IonQ researchers estimated in a paper published on September 8, 2026, that a trapped-ion quantum computer with 19,397 physical qubits could solve the elliptic-curve discrete logarithm problem (ECDLP) on secp256k1 in about 25.7 days per attempt. Secp256k1 is the elliptic curve that Bitcoin and Ethereum use to sign transactions. An attacker who solves the ECDLP on that curve can work out a private signing key from its public key and sign transactions in the owner’s name.
IonQ posted the paper, written by 14 of its researchers and dated September 3, on its website alongside a press release. The paper had not been peer reviewed when the company announced it.
IonQ priced the attack for a machine it has not built: on its published roadmap, the company lists 100 to 256 or more physical qubits for 2026 and 20,000 physical qubits for 2028. At the runtime IonQ modeled, the attack would apply to public keys that stay exposed for weeks, such as those in reused addresses, and would be too slow for a transaction that waits minutes for confirmation.
How the authors built the estimate
The authors estimated the cost of running Shor’s algorithm on a modified version of Walking Cat, the fault-tolerant trapped-ion architecture that IonQ published in April. Shor’s algorithm is a quantum method for factoring large numbers and solving discrete logarithm problems such as the ECDLP. Trapped-ion machines use individual charged atoms, called ions, as qubits.
A fault-tolerant computer corrects its own errors as it runs by spreading each logical qubit, the unit an algorithm works with, across many physical qubits. The authors wrote that they started from circuits for the same curve that André Schrottenloher published in a June 2026 preprint and cut the number of Toffoli gates from about 58 million to 39 million. Their version uses 1,457 logical qubits.
A Toffoli gate is a three-qubit logic operation. In the designs these estimates assume, each one consumes a specially prepared resource state, so researchers use the Toffoli count as the main measure of an attack’s cost.
The authors then compiled each step into a schedule of operations for the proposed device and estimated a total of 75,251,329 layers of logical measurements. They allowed 29.5 milliseconds for each layer, the time their design takes to inject the resource state for one Toffoli gate. The authors called the resulting 25.7 days “a conservative upper bound on runtime.”
The authors laid out 69 memory blocks, each using 207 physical qubits to store 22 logical qubits. They added four factories of 319 physical qubits each to prepare the resource states that Toffoli gates consume.
Error rates and success probability
The authors assumed two-qubit gate errors of 1 in 10,000, single-qubit errors of 1 in 100,000, and a physical operation cycle of 200 microseconds. They wrote that the two-qubit error rate “has been demonstrated experimentally on small trapped-ion devices.”
The authors simulated the error-correcting code for their memory blocks at physical error rates between 5 in 10,000 and 2 in 1,000. They then extrapolated a fitted curve down to 1 in 10,000 to estimate how often the logical qubits in that code would fail.
Combining memory, factory, and other failures, the authors estimated about a 26% chance of a logical failure in any single run. They put the probability that a single attempt succeeds at 63.3% by a heuristic estimate and at 40.7% by a rigorous lower bound. The authors wrote that five identical machines running in parallel would have a 99.3% chance that at least one attempt succeeds, based on the 63.3% figure and assuming the machines fail independently.
What IonQ withheld
IonQ said it followed responsible disclosure practices and shared advance copies with U.S. government and industry partners. “Consistent with comparable recent work, IonQ is publishing resource estimates while withholding the specific circuits,” the company said.
IonQ said the cryptographic exposure described in the paper “relates to authentication and integrity rather than to confidentiality.” The company said ML-DSA, formerly CRYSTALS-Dilithium, and SLH-DSA, formerly SPHINCS+, are unaffected by this class of result. NIST published both in August 2024 as signature standards designed to resist attacks by quantum computers.
In its release, IonQ called the paper the world’s first fully compiled, end-to-end blueprint for breaking 256-bit elliptic-curve signatures. The authors made a narrower claim, writing, “To our knowledge, it is the first ECDLP architecture for trapped ions based on quantum LDPC codes.” Quantum LDPC codes are error-correcting codes that store several logical qubits in each block of physical qubits.
Other estimates for the same curve
In a March 30 whitepaper, a team led by Ryan Babbush of Google Quantum AI estimated that its circuits for the same problem could run in minutes on fewer than half a million physical qubits. The team assumed superconducting hardware with physical error rates of 1 in 1,000. Babbush’s team also withheld its circuits and used a zero-knowledge proof, a cryptographic method for proving a claim without revealing the underlying data, to support its resource counts.
Martin Roetteler, IonQ’s vice president of quantum applications R&D and a co-author of the paper, said in the release, “A computation that once demanded millions of physical qubits now fits on a 20,000-qubit IonQ machine on our roadmap.”
IonQ’s hardware timeline
Niccolo de Masi, IonQ’s chairman and chief executive, said in the release that he had flagged in 2025 that Q-Day was shifting “from the 2030s to the 2020s.” Q-Day is the point at which a quantum computer can break the public-key cryptography in use today. De Masi said IonQ is on track to produce a fully fault-tolerant system with 10,000 physical qubits in 2027.
In a separate release the same day, IonQ said it expects its Superion 10K, the first hardware generation built to run the Walking Cat architecture, to reach fault tolerance in a laboratory setting in 2027. IonQ said the machine in the estimate is in line with the scale of systems on its roadmap for about 2028.
