Google Quantum AI said on 15 October 2026 that it has made “magic states”, the costliest ingredient of an error-corrected quantum computer, about 40 times more reliable on its own hardware. The method, called magic state cultivation, is described in a paper in Science and in a Google blog post by researchers Emma Rosenfeld and Craig Gidney. For anyone following quantum computing and Bitcoin, the result matters for one reason: Google’s own estimates of what it would take to break Bitcoin’s signatures already assumed this technique would work. Now it has been shown on a real chip.
It does not put any bitcoin at risk today. Willow, the chip used, has 105 qubits, and Decrypt reports that the experiment needed at most 54 of them. The paper, as Decrypt reads it, puts the magic-state error needed to factor an RSA-2048 key at around one in 10 billion. Decrypt works out that this is roughly a million times cleaner than what Google reached.
The blog post does not mention cryptography or Bitcoin. Its stated next goal is to show cultivation at a larger scale on the way to a useful, error-corrected quantum computer.
Google made T states 40 times cleaner and kept 8% of attempts
“We’ve shown that magic state cultivation works on Google Quantum AI hardware,” the blog post says. The cultivated magic states, also called T states, reached a logical fidelity of 99.99%, which Google describes as a record. The Google Research publication page and the arXiv preprint (2512.13908, first posted in December 2025) give the fidelity as 0.9999(1) and the error reduction as 40-fold against states that were not cultivated.
Cultivation is a filter. The chip grows one good T state inside a small patch of error-correcting code, checks it repeatedly, and throws the attempt away at the first sign of trouble. In the experiment, about 8% of attempts passed every check. More than nine in ten were discarded, which is the price of the clean ones.
The team also used a step it calls “code grafting”: the state was moved from a distance-3 color code into a distance-5 surface code, the kind of code a large machine would use for its main computation. The blog names the hardware as Google’s Willow processor, the 105-qubit superconducting chip unveiled in December 2024, and describes the outcome as “an extraordinary 40-fold reduction in errors relative to un-cultivated states”.
Rosenfeld presented the work at the APS Global Physics Summit on 19 March 2026, seven months before the Science publication. The peer-reviewed paper (DOI 10.1126/science.aee7961) sits behind a paywall, so the qubit count and the code-breaking threshold in this article come from Decrypt’s reading of it.
Why a magic state is worth this much effort
Physical qubits are noisy. An error-corrected computer groups many of them into one reliable “logical” qubit. Most operations on logical qubits are cheap to protect, but one family of gates, needed for algorithms such as Shor’s, requires a pre-made resource called a magic state. Each one is used up when it is consumed, and each one has to be very clean.
Google cites estimates that producing these states could take up to 95% of a quantum computer’s capacity. The classic way to make them is distillation, proposed by Bravyi and Kitaev in 2004, which uses large “factories” of qubits to turn many poor states into a few good ones. Gidney, Shutty and Jones proposed cultivation in September 2024 as a much smaller alternative. Until this week, that proposal had a theory paper and a preprint behind it. It now has a peer-reviewed hardware result.
Google’s team also projects, according to Decrypt, that halving Willow’s hardware noise would bring magic-state errors down to about 2 in 100,000, because those errors shrink with the cube of the noise level.
The figures side by side
| Item | Figure | Source |
|---|---|---|
| Error reduction from cultivation | about 40x | Google blog, 15 Oct 2026; arXiv 2512.13908 |
| Magic (T) state fidelity | 99.99% | Google blog; Google Research |
| Attempts kept | about 8% | Google Research / arXiv |
| Qubits used / chip size | up to 54 of 105 | Decrypt, 15 Oct 2026 |
| Share of capacity for magic states (estimate) | up to 95% | Google blog |
| Magic-state error needed for RSA-2048 | about 1 in 10 billion | The paper, as reported by Decrypt |
| RSA-2048 resources (2025 estimate) | under 1 million noisy qubits, under a week | Gidney, arXiv 2505.15917 |
| RSA-2048 resources (2019 estimate) | 20 million qubits, 8 hours | Gidney and Ekerå |
| Bitcoin secp256k1 key, physical qubits | under 500,000 | Google whitepaper, 30 Mar 2026 |
| Qubits for magic-state production in that attack | about 25,000 | Google whitepaper |
| BTC in P2PK outputs | a little over 1.7 million | Google whitepaper |
Why the result touches Bitcoin’s signature maths
Bitcoin signs transactions with ECDSA and Schnorr on the secp256k1 curve. With a large enough error-corrected quantum computer, Shor’s algorithm could compute a private key from the matching public key. The question has always been how large that machine must be, and Google’s own researchers have spent two years shrinking the answer.
In May 2025, Gidney estimated that RSA-2048, the encryption that protects much of the web, could be factored with “less than a million noisy qubits” in under a week, assuming a 0.1% gate error rate. His 2019 estimate with Ekerå had been 20 million qubits. The abstract of the 2025 paper credits part of the drop to using magic state cultivation instead of distillation.
