Nobody is close to breaking ECC
What needs to actually happen before Elliptic Curve Cryptography (ECC) is broken?
What needs to actually happen before Elliptic Curve Cryptography (ECC) is broken?
Key Takeaways:
Here’s a summary table comparing what the 2026 paper theorized would be needed to break ECC (elliptic curve cryptography, used in TLS, Bitcoin, and HTTPS) vs where we are right now. TLDR is that we are not even close.
The biggest strides have been in theory, like algorithm and error-correction design cutting the number of operations and qubits needed, from ~317M physical qubits (2022) to under 500K (2026). Hardware has improved too (two-qubit fidelity from ~90% in 2005 to 99.9%+ today, coherence from ~1 μs to ~1 ms). However the hardware number that matters most— usable qubits in one machine — has barely moved: ~105 running a real algorithm versus the ~500K required.
Q-day estimates are:
Justin Drake says 10% by 2030, 50% by 2032
NIST/NSA targets 2035 for deprecating vulnerable crypto
There’s no Moore’s Law equivalent. The requirement has fallen ~600x in four years while machines grew maybe 10x in the last decade. Therefore, it’s impossible to know what the actual timeline is.
Current Frontier of Quantum Computing Progress
Definitions:
Physical qubits: number of qubits in the quantum computer.
Logical qubits/Error-corrected qubit: number of qubits you can actually use after error correction (the classical computer parallel are information bits vs total bits). For example, distance-5 code in quantum means storing 1 qubit of information in ~49 physical qubits.
Non-Clifford gates: computation done onto qubits that is hard for classical machines to simulate. Includes the T gate.
T gate: operation that applies a 45 degree phase rotation on a single qubit. Inducing a T gate depends on the hardware of a quantum computer; for a superconducting quantum computer, you use microwave pulses to induce the effect.
Magic state: a pre-made, disposable qubit with a non-Clifford gate baked into it. Since non-Clifford gates can’t be applied directly to an error-corrected qubit, you consume the magic state to apply that gate indirectly — via entanglement + measurement + a correction (a process called gate “teleportation”).
Toffoli gate: acts on 3 qubits (2 controls, 1 target), flipping the target only if both controls are 1. It’s built from ~7 T gates (4 when optimized) plus Clifford gates. On an error-corrected qubit, the only way to apply one is to consume a magic state.
Shor’s Algorithm: invented in 1994 as a way quantum computers could break RSA and ECC (by solving the problem of period-finding)
Syndrome: the stream of results from the qubits used (”check qubits”) to detect if an error occurred with the data qubits.
Distillation: process of combining many noisy magic states that consumes 15 noisy states to output one much cleaner one.
Breaking ECC with Shor’s:
In 2026, a paper introduced new circuit design and a “priming” of Shor’s algorithm, requiring fewer computations to break ECC (which breaks Bitcoin, Ethereum, SSH, TLS, HTTPS).
The paper theorized that breaking ECC is possible on a superconducting quantum computer with ~1,200 logical qubits chaining ~90M Toffolis gates error-free. At the current state of error-correction, that means ~500K physical qubits and minutes of runtime.
The computation pipeline:
The broad process: put physical qubits on a chip → bundle many physical qubits into each error-corrected logical qubit → run the algorithm’s gates on the logical qubits, consuming magic states for the hard (non-Clifford) ones → measure and post-process classically.
Start with noisy physical qubits
Challenge: Physically getting enough qubits into one machine (control lines, decoding chips, laser beams, wiring, etc).
Progress: Improvements in algorithm design have lowered the requirement from ~317M qubits (2022) to ~9M (Litinski 2023) to 500K (2026). Caltech held 6,100 qubits in place with optical tweezers in 2025 (holding them, not computing). IBM’s Condor chip can hold 1,121 qubits but is too noisy to run real algorithms on. The largest chip that’s run an actual algorithm is ~105 (Google Willow, March 2026)
Bundle them into reliable logical qubits with error correction
Challenge: The 2026 paper needs ~90M Toffolis chained in sequence and every one must succeed, the logical error rate per operation has to sit below ~1/90,000,000. In practice the target (”north star”) is a logical error rate of ~10⁻⁹ or lower.
