A neutral-atom quantum computer with about 12,000 physical qubits could break a 256-bit elliptic-curve key in roughly 264 days, researchers at Oratomic, Caltech, and the University of California, Berkeley, estimated in a preprint posted on March 30, 2026. To bring that run down to 10 days, they needed about 26,000 physical qubits. Their smallest design, the source of the paper’s 10,000-qubit title, uses 9,739 physical qubits and runs slower still.
Shor’s algorithm is the quantum method for factoring large numbers and computing discrete logarithms, the problems behind RSA and elliptic-curve cryptography. Algorithm designers have cut the logical qubits it needs, the error-protected units an algorithm works with, from about 6,200 for RSA-2048 in a 2019 design to 1,399 in a 2025 preprint. Code designers have cut the physical qubits that each logical qubit costs. Teams have published physical-qubit counts for RSA-2048 that range from 20 million down to 13,255, about 1,500-fold, and counts for 256-bit elliptic curves that differ about 50-fold.
Researchers have fit Shor’s algorithm into fewer than 25,000 physical qubits only by accepting attacks that take days to years and assuming hardware that no machine has yet shown, so security teams should treat each new low estimate as a list of milestones to watch and keep their migration deadlines where they are.
The assumptions behind the 10,000-qubit design
In this design, each physical qubit is one atom held by a focused laser beam called an optical tweezer. The authors moved atoms with the tweezers between operations to give their error-correcting codes the long-range connections those codes need.
Most earlier teams based their estimates on the surface code, which stores one logical qubit in each patch of physical qubits. The Oratomic team, whose corresponding authors are Madelyn Cain, Qian Xu, and Dolev Bluvstein, chose high-rate codes from the quantum low-density parity-check (qLDPC) family instead. Their largest memory code stores 1,480 logical qubits in 5,278 physical qubits, an encoding rate of 28%, at a code distance of up to 24. A code’s distance is the smallest number of errors on its physical qubits that can corrupt the stored information without being detected.
The team kept the large codes as memory and performed logic in smaller processor codes, moving logical qubits between blocks through sequences of joint measurements called code surgery. The authors described the construction as “a theoretically consistent existence proof” and wrote that it may not be the cheapest one possible. They found several of the new codes with “an LLM-assisted heuristic computer search,” guided by a large language model.
In the architectures costed here, a machine consumes a specially prepared magic state for each Toffoli gate, the three-qubit operation that accounts for most of the cost of Shor’s algorithm, as Quantum Observer described in its ranking of fault-tolerant applications by gate count. The Oratomic authors set aside 2,565 physical qubits, about a quarter of their smallest machine, for five factories that make those states.
In the authors’ noise model, every entangling gate, state preparation, and measurement fails with the same probability. They simulated their codes at 0.1%, or one fault in 1,000 operations, but required lower rates to run the attacks.
For the elliptic-curve attack, the authors required 0.093% with their larger memory code and 0.070% with the smaller one, which they used in the machines with 9,739 and 11,961 physical qubits. They wrote that RSA-2048 would require “slightly reduced physical error rates,” below the elliptic-curve attack’s 0.093%. A machine at their 0.1% test point would fall short of either attack.
The authors also assumed a stabilizer measurement cycle of 1 millisecond. The machine’s speed depends on the length of a cycle, one round of the parity checks that reveal faults. Of the 1-millisecond cycle, the authors wrote that “realizing this in practice may require technological development.” They expect it to become possible with faster readout and atom motion.
Recent experiments “required several ms per stabilizer measurement cycle” on smaller arrays, they wrote. In current machines, the authors wrote, gates of about 200 nanoseconds are separated by idle periods of 200 microseconds or more. Readout and atom motion take from 100 microseconds to several milliseconds, depending on the implementation.
As of November 12, 2026, the preprint had one version on arXiv and no journal publication.
Qubits traded for time
The authors traded qubits for speed by running Toffoli gates in parallel batches, each with its own factories and working space. With batches of 20 gates, the elliptic-curve machine grew to about 19,000 physical qubits and needed about 52 days, according to the paper’s Figure 3. With batches of 130, it grew to about 26,000 physical qubits and finished in 10 days. For RSA-2048, with batches of 1,160 gates, the authors put the run at 97 days on about 102,000 physical qubits, using the 2019 Gidney–Ekerå circuit instead of the 2025 one.
