We Just Published the First Full-Stack Blueprint for Breaking 256-Bit Elliptic-Curve Signatures — Here’s What That Means

At a glance:

• We have published the first fully compiled, end-to-end resource estimate for breaking 256-bit elliptic-curve signatures, mapped down to quantum error-correction primitives.
• The estimate is about 20,000 physical qubits and 26 days per attempt, with a rigorous, provable lower bound on the algorithm’s success probability, rather than a heuristic argument. 
• No wallet, key, network, or live system was touched. No machine capable of running this attack exists today.
• The result aligns with our own public hardware roadmap for 2028, and reinforces why enterprises should accelerate cryptographic discovery and migration now.

Today, we published the first fully compiled, end-to-end resource estimate for breaking 256-bit elliptic curve cryptography (ECC). The estimate is mapped down to quantum error-correction primitives, rather than limited to the algorithm level as in prior public work by others. A fault-tolerant trapped-ion quantum computer with 19,397 physical qubits could complete the underlying computation in 25.7 days per attempt, with a proven lower bound on the success probability. The result demonstrates our full-stack capabilities. Our researchers reduced the resource requirements to break secp256k1 by optimizing the algorithm, compiler, hardware architecture, and error-correction layer in tandem. The sections below describe what the estimate shows and what it does not show.

In 2025, I flagged that the Q-Day time horizon was shifting materially earlier - from the 2030s to the 2020s. Major enterprises and the U.S. government now concur, and the White House issued its executive order on quantum security earlier this summer.
‍
IonQ’s superior full-stack approach provides powerful capabilities as our historic paper today demonstrates in full detail.  We are on track to produce our fully fault tolerant 10,000 physical qubit system in 2027, with significant further advances in both our labs, manufacturing and deployments in 2028.  Our quantum platform spans software, post-quantum cryptography (PQC), and quantum key distribution hardware (QKD).  We are confident IonQ is uniquely positioned to help secure our nation and allies against the cyber risks our adversaries will pose in the quantum era.

— Niccolo de Masi, Chairman and CEO of IonQ

A broader signal for full-stack capability

This paper builds directly on our Walking Cat architecture, published in April 2026 as the world’s first full-stack blueprint for a utility-scale fault-tolerant quantum computing. Here, we apply that blueprint to a challenging cryptography problem. We are taking the same approach to practical applications in chemistry, materials science, optimization, and beyond.  We see this result as a capability milestone first and a security finding second: a three-decade-old problem, tackled end-to-end in one multi-layered study. This is made possible by combining an optimizing compiler, re-usable software libraries, co-designed quantum error correction, and a micro-architecture that allows us to maximally leverage the massive amount of parallelism afforded by the underlying electronically-controlled qubit fabric. That same full-stack methodology is what we are applying across our broad roadmap of quantum applications beyond cryptography.

• 25.7 days: estimated time to solve the 256-bit ECDLP on secp256k1 per attempt
• 19,397 physical qubits: total device footprint
• 1,457 logical qubits and 39 million Toffoli gates at the logical level
• First end-to-end estimate fully mapped to underlying quantum error correction (QEC) codes and error-correction circuits
• A rigorous, provable lower bound on the algorithm’s success probability, rather than a heuristic argument
• Result aligns with the scale of systems on IonQ’s publicly stated hardware roadmap (~2028 timeframe)

Why secp256k1 is a canary in the coalmine, not a target

secp256k1 is the elliptic curve used by Bitcoin for authentication and for signing the blockchain. It is the cryptographic basis that is used to prove you own a bitcoin address and authorize a transaction.  We selected it for this study because it is the most scrutinized, best-understood 256-bit curve in production use today, making it the clearest available benchmark for this class of mathematics. The architecture and methodology developed for this study generalize directly to RSA-2048 and to the ECC curves that secure TLS, VPNs, and government communications. The majority of the real-world exposure this research points to sits in enterprise and government infrastructure, not in any single digital asset.

No wallet, key, network, or live system was touched at any point in this research, and no fault-tolerant quantum computer capable of running this algorithm exists today. This is an architectural and resource-estimation study, not a demonstration. Its contribution is a precise accounting of the requirements for a quantum computer to achieve this feat. 

Throughout this research, we followed responsible disclosure practices prior to publication. We shared advance copies of this work with U.S. government and industry partners, and hosted discussions on its implications.

A full-stack approach to optimize all four layers together

Earlier public estimates optimized one layer of the stack and assumed the rest. We optimized four together:

• The algorithm and arithmetic that express the elliptic-curve discrete-logarithm problem.
• The compiler and logical instruction set that lower, schedule, and route it.
• The error-correction scheme, including code selection and syndrome extraction, that executes many millions of logical operations reliably.
• The physical architecture that runs all of it, including qubit transport and resource allocation.

The result is the first trapped-ion architecture for this problem built on quantum LDPC codes, and it builds directly on the Walking Cat architecture we published in April.

An optimized micro-architecture built for utility-scale applications

Rather than treating the Walking Cat design as fixed, we reshaped it and optimized it around the parts of the calculation that consume the most time and hardware. The result is an architecture that uses 69 memory blocks to hold the protected data, 4 dedicated factories to supply the special quantum states needed for its most demanding logic operations, and a shared pool of measurement qubits that can be moved to the part of the machine where they are needed. The design uses 19,397 physical qubits while sustaining the throughput required for a roughly 26-day run.