Progress: In 2024, Google showed that 1 logical qubit made of 101 physical qubits (distance-7) had 2.14x less error than the 49 physical qubit one (distance-5), which had 2.14x less error than the 17 physical qubit one (distance-3). This paper proved that error consistently fell as physical qubits increased. The 101 qubit (distance-7) sits at 1.4×10⁻³ errors per cycle; roughly a million times too error-prone.
Keep error correction running to hold them alive
Challenge: Decoding gets harder the more qubits you have. Superconducting quantum computers emit one round of syndrome data every ~1 μs, and the classical decoder must fully process each round in under that ~1 μs, continuously. Decoding must keep up with the number of qubits added to the computer.
Progress: Riverlane’s Local Clustering Decoder (Nature Comms, Dec 2025) is the first hardware (FPGA) decoder to hit sub-1μs per round with adaptivity. Google’s AlphaQubit 2 (March 2026) does real-time neural decoding under 1μs/cycle to distance 11; simulations suggest one TPU could reach distance 25. Nothing even close to 500K qubit scale.
Burn magic states to do the hard gates
Challenge: Every hard gate (Toffoli) consumes a magic state, and ECC needs ~90M of them. Manufacturing and purifying magic states fast enough is a major throughput bottleneck. A distillation factory is a block of logical qubits + routing channels sitting idle for computation. At scale, factories are typically ~2–10%+ of total physical qubits.
Progress: Magic state cultivation (2024) made each one far cheaper. QuEra demonstrated logical-level distillation in 2024 on just 5 logical qubits.
Measure → classical computer finishes the math
Not a bottleneck. Measuring the logical qubits and running the classical post-processing (measurement outcomes → period → private key) is well understood and cheap.
Some research frontiers I didn’t discuss:
Fast-clock vs slow-clock architectures
Modular / multi-chip architectures
below-threshold error correction codes
Surface codes vs qLDPC codes: I didn’t discuss IBM’s advances with qLDPC because they so far only demonstrated storing qubits (memory), not computing on them.
Magic state cost
Magic state routing/compilation
Coherence times
Running memory vs computation on qubits
Cryogenic control electronics
Leakage and correlated errors
Bitcoin Risk
There’s all this FUD around Bitcoin getting hacked since it uses ECC. What does breaking ECC actually mean for Bitcoin?
Shor’s allows an attacker to recover your private key k if they have your public key Q. Once they do that, they are you. They can sign a transaction moving your coins to themselves, and it’s a perfectly valid transaction.
However, a Bitcoin address is not your public key, it’s a hash of your public key (RIPEMD-160 of SHA-256 of it). Hashing is a different mathematical operation, and Shor’s doesn’t break it.
However, to authorize a transaction, you reveal the public key Q, which is on-chain forever. So any address that has sent Bitcoin to another address could be compromised. Modern wallets move the whole balance to a fresh address every time Bitcoins are sent which protects the user.
There is around 6.7M BTC that is exposed and could get stolen via quantum computing.
Justin Drake also writes about the risk of getting your private key taken within the 10 minute Bitcoin block time. The papers he lists show that it may be possible to do in 9 minutes. That is much less of an issue than losing the 6.7M BTC that is already exposed.
The only way to really solve this is to make everyone switch over to quantum secure keys (the tech already exists) and also burn people’s Bitcoin that hasn’t moved over after some period of time. Getting the Bitcoin community to agree to that would be an undertaking.
Ethereum Risk
Ethereum uses the same curve as Bitcoin (secp256k1) and the same signature scheme (ECDSA), so the underlying break is identical: given the public key, Shor’s recovers the private key, and the holder of the private key is the account.
Ethereum has persistent accounts, meaning addresses are re-used. That means if quantum worked today, every wallet that has ever sent a transaction could be taken control of.
Replacing ECDSA is straightforward. The issue is that post-quantum signatures are much larger than ECDSA, meaning nodes would have to store much more memory. That’s also why Ethereum is moving to zk along with the signature change.
It also requires every user to actively migrate from their old key to new key. Accounts that people don’t move would have to be burned so that hackers can’t take control of them.
Technical Explanation
Public-key cryptography allows two individuals to securely communicate over untrusted networks like the public internet without having to share secrets beforehand.
There are a lotttt of different protocols (which you can think of as end-use tools to fit specific use cases). For example, Diffie-Hellman key exchange, ECDSA signatures, RSA encryption. The underlying hard problems for them are discrete log, EC discrete log, and factoring, respectively. The core math bottleneck that is very hard for classical computers to solve is periodicity.
