Quantum computing is still far from being able to break elliptic curve cryptography.
TechFlow Selected TechFlow Selected
Quantum computing is still far from being able to break elliptic curve cryptography.
This article breaks down what conditions are actually needed to break ECC and how far we are from that day.
Navigating Web3 tides with focused insightsAuthor: Derrick Cui
Compiled by: TechFlow
TechFlow Editor's Note: Although theoretical advances have reduced the quantum hardware requirements needed to break elliptic curve cryptography from 317 million physical qubits (2022) to 500,000 (2026), the number of qubits current quantum computers can actually run algorithms on is only about 105, still several orders of magnitude away from practical attacks. This article breaks down exactly what conditions are needed to break ECC and how far we are from that day.
Key Points
The table below compares the conditions theoretically required to break ECC (Elliptic Curve Cryptography, used for TLS, Bitcoin, and HTTPS) in a 2026 paper with current actual progress. The conclusion is: we are far from close.
The biggest progress comes from the theoretical level, such as algorithms and error correction designs reducing the required number of operations and qubits from about 317 million physical qubits (2022) to under 500,000 (2026). Hardware has also improved (two-qubit fidelity increased from about 90% in 2005 to over 99.9% today, coherence time extended from about 1 microsecond to about 1 millisecond). But the most critical hardware metric—the number of qubits available in a single machine—has hardly grown: about 105 can run real algorithms, while the required number is about 500,000.
Q-Day (the day quantum computing breaks cryptography) estimates:
Justin Drake believes there is a 10% probability before 2030, and 50% probability before 2032
National Institute of Standards and Technology/National Security Agency set the target to phase out vulnerable cryptography by 2035
Quantum computing has no equivalent to Moore's Law. The required conditions decreased by about 600 times in four years, while machine scale may have only grown 10 times in the past decade. Therefore, it is impossible to know what the real timeline is.
Current Frontier of Quantum Computing Progress
Definitions:
Physical qubit: The total number of qubits in a quantum computer
Logical qubit/Error-corrected qubit: The number of qubits actually available after error correction (the corresponding concept in classical computers is the ratio of information bits to total bits). For example, a distance-5 code in quantum computing means using about 49 physical qubits to store the information of 1 qubit
Non-Clifford gate: Computations performed on qubits that are difficult for classical machines to simulate. Includes T gates
T gate: An operation that applies a 45-degree phase rotation to a single qubit. Inducing a T gate depends on the quantum computer's hardware; for superconducting quantum computers, microwave pulses are used to induce this effect
Magic state: Pre-fabricated, one-time-use qubits where non-Clifford gates are pre-baked. Since non-Clifford gates cannot be directly applied to error-corrected qubits, you apply the gate indirectly by consuming magic states—through entanglement + measurement + correction (a process called gate "teleportation")
Toffoli gate: Acts on 3 qubits (2 control bits, 1 target bit), flipping the target bit only when both control bits are 1. It is constructed from about 7 T gates (4 after optimization) plus Clifford gates. On error-corrected qubits, the only way to apply a Toffoli gate is to consume a magic state
Shor's algorithm: Invented in 1994, as a method for quantum computers to break RSA and ECC (by solving the period finding problem)
Syndrome: The result stream produced by qubits used to detect whether errors have occurred in data qubits ("check qubits")
Distillation: The process of combining many noisy magic states, consuming 15 noisy states to output a much cleaner state
Breaking ECC with Shor's algorithm:
In 2026, a paper introduced new circuit designs and "preprocessing" for Shor's algorithm, requiring less computation to break ECC (this would break Bitcoin, Ethereum, SSH, TLS, HTTPS)
The paper theorized that breaking ECC is possible on a superconducting quantum computer, requiring about 1,200 logical qubits to link about 90 million Toffoli gates without error. At current error correction levels, this means about 500,000 physical qubits and minutes of runtime
Computational Pipeline
Rough process: Place physical qubits on a chip → Bundle many physical qubits into each error-corrected logical qubit → Run algorithm gates on logical qubits, consuming magic states for difficult (non-Clifford) gates → Measure and post-process on a classical computer.
