000	317 million	1 hour
0.1% (current best)	~1,000	13 million	1 day
0.01% (near-term target)	~100	~1.3 million	1 day
0.001% (speculative)	~10	~130,000	1 day

Why Bitcoin's P2PK Addresses Are the Highest-Risk Category

Bitcoin has two primary address types with different quantum exposure profiles. P2PK (Pay to Public Key) addresses embed the full public key directly in the output script, making it permanently visible on-chain regardless of whether the address has ever sent a transaction. P2PKH (Pay to Public Key Hash) addresses only expose the public key when spending. P2PK outputs, common in early Bitcoin history and Satoshi-era blocks, carry the highest quantum risk because attackers do not need to wait for a spend — the public key is already available. An estimated 1.7 million BTC sit in P2PK outputs.

The distinction matters for the attack timeline. For P2PKH and modern address formats (P2WPKH, P2TR), the public key is only exposed when the owner sends a transaction. An attacker who wants to steal funds from a P2WPKH address must wait until the owner broadcasts a spending transaction and then derive the private key faster than the transaction confirms — typically a window of 10 minutes for Bitcoin's block time, potentially seconds for faster chains. This is an extremely tight time constraint that requires the quantum attack itself to complete in under one block interval. It effectively means P2WPKH addresses are safe until quantum hardware can run Shor's algorithm in under ten minutes, which would require significantly more capability than the one-day attack scenario above.

For P2PK outputs, no such time constraint exists. The public key is permanently on-chain, attackable at any time by a quantum computer, without any time pressure. This is why the approximately 1.1 million BTC widely attributed to Satoshi Nakamoto — held predominantly in P2PK coinbase outputs — represents the most acute quantum risk in the Bitcoin ecosystem.

Where Current Quantum Hardware Stands in 2026

IBM's Heron R2 processor (2024) achieves 156 physical qubits with a two-qubit gate error rate of approximately 0.1%. Google's Willow chip (2024) demonstrates 105 qubits with improved error correction scaling. Microsoft's Majorana 1 (February 2025) uses a different architecture based on topological qubits, with claimed advantages in physical-to-logical qubit ratios if the technology is validated at scale.

The gap between current hardware and the secp256k1 attack requirement is approximately three to four orders of magnitude in physical qubit count, and the error correction overhead at current fidelity levels would require far more physical qubits than are feasible in a single cryogenic system. This is not a gap that closes in two or three years. The Webber et al. analysis, even under optimistic assumptions, places the hardware requirement well beyond what any publicly announced roadmap reaches by 2026.

What the Trajectory Means More Than the Current Gap

The argument for taking the quantum threat seriously is not that quantum computers will break Bitcoin in 2026. They will not. The argument is that blockchain migration timelines are long, the harvest-now, decrypt-later threat is already active, and the hardware is advancing on a measurable trajectory.

Physical qubit counts have doubled roughly every 18 months since 2019 — not a universal law, but a consistent trend across IBM, Google, and other organizations. Error rates are improving more slowly but are improving. If both trends continue, the intersection with the secp256k1 attack threshold arrives somewhere in the late 2030s under current academic consensus. That intersection is not 2026, but it is within the design lifetime of systems being built today.

Bitcoin has no post-quantum migration in production. Ethereum's account abstraction migration path exists conceptually but is years from deployment. The time to design and deploy a post-quantum wallet migration mechanism is before the attack is imminent, not after. The Vulnerable Wallets guide covers which wallet types and address formats carry the most acute current exposure, and the Quantum Threat Calculator models how hardware cost trajectories affect individual holdings over time.