{
  "title": "Published quantum resource estimates for breaking secp256k1 / 256-bit elliptic curves",
  "article": "https://synxcrypto.com/articles/123-how-many-qubits-to-break-bitcoin-secp256k1.php#estimates",
  "reviewed": "2026-09-23",
  "license": "CC BY 4.0",
  "scope": "Editorial comparison of published resource estimates. Models of machines that do not exist; assumptions differ by study and are kept in each row.",
  "columns": [
    "Study",
    "Logical Qubits",
    "Physical Qubits",
    "Assumptions",
    "Source URL"
  ],
  "rows": [
    [
      "Häner et al., September 2026 preprint",
      "About 1,450",
      "19,397",
      "Trapped-ion architecture; about 40 million Toffoli gates; 25.7 days; estimated success probability 63%. A modeled machine, not a hardware demonstration.",
      "https://arxiv.org/abs/2609.05625"
    ],
    [
      "Babbush et al., March 2026; revised April",
      "<1,200 or <1,450",
      "<500,000",
      "Two circuits: <90 million or <70 million Toffoli gates respectively. Superconducting model with 10^−3 physical error rate and planar connectivity; runtime in minutes.",
      "https://arxiv.org/abs/2603.28846"
    ],
    [
      "Luo et al., July 2026; revised September",
      "835 (3n + 6⌊log_2 n⌋ + O(1) at n = 256)",
      "Not estimated",
      "Space-efficient point addition and modular inversion: the lowest published logical-qubit count for a 256-bit prime-field curve, paid for with far more Toffoli gates (leading term 1056n^3/log_2 n, about 2.2 billion at n = 256). No runtime or hardware estimate.",
      "https://arxiv.org/abs/2607.13816"
    ],
    [
      "Cain et al. (Caltech, Oratomic), March 2026",
      "Not stated in the abstract",
      "26,000 (neutral atoms)",
      "Reconfigurable neutral-atom architecture with high-rate error-correcting codes; discrete logarithms on the 256-bit P-256 curve in a few days; as few as 10,000 qubits at longer runtimes. A modeled machine, not a hardware demonstration.",
      "https://arxiv.org/abs/2603.28627"
    ],
    [
      "Litinski, 2023",
      "Not stated in the abstract (50 million Toffoli gates per key)",
      "About 6.9 million (6,000 modules of 1,152)",
      "Silicon-photonics-inspired active-volume architecture with non-local connections, 10% threshold and 10-μs code cycle: one key every 10 minutes. With strict 2D-local connectivity, one key every 38 hours.",
      "https://arxiv.org/abs/2306.08585"
    ],
    [
      "Webber et al., 2021",
      "Not stated in the abstract",
      "About 13 million for one day; about 317 million for one hour",
      "Surface code with a 1-μs code cycle, 10-μs reaction time and 10^−3 physical error rate.",
      "https://arxiv.org/abs/2108.12371"
    ],
    [
      "Roetteler et al., 2017",
      "2,330 for n = 256",
      "No hardware count in this circuit bound",
      "Historical prime-field ECDLP bound: 9n + 2⌈log₂ n⌉ + 10. The paper evaluates NIST curves; this is context for 256-bit ECC, not a secp256k1 hardware benchmark.",
      "https://arxiv.org/abs/1706.06752"
    ]
  ]
}