Researchers mostly at Paris-based Alice & Bob project that a quantum computer of under 30,000 cat qubits could solve secp256k1, the curve behind Bitcoin’s signatures, in about an hour. Their paper, posted on arXiv on 27 October 2026 and on the IACR ePrint archive a day later, is a calculation, not an attack. No such machine exists, the work has not been peer reviewed, and the number rests on a bit-flip performance that the authors themselves place far beyond anything measured so far.
For anyone tracking the bitcoin quantum threat, the arithmetic has still moved. Google’s March 2026 estimate for the same curve was under 500,000 physical qubits, and Alice & Bob’s own 2023 paper needed 126,133 cat qubits and 9 hours. The drop from Google’s number comes from a different kind of qubit, not from a better way of attacking Bitcoin, and that distinction decides how much weight the figure can carry.
The abstract says solving the curve “requires at most 30 000 cat qubits and 1 hour”. The tables in the 128-page paper are more precise: 29,588 cat qubits and 61.8 minutes, the same values given in a company release carried by The Quantum Insider on 29 October. The authors call these upper bounds. They reused operations compiled for RSA instead of tuning a design for the curve, and they say most of those subroutines and the layout could be optimised further. A slower version trims the machine to 28,183 cat qubits and stretches the run to 146 minutes.
Bitcoin is not the paper’s main subject. Its title is about RSA-2048, the encryption that protects much of the web, at 22,593 qubits in 3.14 days, and RSA is the only configuration compiled in full.
What the paper assumes, and why it matters more than the headline
Every resource estimate is a set of conditions followed by a number. Here the conditions open the abstract’s second half.
- An error-correction cycle of 1 microsecond and a reaction time of 10 microseconds.
- Circuit-level phase-flip noise of 5 in 10,000 (p_Z = 5 × 10⁻⁴).
- No bit-flips during the computation, which the abstract equates to a bit-flip time of about 100 years.
The third line carries the most weight. A cat qubit is a superconducting design built to suppress one of the two kinds of quantum error, the bit-flip, in hardware. The other kind, the phase-flip, is then handled by an error-correcting code, here a repetition code or a more compact LDPC code. If bit-flips are rare enough to ignore, the machine needs far fewer qubits. How rare is the whole question. The paper’s review of published experiments cites bit-flip times of tens of seconds, all on a single cat qubit. The company has reported more: PostQuantum wrote in September 2025 that an Alice & Bob blog post described 41 flips over 61 hours, or one every 44 minutes, with a confidence interval of 33 to 60 minutes, again on one qubit.
A bit-flip time of 100 years is about 880,000 times longer than one hour, nearly six orders of magnitude by our arithmetic. An appendix sets a lower bar for the Bitcoin-curve run alone, 16.9 years, because it is much shorter than the RSA job. That is still about 150,000 times one hour, again our calculation, and it would have to hold across tens of thousands of qubits on one chip while they run gates. The authors list those conditions as still to be demonstrated.
The paper does give a fallback. With a bit-flip time of about one hour, and an extra layer of bit-flip correction (a distance-3 code), RSA-2048 costs about 45,000 cat qubits, roughly double, which the authors describe as a rough estimate. They give that relaxed number for RSA only. There is no matching figure for Bitcoin’s curve, so “under 30,000” should be read as the case where bit-flips have already been solved.
Bitcoin quantum estimates side by side: 30,000 against 500,000 qubits
The figures below come from different teams, different hardware and different error models. They do not line up like for like. Google’s numbers come from its whitepaper dated 30 March 2026.
| Estimate | Target | Hardware | Qubits | Time |
|---|---|---|---|---|
| Alice & Bob, February 2023 | 256-bit elliptic curve | Cat qubits | 126,133 | 9 hours |
| Gidney (Google), May 2025 | RSA-2048 | Noisy superconducting qubits | Under 1 million | Under a week |
| Google whitepaper, 30 March 2026 | secp256k1 | Superconducting, surface code | Under 500,000 | 18 or 23 minutes; about 9 to 12 once primed |
| Cain et al., arXiv, 30 March 2026 | P-256 | Neutral atoms | 26,000 | A few days |
| Alice & Bob, October 2026 | secp256k1 | Cat qubits | 29,588 | 61.8 minutes |
| Same paper, space-saving version | secp256k1 | Cat qubits | 28,183 | 146 minutes |
| Same paper, main result | RSA-2048 | Cat qubits | 22,593 | 3.14 days |
| Same paper, trade-off version | RSA-2048 | Cat qubits | 610,530 | 1.25 hours |
| Same paper, 1-hour bit-flip time | RSA-2048 | Cat qubits | About 45,000 | At least 3.14 days |
On the raw numbers, the new estimate uses about 17 times fewer qubits than Google’s for Bitcoin’s curve. It runs about three times longer than Google’s full run and five to seven times longer than the primed one. Against the company’s own 2023 paper it uses about four times fewer qubits and is about nine times faster, under different assumptions. All of that is our arithmetic. The paper’s own comparison is on RSA: 40 times fewer physical qubits than Gidney’s 2025 paper (arXiv 2505.15917), “with different hardware hypotheses”. The LDPC code does part of that work: the repetition-code version in the same paper needs 49,649 qubits for RSA-2048.