Then, on 30 March 2026, Google Quantum AI published a whitepaper on elliptic-curve cryptocurrencies. Its authors include Gidney, Neven, Justin Drake of the Ethereum Foundation and Stanford’s Dan Boneh. It puts Shor’s algorithm against a 256-bit secp256k1 key at no more than 1,200 logical qubits and 90 million Toffoli gates, or 1,450 logical qubits and 70 million Toffoli gates. On superconducting hardware with a 0.1% physical error rate, that means fewer than 500,000 physical qubits, about 20 times fewer than earlier estimates. The authors validated their circuits with a zero-knowledge proof rather than publishing the attack itself.
Magic states sit right inside that estimate. To run 70 million Toffoli gates in about nine minutes, the whitepaper says the machine needs half a million T states per second, from roughly 25,000 physical qubits set aside for producing them. That is the job cultivation does. This week’s paper shows the method works at small scale on real hardware, which removes one assumption from the list. It does not shorten the other items on it.
Can a quantum computer break Bitcoin today?
No. Google’s chip has 105 physical qubits, against the hundreds of thousands in the estimates above. According to Decrypt, the paper puts the magic-state error needed for an RSA-2048 run near one in 10 billion, which Decrypt calculates is about a million times cleaner than this week’s result. Google says cultivation still has to be demonstrated at larger scale. No source gives a date for a cryptographically relevant quantum computer, and the next Google chip has no published qubit count or date.
Google does plan around a date for itself. On 25 March 2026, in a blog post by Heather Adkins and Sophie Schmieg, it set 2029 as the deadline to move its own products to post-quantum cryptography. NIST, the US standards body, published its first post-quantum standards (FIPS 203, 204 and 205) in August 2024 and plans to deprecate ECDSA by 2030 and disallow it by 2035, according to ethereum.org. In the EU, a coordinated roadmap from June 2025 asks member states to start the transition by the end of 2026 and to move high-risk systems, finance included, by the end of 2030.
When the machine does arrive, the whitepaper models two kinds of attack. In an at-rest attack, the public key is already on the blockchain and the attacker has years. In an on-spend attack, the attacker sees the public key when a transaction is broadcast and must derive the key before it confirms. The paper puts one key at 18 to 23 minutes, or about 9 to 12 minutes on a machine “primed” in advance, against a 10-minute average Bitcoin block. It gives an idealised on-spend success rate of “slightly less than 41%” for Bitcoin, under 3% for Litecoin with its 2.5-minute blocks, and under 1 in 8,000 for Dogecoin.
Slower machines built on neutral atoms or trapped ions would need between about 14 hours and 12 days per key in the same model, mostly because of magic state production. They could only attack coins whose keys are already public.
About 1.7 million BTC sit in old P2PK outputs with public keys in view
Not every coin is equally exposed. Bitcoin addresses come in several script types, and what matters is whether the public key is already visible on-chain. The whitepaper’s breakdown, explained in more depth in our guide to how crypto wallets and addresses work, looks like this:
- P2PK, bare multisig (P2MS) and Taproot key-path (P2TR) outputs show the public key on-chain, so they are open to at-rest attacks.
- P2PKH, P2WPKH and P2SH hide the key behind a hash until the coins are spent. They are safe at rest if the address is never reused, but the key appears in the mempool when the coins move.
- Every current script type would be exposed to an on-spend attack by a future fast machine.
P2PK scripts, used heavily in Bitcoin’s first years, hold a little over 1.7 million BTC, close to 9% of all bitcoin, the whitepaper says. Most of those coins have not moved since 2009. Coins attributed to Satoshi Nakamoto account for about 1 million BTC behind P2PK. At $82,100 per bitcoin at 07:59 UTC on 16 October, the 1.7 million BTC would be worth about $140 billion. Counting all script types, dormant coins with exposed keys (inactive for at least five years) “may reach 2.3 million BTC”, according to the paper. Taproot outputs moved about 16.8 million BTC in 2025, 21.68% of that year’s transactions.
Wider counts include reused addresses. Glassnode found on 20 May 2026 that 6.04 million BTC, about 30.2% of the supply then issued, had public keys already exposed, CryptoSlate reported. Jameson Lopp estimated the next day that about 2.6 million exposed BTC may never migrate.
Mining is a separate question. Bitcoin’s proof of work relies on SHA-256 hashing, which Shor’s algorithm does not break. Grover’s algorithm offers only a modest speed-up, and the whitepaper has a section on the infeasibility of quantum attacks on proof of work.
Bitcoin developers have two drafts on the table, neither activated
BIP-360, now called Pay-to-Merkle-Root (P2MR), is by Hunter Beast, Ethan Heilman and Isabel Foxen Duke. It got its number on 18 December 2024 as P2QRH, was renamed P2TSH in September 2025 and P2MR in February 2026, according to its changelog, and was merged into the BIPs repository on 11 February 2026. It works like Taproot without the key-path spend, so no public key sits on-chain while coins wait. It would use SegWit version 2, with addresses starting with bc1z. The text spells out the limit: P2MR “does not, by itself, protect against short exposure quantum attacks”, meaning the minutes when a spend sits in the mempool. Post-quantum signatures are left for a later proposal.