The actual math that quantum computers are able to do is period-finding.
What is ECC
ECC (used in TLS, Bitcoin, and HTTPS) is built on a one-way street. Start with a public point G on a curve and “hop” it to itself k times to land on a new point Q. Doing the hops forward is fast. But if someone shows you the start (G) and the end (Q), figuring out how many hops it took is effectively impossible.
That hop count k is your private key; the endpoint Q is your public key. Everyone can see where you started and ended, but only you know the number of steps between them.
The mathematical explanation is:
An elliptic curve is just a set of points satisfying an equation like y² = x³ + ax + b over a finite field
G is the base point (public, fixed by the standard). For k as your private key, the public key is the point Q = kG
Computing Q from k takes O(log k) group operations via double-and-add
Recovering k from (G, Q) is ECDLP (elliptic curve discrete log problem), classically done through trial and error, so very slowly
Shor’s algorithm solves ECDLP in polynomial time, reducing it to period-finding over the group generated by G
697
This is an elliptic curve.
Diagram showing EC point multiplication on y² ≡ x³ + 7 (mod 17). The curve and the base point G are public, and so is the endpoint Q. The secret is k = 6, the number of hops from G to Q. Going forward (computing Q = kG) is fast; recovering k from G and Q has no known classical shortcut. This example uses mod 17, where you could just count the hops — real ECC uses a mod space of ~2²⁵⁶
How Shor’s breaks ECC
Breaking ECC boils down to a straightforward-looking function: f(x, y) = xG + yQ, where G is the public generator and Q is the public key you’re attacking. Since Q = kG, this is really f(x, y) = (x + ky)G.
That has a consequence: stepping the inputs by (k, −1) never changes the output, since (x + k) + k(y − 1) = x + ky. So f repeats along parallel diagonal lines through the (x, y) grid, and the direction of those diagonals encodes k (the private key).
Finding that direction requires two different (x, y) pairs that produce the same output. Classically you’d have to hunt for such a collision by brute force.
Quantum computers let you:
Evaluate f over all (x, y) pairs at once in superposition, so the entire striped grid exists in the machine simultaneously
But you still can’t look — measuring collapses to one random point, which tells you nothing
The Fourier transform makes everything except the repeat direction cancel out, producing a frequency peak that (with a bit of classical math) gives you k
Every gold cell is an input pair (x, y) that produces the same output point. They repeat by a fixed step — right k, down 1 — so the private key is encoded in the direction of the diagonals. (Toy example: k = 2, n = 13. At real scale the grid has 2²⁵⁶ columns and you can only inspect one cell at a time, which is why the pattern is invisible classically.)
Example
Let’s look at an example:
Take the curve y² = x³ + 2x + 2 over the integers mod 17. (This problem is easy because it’s in mod17. It is typically over mod 2²⁵⁶) It has exactly n = 19 points, and G = (5, 1) generates all of them. Suppose my public key is Q = (0, 6).
Your job: find k such that Q = kG. (The answer is k = 7, since G, 2G, 3G, ... walks through (5,1), (6,3), (10,6), (3,1), (9,16), (16,13), and lands on (0,6) at the 7th step.)
Setup. Two counting registers, one for x and one for y, each holding values 0 to 18. One work register holding a curve point. A key difference from factoring: with RSA the period r is the unknown, so the registers must be oversized (2n qubits) and the peaks come out approximate. Here n = 19 is public, so we can do the QFT exactly over mod-19 arithmetic and the peaks are perfectly sharp every time.
Stage 1 — Initialize. Reset everything. Set the work register to the identity point O (the curve’s “zero”).
Stage 2 — Superposition. Hadamard-style superposition over both counting registers. They now hold all 19 × 19 = 361 pairs (x, y) at once.
Stage 3 — Point addition (the entangling step). Beforehand, classically compute the constants 2ʲG and 2ʲQ for each bit position j. Then, controlled on each counting qubit, add the corresponding constant into the work register. After the full sequence, the work register holds xG + yQ, entangled with each (x, y) pair.