Start with noisy physical qubits
Challenge: Physically fit enough qubits into one machine (control lines, decoding chips, laser beams, wiring, etc.)
Progress: Improvements in algorithm design have reduced requirements from about 317 million qubits (2022) to about 9 million (Litinski 2023) to 500,000 (2026). Caltech trapped 6,100 qubits with optical tweezers in 2025 (trapped them, not computed). IBM's Condor chip can hold 1,121 qubits, but is too noisy to run real algorithms. The largest chip to have run actual algorithms is about 105 (Google Willow, March 2026)
Bundle them into reliable logical qubits through error correction
Challenge: The 2026 paper requires about 90 million Toffoli gates linked sequentially and each must succeed, with a logical error rate per operation below about 1/90,000,000. Actually the target ("North Star") is a logical error rate of about 10⁻⁹ or lower
Progress: In 2024, Google demonstrated that the error rate of 1 logical qubit composed of 101 physical qubits (distance-7) was 2.14 times lower than that of 49 physical qubits (distance-5), which was 2.14 times lower than that of 17 physical qubits (distance-3). This paper proved that errors continue to decrease as physical qubits increase. The error rate for 101 qubits (distance-7) is 1.4×10⁻³ per cycle; about a million times higher
Keep error correction running to keep them alive
Challenge: Decoding becomes harder as the number of qubits increases. Superconducting quantum computers emit a round of syndrome data every about 1 microsecond, and the classical decoder must fully process each round in less than about 1 microsecond, continuously. Decoding must keep up with the number of qubits added to the computer
Progress: Riverlane's local clustering decoder ("Nature Communications", December 2025) is the first hardware (FPGA) decoder to reach under 1 microsecond per round and is adaptive. Google's AlphaQubit 2 (March 2026) performs real-time neural decoding to distance 11 at under 1 microsecond per cycle; simulations indicate one TPU can reach distance 25. Still far from the 500,000 qubit scale
Consume magic states to execute difficult gates
Challenge: Each difficult gate (Toffoli) consumes one magic state, and ECC requires about 90 million. Manufacturing and purifying magic states fast enough is a major throughput bottleneck. A distillation factory is a block of logical qubits + routing channels, idle during computation. At scale, factories typically account for about 2-10% or more of total physical qubits
Progress: Magic state farming (2024) significantly reduced the cost per magic state. QuEra demonstrated logical-level distillation with only 5 logical qubits in 2024
Measure → Classical computer completes mathematical operations
Not a bottleneck. Measuring logical qubits and running classical post-processing (measurement results → period → private key) is well understood and low cost.
Some research frontiers I did not discuss:
Fast clock and slow clock architectures
Modular/multi-chip architectures
Below-threshold error correction codes
Surface codes and qLDPC codes: I did not discuss IBM's progress on qLDPC because they have so far only demonstrated storage qubits (memory), not computation on them
Magic state cost
Magic state routing/compilation
Coherence time
Running storage and computation on qubits
Cryogenic control electronics
Leakage and Related Errors
Bitcoin Risk
There is a lot of panic talk about Bitcoin using ECC being broken. What does breaking ECC actually mean for Bitcoin?
Shor's algorithm allows an attacker to recover your private key k given your public key Q. Once they do this, they become you. They can sign a transaction transferring your coins to themselves, and this is a completely valid transaction.
However, Bitcoin addresses are not your public key, but the hash of your public key (public key goes through SHA-256 then RIPEMD-160). Hashing is a different mathematical operation, and Shor's algorithm cannot break it.
However, to authorize a transaction, you must reveal public key Q, which stays on the chain permanently. So any address that has sent Bitcoin to another address may be compromised. Modern wallets transfer the entire balance to a new address every time Bitcoin is sent, which protects users.
About 6.7 million BTC are already exposed and could be stolen via quantum computing.
Justin Drake also wrote about the risk of private keys being stolen within the 10-minute Bitcoin block time. The papers he listed show this could be done within 9 minutes. This issue is far less severe than losing the already exposed 6.7 million BTC.
The only way to truly solve this problem is to get everyone to switch to quantum-safe keys (the technology already exists), and destroy untransferred Bitcoin after a period of time. Getting the Bitcoin community to agree to this will be a daunting task.