The qubit count alone is not a record. A neutral-atom paper posted in March (arXiv 2603.28627) put a curve of the same size at 26,000 physical qubits, with a run time of a few days. What is new here is an hour at that scale, and it depends on a 1-microsecond cycle.
Cat qubits and superconducting surface-code qubits are not the same thing, so a count of one is not a count of the other. A surface-code machine corrects both error types in code. A cat-qubit machine moves part of that job into the physics of each qubit. Fewer qubits does not automatically mean an easier machine to build.
Logical qubits are the fairer yardstick. Google’s circuits need at most 1,200 of them with 90 million Toffoli gates, or 1,450 with 70 million. Alice & Bob’s Bitcoin estimate uses a circuit of 1,462 logical qubits from co-author André Schrottenloher of Inria, so the logical machine is about the same size and the saving sits in the physical qubits behind each one. The company’s roadmap, as PostQuantum described it in 2025, aims for about 100 logical qubits by 2030. The release says hardware progress and falling requirements should meet in the early 2030s, while conceding that substantial engineering challenges remain. That is a company forecast about its own field.
What “one hour” changes for bitcoin at exposed addresses
A quantum attack on a Bitcoin signature needs the public key. From the public key, Shor’s algorithm could in theory work back to the private key; our guide to private and public keys covers the relationship. So what matters is who has already shown their public key, and for how long.
Old pay-to-public-key (P2PK) outputs show it permanently. Taproot (P2TR) outputs do too, according to Google’s whitepaper, even without address reuse. Reused addresses show it after their first spend. Coins at other hashed addresses that have never spent keep it hidden until the owner sends a transaction, when it appears in the mempool, as our explainer on how crypto transactions work describes.
For those two groups, the run time means very different things.
- Against a permanently visible key, a machine of this type, if one were ever built, would face no deadline. The paper itself names P2PK outputs and reused addresses as what its space-saving version would threaten.
- Coins revealed only during a spend are protected by the race to the next block. Bitcoin averages one block every 10 minutes, so a one-hour attack would normally lose. The company’s release makes this point; the paper does not discuss it.
Google’s work is the sharper comparison on the second case. Its whitepaper says a machine primed with the first half of the calculation could finish in about 9 minutes, with a chance of slightly under 41%, under idealised assumptions, of beating the next Bitcoin block. Alice & Bob’s design is smaller but slower, which leaves spends safer against it and does nothing for keys that are already public. The paper does not say whether priming would shorten its hour.
Google counts about 6.9 million BTC with exposed keys
The whitepaper gives several counts, and they measure different things. A little over 1.7 million BTC sits in P2PK scripts. About 2.3 million BTC is dormant and vulnerable across script types, counting keys inactive for at least five years. About 6.9 million BTC is vulnerable across all script types, including coins that still move, and those can be migrated by owners who hold their keys. Dormant coins cannot be fixed that way.
Alice & Bob’s paper says its results push for an immediate move to post-quantum cryptography. The company is building quantum hardware, so it has a stake in the story.
The only praise so far comes from the release
We found no independent assessment of this paper. It went up three days ago, it has not been through peer review, and our searches turned up no outside cryptographer or physicist who has tested it. The people quoted in coverage so far are the ones the release itself chose to quote.
Chief executive Théau Peronnin said “fewer than 23,000 physical cat qubits could be enough to factor RSA-2048 in just three days.” Antoine Joux, a cryptanalyst, called it “an important paper”; the paper’s acknowledgements thank him and André Chailloux for reviewing preliminary versions. Ali El Kaafarani, founder and chief executive of PQShield, said “The post-quantum standards to replace vulnerable cryptography already exist.” Alice & Bob’s newsroom did not list the release when we checked on 30 October, so we have read those quotes only in The Quantum Insider.
The author list does widen the picture. Besides the company’s researchers, it includes affiliations with Inria and the University of Rennes, Paris-Saclay, CEA and CNRS, and the University of Edinburgh. The Bitcoin figures rest on Schrottenloher’s circuit, and the adder is adapted from Gidney’s 2025 estimate.
Two checks would settle most of the open questions. Outside readers can test the bit-flip requirement against what the hardware can do, and they can work out what the Bitcoin figure becomes with a one-hour bit-flip time, the case the paper gives only for RSA.
Where Bitcoin stands on the fix
BIP-360, which proposes a new Pay-to-Merkle-Root output, remains a draft for a soft fork, with a changelog entry dated 24 July 2026 and no activation described. It works like Taproot without the key-path spend, which is meant to guard against long-exposure attacks. The draft says it does not by itself protect against short-exposure attacks, a limit our report on Google’s magic-state result also noted. BIP-361, on phasing out legacy signatures, has no activation date either, according to the same report.
The wider deadline comes from government guidance. According to the release, US and UK advice asks organisations to finish moving to post-quantum cryptography by 2035. Bitcoin has no central party that can impose such a date, and any change would have to go through its usual consensus process.
Google’s whitepaper names ending public-key reuse and limiting key exposure as a first mitigation. A fresh address for each receipt keeps a hashed key off the chain until the moment of spending, though the whitepaper notes that Taproot outputs show a key regardless. No machine can run this attack today, and this estimate is a preprint for hardware that has not been built.
The next thing to watch is how outside cryptographers and hardware physicists read the full paper. Its authors also propose a far smaller benchmark, FFDLP-512, at 6,656 cat qubits and 21 minutes, as a way to validate the whole architecture.