The full state is one big entangled sum: Σ |x⟩|y⟩|xG + yQ⟩ over all 361 pairs. Since Q = 7G, the work register really holds (x + 7y mod 19)G — only 19 distinct values. Grouping the sum by work-register value:
all (x, y) with x + 7y ≡ 0 (mod 19) ⊗ |O⟩
all (x, y) with x + 7y ≡ 1 (mod 19) ⊗ |(5, 1)⟩
all (x, y) with x + 7y ≡ 2 (mod 19) ⊗ |(6, 3)⟩
... 19 groups of 19 pairs each
The secret k = 7 is now encoded in the slope of each group: every group is a diagonal line through the (x, y) grid. But you can’t read it out directly since measuring would collapse to give one random pair, telling you nothing about the slope.
Stage 4 — Inverse QFT + measure. Apply the inverse QFT to both counting registers. Amplitude concentrates on exactly the 19 pairs (u, v) satisfying v ≡ k·u (mod 19). The Fourier transform turns the slope of the lines into a slope in frequency space. Measurement yields one of those 19 pairs at random.
Left grid is the state after Stage 3. All 361 pairs (x, y) exist in superposition, and each distinct work-register value collects a diagonal family of them. The green and orange are two groups. Right grid is after the inverse QFT. All amplitude collapses onto the single line v ≡ k·u (mod 19).
Off-chip post-processing:
Measure (u, v) = (3, 2): k = 2 · 3⁻¹ mod 19 = 2 · 13 = 26 ≡ 7 ✓ (check: 7G = (0, 6) = Q ✓)
Measure (u, v) = (5, 16): k = 16 · 5⁻¹ mod 19 = 16 · 4 = 64 ≡ 7 ✓
Measure (u, v) = (0, 0): no information, rerun
Any outcome with u ≠ 0 works (18/19 runs).
We care about finding k because k is the private key. You can now send messages with no distinction between you and the person’s key you cracked.
Appendix
Types of quantum computers
The TLDR is that a qubit can be made in any system where the output probabilistically exists between 1 and 0.
The types of qubits are:
Superconducting circuits (Google, IBM, Rigetti, IQM)
Based on LC circuits. Basically, it’s a circuit that acts very similarly to an atom (”artificial atom”). In the same way that the electrons exist in quantized energy levels, we can make quantized energy levels of the oscillations in the circuit.
Trapped ions (IonQ, Quantinuum).
Take a single atom that is missing an electron, then use a laser to create superposition, then shine another laser and take a photo of it to capture its state (either it glows or it doesn’t, the two states).
Neutral atoms (QuEra, Pasqal, Atom Computing)
Same idea as ions (two internal states of a single atom, read out by imaging) but the atom is uncharged and held in an optical tweezer.
Photonic (PsiQuantum, Xanadu).
A single photon has a property of either being polarized horizontally or vertically (or taking one of two paths).
Silicon spin qubits (Intel, Diraq, Quantum Motion)
Property is the electron’s spin; they exist between spin up or spin down.
Exercise to the reader
As a fun exercise for a reader here’s a homework question and my solution in my cryptography class from a couple years ago.
Sources of inspiration
Why I Left Quantum Computing Research - Looking Glass Research
Quantum Computing in 2026: The State of the Race - Richard Conway
The Map of Quantum Computing, Quantum Computing Explained - Domain of Science
BREAKING RSA ENCRYPTION USING SHOR’S ALGORITHM! - physicsmindboggler
Quantum Computers: Explained VISUALLY - Lukas’s Lab
How To Build A Quantum Computer - Lukas’s Lab
How Shor’s Algorithm Factors 314191 - minutephysics
How Quantum Computers Break Encryption | Shor’s Algorithm Explained - minutephysics
The Topsy Turvy World of Quantum Computing - IEEE Spectrum
Some papers to dive deeper:
Fowler et al., Surface codes: Towards practical large-scale quantum computation — https://arxiv.org/abs/1208.0928
Preskill, Quantum Computing in the NISQ era and beyond — https://arxiv.org/abs/1801.00862
Preskill, Quantum computing 40 years later — https://arxiv.org/abs/2106.10522
Devitt, Munro, Nemoto, Quantum Error Correction for Beginners — https://arxiv.org/abs/0905.2794
Gottesman’s thesis, Stabilizer Codes and Quantum Error Correction — https://arxiv.org/abs/quant-ph/9705052
Some blogs to follow to keep up to date with Quantum Computing progress: