How Many Qubits to Crack Bitcoin? IonQ Says 19,397, in About 26 Days

IonQ, the trapped-ion quantum computing company, has published the first fully compiled, end-to-end resource estimate for running Shor's algorithm against secp256k1, the specific elliptic curve that signs Bitcoin transactions. Shor's is the quantum procedure that, in theory, breaks the public-key cryptography behind Bitcoin and most blockchains.

The artifact is a paper blueprint, not a working machine. It is the first vendor-attributed study to put concrete numbers on what a fault-tolerant attack would actually require: 19,397 physical qubits, 25.7 days per attempt, a 63.3% heuristic single-run success probability, and a 1,457-logical-qubit core. The paper's success-probability guarantee is a rigorous lower bound of at least 1 − 2⁻¹²⁸ across phase and computational-basis approximation errors; it is a bound on the algorithm's run, not a confidence interval on the resource estimate itself.

A "resource estimate" is a paper study that models how big and how fast a fault-tolerant quantum computer would need to be to run a given algorithm. The numbers in IonQ's release and the arXiv preprint 2604.19481 put a Toffoli budget on the attack: 39 million Toffoli gates and 273 million T-states, down from a prior baseline of 58 million Toffolis. Toffoli gates are the expensive primitive in fault-tolerant quantum computing; cutting their count cuts the wall-clock cost of the attack in proportion.

The lever doing the work is a refactored version of IonQ's "Walking Cat" fault-tolerant architecture, a qLDPC design. qLDPC stands for quantum low-density parity check, a class of error-correcting codes that uses far fewer physical qubits per logical qubit than the older surface-code approach. The optimized stack adds pseudo-Mersenne point-addition arithmetic tuned to secp256k1's prime shape, a Karatsuba modular squarer, and a two-level magic state factory that produces CCZ states directly in qLDPC memory. A "magic state factory" is the subsystem that manufactures the noisy resource states, here CCZ states, that Toffoli gates consume. Depth-one CCZ injection, non-overlapping cat-state measurement channels, and a pipelined logical CliNR frame-clearing protocol then push per-Toffoli execution down to 29.5 milliseconds, a 31× speedup over the unoptimized baseline.

Four CCZ factories consume 1,276 physical qubits and average under 28 milliseconds per CCZ, keeping the magic-state supply continuous. The compiler toolchain, detailed in the IonQ-hosted PDF, does not abstract away the physical layer. It models 2D ion shuttling, qubit transport, syndrome extraction, and a Swap-Loss model with Leakage and Loss Reduction Units (LLRUs). Routing, Clifford gates, and decoherence stay in the cost model rather than getting smoothed over. That choice is the paper's strongest honesty signal: the resource estimate is only as good as the ion-trap hardware assumptions behind it.

Independent trade coverage has already recast the same numbers in the bitcoin frame. The Quantum Insider reports that a roughly 20,000-qubit machine could break secp256k1 in 26 days, matching IonQ's framing. The original trigger article, from Quantum Computing Report, treated the study as discovery; the analytical weight sits in the IonQ release, the preprint, and the hosted PDF.

The Bitcoin-developer community is calibrated rather than panicked. A Draft BIP titled "Quantum-Resistant Transition Framework for Bitcoin" is in circulation on the bitcoindev Google group, laying out a staged migration path. At the same time, a Murmurations Substack post argues that core developers are mostly unworried about near-term quantum risk. The split is real: a transition framework exists, but the people who would have to ship it are not treating this paper as a fire alarm.

The honest test of this blueprint is not whether secp256k1 has been broken. It has not. The test is whether a real fault-tolerant trapped-ion device can match the physical-layer assumptions in the model. The Walking Cat architecture and the two-level CCZ factory are a vendor's roadmap, peer-track but not peer-reviewed hardware. Until a small fault-tolerant prototype can run the same Toffoli budget in the same wall-clock window, the 19,397-qubit, 26-day figure is the shape of an engineering problem, not the date of an attack.