A new quantum estimate targets Bitcoin’s curve, with major caveats

A new preprint estimates that a particular superconducting cat-qubit design could solve the elliptic-curve discrete-log problem on secp256k1 using at most 30,000 physical cat qubits in about one hour. That is a theoretical resource estimate, not a working quantum computer, a demonstrated Bitcoin attack, or a forecast that Bitcoin keys will soon be recoverable.

What the paper actually estimates

The October 28 paper compiles versions of Shor’s algorithm for several cryptographic problems, then gives a detailed layout and schedule for factoring RSA-2048. For secp256k1, the authors reuse operations compiled for that RSA configuration and report an upper estimate of 30,000 cat qubits and one hour. Secp256k1 is the curve used in Bitcoin’s public-key signature system, so the result is relevant to one part of Bitcoin’s security model.

The number is inseparable from the model. The paper assumes a one-microsecond error-correction cycle, a ten-microsecond reaction time, a specified phase-flip noise rate, and no bit-flips. The authors say the no-bit-flip condition corresponds to a bit-flip time of about 100 years in the modeled system. Adding a bit-flip correction layer changes their resource estimate. These are design assumptions in a preprint, not measured performance from a deployed device.

Why a lower estimate is not an imminent attack

Physical-qubit counts do not describe a machine by themselves. Qubit quality, connectivity, error correction, gate operations, control systems and sustained runtime all affect whether a mathematical circuit can be executed. This paper is an attempt to account for some engineering costs within one proposed architecture. It does not report a machine near the estimate, nor does it show a private key recovered from a Bitcoin public key.

CoinDesk’s October 29 report places the estimate beside a separate Google model and discusses possible exposure from public keys. Those comparisons should be treated cautiously: different architectures, definitions and assumptions can make headline qubit counts poor like-for-like measures. The paper itself is the best source for its exact assumptions; the news coverage is context rather than independent validation of the calculation.

What Bitcoin readers can take from it

The immediate takeaway is that cryptographic risk is studied through changing models, not a single countdown. A resource estimate can help researchers compare architectures and inform long-term migration planning, but it cannot establish when a capable machine will exist or what fraction of coins could be affected. This is distinct from our earlier coverage of a standards alliance: that story examined coordination and deployment evidence, while this one explains a new preprint’s assumptions and what its estimate does—and does not—show.

For developers, the useful questions are how future work handles bit-flip errors, whether the circuit and runtime estimates are independently reproduced, what hardware capabilities are demonstrated, and how a network could coordinate any signature migration. Until those questions have stronger evidence, the paper is a research signal to evaluate carefully, not grounds for a claim that Bitcoin is currently breakable. The result is theoretical and does not change Bitcoin’s current protocol or provide investment guidance.