Ethereum Risk
Ethereum uses the same curve (secp256k1) and the same signature scheme (ECDSA) as Bitcoin, so the underlying breaking method is the same: given the public key, Shor's algorithm recovers the private key, and the private key holder is the account owner.
Ethereum has persistent accounts, meaning addresses are reused. This means if quantum computing were usable today, every wallet that has sent a transaction could be taken over.
Replacing ECDSA is simple. The problem is that post-quantum signatures are much larger than ECDSA, meaning nodes must store more memory. This is also why Ethereum is turning to zk while changing signature schemes.
It also requires every user to actively migrate from old keys to new keys. Accounts that people do not transfer must be destroyed so hackers cannot control them.
Technical Explanation
Public key cryptography allows two people to communicate securely on an untrusted network (such as the public internet) without needing to share secrets beforehand.
There are many different protocols (you can think of them as end-user tools suited for specific use cases). For example, Diffie-Hellman key exchange, ECDSA signatures, RSA encryption. Their underlying hard problems are discrete logarithm, EC discrete logarithm, and factorization respectively. The core mathematical bottleneck that classical computers find difficult to solve is periodicity.
The actual mathematical operation quantum computers are capable of is finding periods.
What is ECC
ECC (used for TLS, Bitcoin, and HTTPS) is built on a one-way street. Starting from a public point G on the curve, "jump" k times to reach a new point Q. Jumping forward is fast. But if someone shows you the starting point (G) and the ending point (Q), finding out how many jumps were made is practically impossible.
The number of jumps k is your private key; the endpoint Q is your public key. Everyone can see your start and end points, but only you know the number of steps between them.
The mathematical explanation is:
Elliptic curves are simply sets of points on a finite field satisfying the equation y² = x³ + ax + b
G is the base point (public, fixed by standard). For private key k, the public key is point Q = kG
Calculating Q from k via doubling-and-adding requires O（log k）group operations
Recovering k from (G, Q) is ECDLP (Elliptic Curve Discrete Logarithm Problem), classical methods are trial and error, so very slow
Shor's algorithm solves ECDLP in polynomial time, reducing it to finding a period on the group generated by G
This is an elliptic curve.
Chart showing EC point multiplication on y² ≡ x³ + 7 (mod 17). The curve and base point G are public, and the endpoint Q is also public. The secret is k = 6, the number of jumps from G to Q. Forward calculation (calculating Q = kG) is fast; there are no known classical shortcuts to recover k from G and Q. This example uses mod 17, you can count the jumps—real ECC uses a modulus space of about 2²⁵⁶
How Shor's Algorithm Breaks ECC
Breaking ECC boils down to a seemingly simple function: f(x, y) = xG + yQ, where G is the public generator, and Q is the public key you want to attack. Since Q = kG, this is actually f(x, y) = (x + ky)G.
This brings a consequence: stepping the input by (k, −1) never changes the output, because (x + k) + k(y − 1) = x + ky. So f repeats along parallel diagonals through the (x, y) grid, and the direction of these diagonals encodes k (the private key).
Finding this direction requires two different (x, y) pairs to produce the same output. Classical methods must search for such collisions via brute force.
Quantum computers allow you to:
Evaluate f for all (x, y) pairs at once in superposition, so the entire striped grid exists in the machine simultaneously
But you still cannot observe—measurement collapses to a random point, which tells you nothing
Fourier transform causes everything except the repeating direction to cancel each other out, producing a frequency peak, through which k can be obtained via some classical mathematical operations
Each golden cell is an input pair (x, y) producing the same output point. They repeat at a fixed step—right k, down 1—so the private key is encoded in the direction of the diagonals. (Toy example: k = 2, n = 13. At real scale, the grid has 2²⁵⁶ columns, you can only check one cell at a time, which is why this pattern is invisible classically.)
Let's look at an example: take the curve y² = x³ + 2x + 2 on integers mod 17. (This problem is simple because it is under mod 17. Usually it is under mod 2²⁵⁶) It happens to have n = 19 points, G = (5, 1) generates all points. Suppose my public key is Q = (0, 6). Your task: find k such that Q = kG. (The answer is k = 7, because G, 2G, 3G, ... walk through (5,1), (6,3), (10,6), (3,1), (9,16), (16,13) in sequence, reaching (0,6) at the 7th step.)