The biggest speedup comes from a 3-qubit logic operation (called the Controlled-Controlled-Z gate, or CCZ gate for short) which is used about 39 million times. A straightforward implementation would build each one from a long sequence of smaller steps. We changed this to a different design that allows us to execute a CCZ natively. Together with software tracking of some corrections, this error-correction module makes the operation 31 times faster than the straightforward approach.

Scheduling the full computation at the qubit level

The resource estimate starts from a schedule that the proposed machine could actually execute. Our compiler turns the algorithm into the measurements and error-correction steps the hardware would run, decides where each piece of data must be, and determines which operations can happen at the same time. It also checks that memory, measurement, and the factories that prepare those special states are available when needed, and includes the time required to move qubits between memory blocks.

Part of our compiler is a layout mapper that maps logical level qubits to the error-correction modules and a scheduler that performs the routing to the physical qubits and coordinates the movement of the underlying ions. The scheduler is optimized in such a way that these movements overlap as much as possible with useful work, so routing adds about 5% to the total runtime. 

As an example, for one of the main arithmetic routines, it produced a 674-step schedule, just 5 steps above the fastest sequence allowed by the arithmetic, while still moving data between blocks.

The error-correction model also includes ion loss and leakage. The paper introduces a new way to detect a missing or leaked ion under a model in which a loss may change location but does not cascade through the device. This cuts the number of qubits required in each memory and factory block by one-third. These details make the 26-day result an accurate end-to-end machine performance estimate rather than just a footprint analysis.

Accounting for every operation

Every operation the machine would actually perform — including routing, transport, and error correction — is accounted for here, using measurements from an actual circuit rather than assumed values. That's the non-trivial difference between an engineering blueprint and a resource estimate. The resource estimate is also a lever, not a limit. More physical qubits, applied the right way, can substantially cut the runtime for a significant speedup. Our result reflects two fronts of progress advancing together inside IonQ: continued gains in algorithm and compiler efficiency, and continued gains in what our hardware and error correction can reliably execute.

This is the first time anyone has taken a utility-scale algorithm and estimated its cost without approximating away the parts that usually dominate a real machine’s runtime. We compiled every operation down to the actual error-correction primitives our architecture runs, and we proved, rather than assumed, a lower bound on the probability that the full computation succeeds.

— Chris Ballance, President of Quantum Computing at IonQ

Why this generalizes beyond cryptography

We're applying this same full-stack approach — co-optimizing algorithm, compiler, error correction, and hardware — across our broader roadmap, including chemistry, optimization, and materials science, and more, and expect it to speed up commercialization in each. In chemistry, that means catalyst and battery-material design. In optimization, logistics and freight-routing. In materials science, generative modeling for durability and design with industrial manufacturers. Results like this come from optimizing the full stack, not from improving hardware, algorithms, or error correction in isolation. This study is the clearest public evidence yet of the commercial advantage that approach delivers.

Defense in depth for cryptographic agility 

This finding underscores the importance of the post-quantum transition governments and enterprises have already begun, and the value of treating cryptographic agility as an ongoing investment rather than a one-off migration. This matters because the same category of risk will recur across other curves, key sizes, and algorithms as the underlying math keeps evolving. Our full-stack security roadmap is designed to help organizations prepare for and adapt to impending quantum threats.

That same approach applies with precision to this specific finding. secp256k1 is used in practice for digital signatures: proving ownership and authorizing transactions. Breaking it is an authentication problem, not a confidentiality problem, and the direct remedy is standards-based post-quantum signatures, specifically NIST's (National Institute of Standards and Technology's) ML-DSA and SLH-DSA. Different risks call for different defenses. 

Our findings clearly define the risk to ECC-secured systems. The algorithms meant to replace them require the same kind of rigorous stress-testing we just applied here, and that is work IonQ intends to keep doing.

— Jordan Shapiro, President of Quantum Platform at IonQ

The full technical paper, including the complete architecture, error-correction analysis, and success-probability proofs behind this estimate, is available here.

Did IonQ break Bitcoin or secp256k1 elliptic curve cryptography?

No, IonQ did not break Bitcoin or any live cryptographic system. This research is an architectural and resource-estimation study, not an active exploit or hardware demonstration. No wallets, keys, networks, or operational systems were touched, and no quantum computer capable of running this algorithm exists today. It's also worth being precise about what secp256k1 is used for: it secures digital signatures — proving ownership and authorizing transactions — not confidentiality. Breaking it is an authentication problem, not an encryption problem. IonQ selected secp256k1 because it is the most well-understood 256-bit elliptic curve in production, serving as a standardized benchmark to demonstrate full-stack quantum computing performance — a canary for a much broader category of cryptographic risk, not a target.

How many qubits are needed to solve 256-bit elliptic curve cryptography (ECDLP)?

IonQ's blueprint estimates that solving the 256-bit elliptic-curve discrete logarithm problem (ECDLP) requires 19,397 physical qubits and 1,457 logical qubits operating under quantum low-density parity-check (qLDPC) error-correction codes. 

How long would a fault-tolerant quantum computer take to break a 256-bit ECC key?

Under IonQ's compiled architecture, a single attempt to solve 256-bit ECDLP takes approximately 26 days on a system with a 29.5-millisecond measured error-correction cycle time, yielding a proven lower bound success probability of 40.7% (and up to 63.3% under common mathematical heuristics). IonQ's estimate measures actual circuit-level transport and routing overheads based on an architectural blueprint rather than a coarse-grained resource estimation.