How Many Qubits to Break Bitcoin ECDSA (secp256k1)?

By SynergyX · Updated September 24, 2026 · Primary sources checked

Rather have it explained? Watch or listen to our Gemini Notebook overview: How Many Qubits to Break Bitcoin? (Google sign-in required).

For the wider question, start with quantum computing and Bitcoin risk. This page owns the numerical comparison: the circuit, hardware and runtime assumptions that make a qubit estimate meaningful.

How many logical qubits are needed to break secp256k1?

Babbush and colleagues’ 2026 research gives two alternatives: fewer than 1,200 logical qubits with fewer than 90 million Toffoli gates, or fewer than 1,450 with fewer than 70 million. These are alternative circuits, not a universal minimum-to-maximum range. A smaller qubit budget can demand more gates.

The September trapped-ion preprint explores a different implementation scenario. Its smaller physical-qubit count comes with a much longer runtime. Compare the complete row rather than combining the smallest number from one study with the fastest runtime from another.

A third 2026 study, by a Caltech and Oratomic team including John Preskill, shows that Shor’s algorithm can run on as few as 10,000 reconfigurable neutral-atom qubits; with 26,000, discrete logarithms on a 256-bit curve take a few days. For the same comparison across RSA, AES and SHA-256, see how many qubits it takes to break RSA, AES and SHA-256.

Use this table: CSV · JSON · Permanent table link. Licensed CC BY 4.0; keep each row’s assumptions when you cite it.

The same estimates, explained in our Gemini Notebook overview, which answers questions from these studies (Google sign-in required).

Qubit estimates for breaking secp256k1 — SynergyX Research,
https://synxcrypto.com/articles/123-how-many-qubits-to-break-bitcoin-secp256k1.php#estimates

What is the difference between logical and physical qubits?

A logical qubit is an encoded computational unit protected by error correction. It is not mathematically perfect: a resource estimate must keep logical failures sufficiently unlikely over the whole computation. Physical qubits are the hardware that supports those encoded states, error correction and other circuit operations.

There is no universal ratio between the two. Error rates, connectivity, code choice, gate speed and the resources used to prepare special states all affect the machine size and runtime. Multiplying a logical-qubit count by an arbitrary fixed number produces a weak comparison. Likewise, a vendor announcing thousands of physical qubits has not demonstrated thousands of useful logical qubits.

How does Shor’s algorithm threaten Bitcoin ECDSA and Schnorr signatures?

Bitcoin uses ECDSA and Taproot Schnorr signatures over secp256k1. Given a public point Q = kG, the elliptic-curve discrete-logarithm problem asks for the private scalar k. A sufficiently capable fault-tolerant quantum implementation of Shor’s algorithm could solve that problem and allow forged authorizations under the recovered key.

Polynomial-time complexity does not by itself mean a particular attack finishes in minutes. Runtime follows from the circuit and hardware assumptions. It also does not mean the attacker obtains all Bitcoin keys from one computation: the target key and the resources spent on recovering it remain part of the threat model.

Bitcoin mining asks a different question. Read Grover search versus Shor attacks for the distinction between finding proof-of-work hashes and recovering transaction-signing keys.

Where does the 2,330 logical qubits figure come from?

Roetteler et al. (2017) provide an upper bound of 9n + 2⌈log₂ n⌉ + 10 qubits for a prime-field elliptic-curve circuit. At n = 256, the expression gives 2,330. The paper evaluates NIST curves; the figure is useful historical context, not a complete secp256k1 hardware benchmark.

Newer secp256k1-specific circuits use fewer logical qubits under their stated constructions. That improvement does not invalidate the older mathematical bound. It means readers should state the curve, circuit, gate count and hardware model when quoting either result.

Which Bitcoin public keys are exposed to a future quantum attack?

Exposure depends on the output and its history. P2PK and Taproot key-path outputs expose public keys directly. Hash-based output forms can hide a key until spending, provided the relevant key or script has not already been revealed elsewhere. Address reuse, disclosed extended public keys and recovery arrangements can change that assessment.

The BIP 360 discussion distinguishes long exposure from short exposure. A long-exposed key gives an attacker time to work before its owner moves the funds. A short-exposure attack must compete with transaction confirmation. Ten minutes is Bitcoin’s target average block interval, not a guaranteed safe transaction window.

A copied public key does not mean coins were stolen. The attacker still needs a capable machine, relevant spending authority and funds that remain exposed. Historical dormant balances are not proof that every corresponding private key is lost. This page therefore does not convert an exposed-balance estimate into a claim of inevitable losses.

Can Bitcoin become quantum resistant?

There are published proposals. As checked on September 21, 2026, BIP 360 and BIP 361 are drafts. BIP 360 proposes P2MR outputs to address long exposure without itself introducing a post-quantum signature algorithm. BIP 361 discusses migration away from vulnerable signature paths and depends on a future post-quantum signature proposal. Neither draft proves network activation.

A migration requires agreement on rules, tested implementations, wallet and exchange support, and decisions about old outputs. Signature size and verification cost matter, but one SPHINCS+ parameter set is not a universal cost for every possible Bitcoin upgrade. The design space includes different schemes and transaction arrangements.

Read the BIP 360 and BIP 361 upgrade guide for the scope and unresolved dependencies. Resource estimates cannot establish when such a migration will happen or whether it will finish before an attack-capable machine exists.

When could a quantum computer break Bitcoin?

No cited resource estimate establishes a date. A machine must deliver the required logical qubits, operation count, error performance and runtime together. A vendor roadmap is an engineering target; a government migration deadline is a policy requirement. Neither is a demonstrated Bitcoin key-recovery capability.

The practical reason to plan early is that cryptographic changes and user migration take time. The useful milestones are validated circuits, measured logical operations at the necessary scale, production protocol support and completed wallet migration. Track those milestones separately from a predicted “Q-day.”

What should a wallet user check?

Start with the signature rules the network accepts. Key storage, transaction authentication and encrypted communications perform different jobs. NIST’s ML-KEM establishes shared secrets; ML-DSA and SLH-DSA are signature standards. Algorithm selection does not independently certify an entire wallet.

SynergyX specifies SPHINCS+-SHAKE-128s signatures and Kyber-768 key encapsulation for SYNX. Check the release, accepted transaction-verification path and recovery process. The signature versus key-exchange guide explains the roles; the coin comparison applies the same evidence questions to multiple networks.