Setup. Two counting registers, one for x, one for y, each holding values from 0 to 18. One work register holds curve points. Key difference from factorization: For RSA, the period r is unknown, so registers must be oversized (2n qubits), and peaks are approximate. Here n = 19 is public, so we can perform QFT exactly on mod-19 arithmetic, and peaks are perfectly sharp every time.
Phase 1—Initialization. Reset everything. Set the work register to the identity point O (the curve's "zero").
Phase 2—Superposition. Perform Hadamard-style superposition on the two counting registers. They now hold all 19 × 19 = 361 pairs (x, y) at once.
Phase 3—Point Addition (Entanglement Step). beforehand, classically compute constants 2ʲG and 2ʲQ for each bit position j. Then, controlled by each counting qubit, add the corresponding constant to the work register. After the full sequence, the work register holds xG + yQ, entangled with each (x, y) pair.
The full state is a large entangled sum: sum over all 361 pairs Σ |x⟩|y⟩|xG + yQ⟩. Since Q = 7G, the work register actually holds (x + 7y mod 19)G—only 19 different values. Group by work register value:
All (x, y) where x + 7y ≡ 0 (mod 19) ⊗ |O⟩
All (x, y) where x + 7y ≡ 1 (mod 19) ⊗ |(5, 1)⟩
All (x, y) where x + 7y ≡ 2 (mod 19) ⊗ |(6, 3)⟩
... 19 groups, 19 pairs per group
The secret k = 7 is now encoded in the slope of each group: each group is a diagonal through the (x, y) grid. But you cannot read it directly, because measurement collapses to give a random pair, telling you nothing about the slope.
Phase 4—Inverse QFT + Measurement. Apply inverse QFT to the two counting registers. Amplitudes concentrate on the 19 pairs (u, v) that exactly satisfy v ≡ k·u (mod 19). The Fourier transform converts the slope of the line into a slope in frequency space. Measurement randomly produces one of these 19 pairs.
The grid on the left is the state after Phase 3. All 361 pairs (x, y) exist in superposition, each different work register value collecting their diagonal family. Green and orange are two groups. The grid on the right is the state after inverse QFT. All amplitudes collapse onto the single line v ≡ k·u (mod 19).
Off-chip post-processing:
Measurement (u, v) = (3, 2): k = 2 · 3⁻¹ mod 19 = 2 · 13 = 26 ≡ 7 ✓ (Check: 7G = (0, 6) = Q ✓)
Measurement (u, v) = (5, 16): k = 16 · 5⁻¹ mod 19 = 16 · 4 = 64 ≡ 7 ✓
Measurement (u, v) = (0, 0): No information, re-run any result where u ≠ 0 is valid (18/19 runs).
We care about finding k because k is the private key. You can now send messages, and there is no difference between you and the person whose key was broken.
Types of Quantum Computers
Simply put, qubits can be made in any system where the output probabilistically exists between 1 and 0.
Types of qubits include:
Superconducting circuits (Google, IBM, Rigetti, IQM) based on LC circuits. Basically, this is a circuit that behaves very similarly to an atom ("artificial atom"). Just as electrons exist in quantized energy levels, we can create quantized energy levels for circuit oscillations.
Trapped ions (IonQ, Quantinuum). Take a single atom missing one electron, then use lasers to create a superposition state, then shine another laser and take a photo to capture its state (either glowing or not glowing, two states).
Neutral atoms (QuEra, Pasqal, Atom Computing) Same idea as ions (two internal states of a single atom, read out via imaging), but atoms are not charged, held by optical tweezers.
Photons (PsiQuantum, Xanadu). Single photons have the property of horizontal or vertical polarization (or taking one of two paths).
Silicon spin qubits (Intel, Diraq, Quantum Motion) The property is the spin of an electron; they exist between spin up or spin down.
Exercise for the Reader
As a fun exercise, here is a homework problem from my cryptography class a few years ago and my solution.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
