{
  "dataset": "Qubit estimates for breaking Bitcoin secp256k1 (ECDLP) via Shor's algorithm",
  "version": "2026-08-19",
  "maintainer": "SynergyX Research",
  "source_page": "https://synxcrypto.com/articles/123-how-many-qubits-to-break-bitcoin-secp256k1.php#estimates",
  "license": "CC-BY-4.0",
  "attribution_required": "Qubit estimates for breaking secp256k1 — SynergyX Research, synxcrypto.com",
  "note": "Estimates ordered newest first. The number has only ever been revised downward.",
  "estimates": [
    {"study": "Google Quantum AI (with Ethereum Foundation and Stanford)", "year": 2026, "logical_qubits": "1,200-1,450", "physical_qubits": "<500,000", "runtime": "minutes", "target": "ECDSA-256 (secp256k1) directly"},
    {"study": "Caltech / Oratomic", "year": 2026, "logical_qubits": "comparable", "physical_qubits": "~26,000", "runtime": "~10 days", "target": "secp256k1 on neutral-atom hardware"},
    {"study": "Webber et al.", "year": 2022, "logical_qubits": "2,048", "physical_qubits": "13-317 million", "runtime": "hours-days", "target": "256-bit ECDSA; superconducting vs trapped-ion, 2022-era error rates"},
    {"study": "Gidney & Ekera (2025 revision cut physical to <1 million)", "year": 2021, "logical_qubits": "~2,124", "physical_qubits": "~20 million", "runtime": "~8 hours", "target": "RSA-2048 factoring (reference point)"},
    {"study": "Roetteler et al.", "year": 2017, "logical_qubits": "2,330", "physical_qubits": "not estimated", "runtime": "n/a", "target": "256-bit ECDLP - the stale figure still widely quoted"}
  ],
  "context": {
    "exposed_btc_with_public_keys_onchain": "6,040,000 BTC (Glassnode, May 2026)",
    "hardware_2026": "best public machines ~2,500 physical qubits; none fault-tolerant at scale",
    "roadmaps": "IBM Starling 2029 (~200 logical), IBM Blue Jay 2033 (>2,000 logical); Google targets 2029",
    "post_quantum_standards": "NIST FIPS 203 (ML-KEM/Kyber-768), FIPS 205 (SLH-DSA/SPHINCS+) - both live in SynergyX from genesis"
  }
}