IonQ's 26-day secp256k1 estimate, read through the box

Updated September 2026

IonQ's September 2026 paper is the most detailed public estimate yet of what it would take to break Bitcoin's signature curve: about 20,000 physical qubits running for 26 days to attack a single key, with the whole design compiled down to error correction. It lowers the hardware bar sharply for trapped ions. It does not describe a machine anyone has built, and its speed matters as much as its size.

What IonQ published, and when

On September 4, 2026, fourteen IonQ researchers posted "Computing 256-bit elliptic curve discrete logarithms in 26 days on a fault-tolerant trapped-ion quantum computer with 20,000 qubits" to arXiv. The authors are Thomas Häner, Felix Tripier, Jacob Young, Michael Naehrig, Andrii Maksymov, Safwan Alam, Dmitri Maslov, Matthew Parrott, Yvette de Sereville, Jordan Sullivan, Mark Webster, Nicolas Delfosse, John Gamble and Martin Roetteler. The company followed on September 8 with a blog post calling it the first fully compiled, end-to-end resource estimate for breaking 256-bit elliptic-curve signatures.

The target is secp256k1, the curve behind every Bitcoin signature. The paper names it directly as "the elliptic curve used by blockchain technologies such as Bitcoin." The attack is Shor's algorithm applied to the elliptic curve discrete logarithm problem: given a public key, find the private key behind it.

Two sentences from IonQ's own post belong at the top of any summary. "No machine capable of running this attack exists today." And "No wallet, key, network, or live system was touched." The paper is an architecture and a cost estimate. It is not a demonstration.

The numbers in the paper

The two success figures come from two starting points. The 40.7% figure builds on a rigorous lower bound from Mosca's work; the 63.3% figure builds on Ekerå's post-processing and heuristic estimate. The headline abstract uses 63%. Both already account for the chance that a logical error spoils the run.

The paper also says what more hardware buys. Assuming independent failures, running the same job on five identical machines in parallel raises the chance that at least one succeeds from 63.3% to 99.3%, "without increasing the wall-clock runtime." More machines buy more tries. They do not make a single try faster than about 26 days.

Why the estimate came out smaller

Resource estimates for Shor's algorithm have been falling for years, and the paper sets out the history. For elliptic curves, the first estimate in 2003 needed about 6 billion gates. By 2023 the best published circuits needed about 200 million Toffoli gates. Earlier in 2026, work by Schrottenloher brought it to about 1,462 logical qubits, with around 60 million Toffoli gates for secp256k1 specifically, because the curve's prime has a shape that makes arithmetic cheaper.

IonQ's team starts from Schrottenloher's circuits and trims them from about 58 million to 39 million Toffoli gates. Then it does the part earlier papers mostly assumed away: it compiles every operation onto a specific machine design, called the Walking Cat architecture, which IonQ published in April 2026. (The cat in that name has nothing to do with ours, though it is a nice coincidence.)

The biggest speed-up is in the three-qubit gate the algorithm uses about 39 million times. A native implementation brings each one down to 29.5 milliseconds, which the paper says is 31 times faster than the straightforward construction. A new way of handling lost ions cuts the number of qubits needed in each block by about a third, according to the blog post.

The effect on the hardware bar is large for this kind of machine. The paper says previous estimates for a trapped-ion computer needed between 1.2 million and 9.4 million qubits. It also cites other recent high-level estimates of under 20,000 physical qubits on a neutral-atom design and under 500,000 on a superconducting one. Different platforms, different assumptions, but the direction is the same one this site described in when, if ever, the runway ends: the theory keeps getting cheaper.

Does this mean Bitcoin can be broken now?

No. The paper describes a computer with 19,397 physical qubits running error correction continuously, at an error rate of one in ten thousand operations, for almost four weeks without stopping. It is a blueprint. IonQ says the result aligns with its own public hardware roadmap for about 2028, and that it expects a fully fault-tolerant 10,000-physical-qubit system in 2027. Those are the company's plans, not delivered hardware, and this site does not treat a roadmap as a date.

The authors also expect the numbers to keep moving. Their conclusion says they chose "simple, uniform implementations over exhaustive co-optimization" and expect future work to improve the runtime, the qubit count and the success probability. A reasonable reading is that 26 days and 20,000 qubits are a snapshot of this year's best design, not a floor.

Which boxes a 26-day run can reach

This is where the box does its work. Shor's algorithm needs a public key as input. It cannot start from an address that shows only a hash of the key. So the first question about any quantum estimate is not how big the machine is, but what it can see.

BIP-360 gives the vocabulary. A long exposure attack is made on keys that are already public on the chain, and attackers "will have ample time" for it. A short exposure attack has to finish while a spending transaction is still waiting in the mempool, which, the BIP says, requires faster quantum computers.

A run of 25.7 days is a long exposure machine by any measure. At Bitcoin's ten-minute block target, 25.7 days is roughly 3,700 blocks. The only keys it can realistically attack are ones that stay on the chain, attached to coins, for weeks. In this site's terms, those are the open boxes:

• P2PK outputs, the oldest format, which put the public key on the chain from the start. They were never closed.
• Taproot outputs, whose bc1p address encodes a public key directly, so the box is open on arrival.
• Addresses that were spent from and still hold coins, including every case of address reuse. The first spend published the key; whatever is left behind sits next to it.

The exposure classification draft submitted to the BIPs repository in September calls this group EXPOSED_AT_REST. IonQ's estimate is, in effect, a price tag for attacking one output in that group.

Why a closed box is out of reach

A never-spent 1, 3 or bc1q address publishes a hash of the public key, not the key itself. A quantum computer running Shor's algorithm has nothing to work on until a spend reveals the key. That is the whole point of the closed versus open distinction on this site.

When you do spend, the key appears in the mempool and then in a block. Typical transactions confirm within minutes to a few hours, depending on fees. Against a machine that needs 26 days per attempt, that window is not close. BIP-360 makes the same point in general terms: early quantum computers are "unlikely" to be fast enough for short exposure attacks, which is why protecting keys at rest comes first.

The one caveat is what you leave behind. If the spend sends change back to the same address, or to a script whose key is now public, those coins become an open box that will sit there as long as you leave them. Fresh change addresses keep the rest closed.

What changed, in dates

• April 2026: IonQ publishes its Walking Cat trapped-ion architecture.
• 2026: Schrottenloher's circuits put secp256k1 at about 1,462 logical qubits and roughly 60 million Toffoli gates.
• September 4, 2026: IonQ's paper appears on arXiv: 19,397 physical qubits, 1,457 logical qubits, 39 million Toffoli gates, 25.7 days per attempt.
• September 8, 2026: IonQ's blog post and announcement, stating that no machine capable of the attack exists today.

What to do with this

Nothing urgent, and nothing new. The estimate sharpens an argument this site has made since it launched: the first coins at risk from any real quantum computer are the ones whose keys are already public, and the fix for your own coins is ordinary hygiene.

• Find out which boxes you hold. Paste an address, never a seed, into the wallet checker.
• If coins sit in a reused or already-spent address, plan a calm move to a fresh, never-spent address using the step-by-step guide. There is no deadline in this paper.
• Know what Taproot trades. A bc1p output is open at rest. For long-term storage that is a real difference, even if it is not an emergency.
• Read headline numbers as design costs. "26 days" is the time per attempt on a machine that does not exist, not a countdown.