BIP-361, “Post Quantum Migration and Legacy Signature Sunset”, goes further. Its authors are Lopp, Christian Papathanasiou, Ian Smith, Joe Ross, Steve Vaile and Pierre-Luc Dallaire-Demers. It got its number on 11 February 2026 and was merged into the BIPs repository on 14 April 2026. Its motivation section reads: “Never before has Bitcoin faced an existential threat to its cryptographic primitives.”
The plan runs in two phases after activation. Phase A starts 160,000 blocks later, about three years, and from then on coins can only be sent to post-quantum outputs. Phase B follows about two years after that. ECDSA and Schnorr spends would then be limited to a quantum-safe rescue protocol that is still to be specified; the draft’s example is proving knowledge of a BIP-32 parent key, which a quantum attacker working from a public key is unlikely to have. For P2PK outputs, the authors write that no rescue protocol is currently believed possible, and they back the Hourglass approach for those coins.
Neither BIP has an activation date, and there is no consensus on either one or on which post-quantum signature scheme Bitcoin would adopt.
The lockout problem: protecting coins from thieves can also freeze their owners
CryptoSlate’s Liam “Akiba” Wright set out the trade-off on 15 October. Keeping today’s rules protects anyone who holds a valid key, which one day could include an attacker with a quantum computer. Sunsetting old signatures reverses that: “owners who cannot migrate or meet rescue conditions could lose access”. For bare P2PK coins, proving ownership any other way is still an unresolved problem.
Other ideas are circulating. Dan Robinson of Paradigm proposed private timestamps, called PACT, on 1 May 2026. Hourglass V2, a February 2026 draft, would limit P2PK spends to one per block and 1 BTC of net spending per block, so a mass sweep could not happen in one go. CryptoSlate’s own example, which it calls explicitly hypothetical, shows why that matters: 50,000 outputs of 50 BTC each, 2.5 million BTC, would fit in about 10 blocks by weight. The Google whitepaper floats a legal route instead, a “digital salvage” framework that would treat recovering dormant P2PK coins as a regulated activity, which it compares to recovering sunken treasure.
Reaction to BIP-361 is split between those who see a necessary defence and those who call it confiscation. Lopp has not hidden his own unease. “I don’t like it myself. I wrote it because I like the alternative even less,” Decrypt quoted him as saying in April.
Ethereum targets core post-quantum upgrades around 2029
Ethereum’s exposure is spread across several layers of the protocol, from user signatures to consensus. The Google whitepaper, co-written by the Ethereum Foundation’s Drake, has a full section on Ethereum accounts, admin keys, code, consensus and data availability. The Ethereum Foundation formed a post-quantum security team in January 2026, and Vitalik Buterin’s February roadmap names four areas:
- Consensus BLS signatures, to be replaced by hash-based leanXMSS with the leanVM aggregator.
- KZG commitments for data availability, to be replaced by STARK or lattice-based commitments.
- ECDSA account signatures, to be handled through account abstraction in EIP-8141, which is being considered for the Hegotá fork.
- Zero-knowledge proofs at the application layer, moving to STARKs.
The “Lean Ethereum” roadmap aims for core post-quantum infrastructure by about 2029, with wider migration after that, according to the ethereum.org quantum-resistance page updated on 8 September 2026. For users, the page says nothing is needed right now, though they will want to move to quantum-safe signatures once wallets support them. Its summary reads: “Quantum computers will eventually threaten the cryptography Ethereum uses today.” Our beginner’s guide to Ethereum explains how its accounts and validators work.
What bitcoin holders can do now
There is no post-quantum address type on Bitcoin mainnet yet, so no migration is possible today. The practical step is an old one: do not reuse addresses, and prefer wallets that only reveal a public key when coins are spent. Coins held at a never-reused P2PKH or P2WPKH address have not shown their public key. If you are newer to how keys and addresses fit together, our beginner’s guide to Bitcoin covers the basics.
The Google whitepaper ends with a direct call: “we urge all vulnerable cryptocurrency communities to join the migration to PQC without delay.” That sentence was written in March, before this week’s result. The new paper gives it a hardware data point, not a deadline.
Next steps and dates to watch
- Google: cultivation at a larger scale and its next chip, with no date given.
- Bitcoin: BIP-360 and BIP-361 discussion continues on the bitcoin-dev mailing list and developer forums, with no activation timeline.
- EU: national post-quantum roadmaps due by the end of 2026, high-risk systems migrated by the end of 2030.
- Google’s own products: post-quantum migration due by 2029; Ethereum core post-quantum target also about 2029.
- NIST: ECDSA deprecated by 2030 and disallowed by 2035.
No Bitcoin Core developer or BIP author had commented on the Science paper itself by the time of writing.