On the balanced layout for elliptic curves, with 11,961 physical qubits, the authors put one key at about 264 days. They wrote that runtimes for RSA-2048 and the elliptic-curve attack on the balanced architecture “vary by nearly two orders of magnitude,” with RSA-2048 the longer. In their Figure 3, the authors put RSA-2048 on the balanced layout, with 13,255 physical qubits, at about 10,000 days, or decades.
For their smallest layout, with 9,739 physical qubits, the authors gave the elliptic-curve runtime only in that figure. They put it at about 1,000 days, against about 264 days on the balanced layout.
Other teams have made the same exchange between size and time. In May 2025, Craig Gidney of Google Quantum AI cut his RSA-2048 estimate from the 20 million noisy physical qubits that he and Martin Ekerå had published in 2019 to 897,864. He wrote that the saving came mainly from approximate residue arithmetic, a way of doing the algorithm’s arithmetic with fewer qubits.
His expected runtime rose from 8 hours to about 5 days. He wrote that the longer runtime was “mainly due to performing more Toffoli gates and using fewer magic state factories.”
Ryan Babbush of Google Quantum AI and eight co-authors, Gidney and Dan Boneh of Stanford University among them, estimated in a March 2026 preprint that a 256-bit elliptic-curve key could be broken in a single run of 23 minutes with fewer than 1,200 logical qubits, or 18 minutes with fewer than 1,450, on fewer than 500,000 physical qubits. They assumed superconducting hardware with a 0.1% error rate and error-correction rounds of 1 microsecond. For neutral-atom and trapped-ion machines with rounds of 100 microseconds or longer, they calculated that running the attack in minutes would take about 2.5 million physical qubits for magic-state production alone. On such machines, they wrote, attacks on keys that have been public for a long time would become possible before attacks on transactions in progress.
Iceberg Quantum, a Sydney company that also designs with qLDPC codes, gave the same trade in numbers in October. In its Pinnacle 1.2 update, posted without a paper, the company put RSA-2048 at 72,000 physical qubits and an expected 3.7 days with a 1-microsecond cycle and a 0.1% error rate. With a 1-millisecond cycle at the same error rate, it put the requirement at 2.1 million physical qubits and 32 days. For chips whose connections are fixed at fabrication, as on superconducting processors, it estimated 99,000 physical qubits.
Iceberg has not published the circuits or decoder behind the update, as Quantum Observer reported. A decoder is the classical system that reads error-correction measurements and works out which errors occurred. The company reported a mean decoding time of 4 microseconds per round, against the 1-microsecond cycle in its headline estimate.
Teams that kept the surface code on neutral atoms needed far more qubits. Hengyun Zhou and seven co-authors, Bluvstein and Cain among them, estimated in a peer-reviewed 2025 paper that a machine of 19 million physical qubits could factor RSA-2048 in 5.6 days with 1-millisecond cycles. In a May 2026 preprint, Tian Xue and Jacob Covey of the University of Illinois Urbana-Champaign put a modular atomic machine of about 470,000 physical qubits at about 190 days for each of about nine expected runs.
For RSA-2048 at one cycle per millisecond, published estimates range from 5.6 days on 19 million physical qubits to decades on 13,255 physical qubits.
The published estimates side by side
Each row in the tables below lists one team’s published figures, with physical error rates per operation and cycle times per round of error checks. Only Gidney and Ekerå’s 2019 estimate has appeared in a journal. The others are preprints, company papers, or posts.
RSA-2048
| Estimate | Platform and code | Physical qubits | Logical qubits | Runtime | Physical error rate | Cycle |
|---|---|---|---|---|---|---|
| Gidney and Ekerå, 2019 | superconducting, surface code | 20 million | about 6,200 | 8 hours | 0.1% | 1 µs |
| Gidney, 2025 | superconducting, surface code | 897,864 | 1,399 | about 5 days | 0.1% | 1 µs |
| Oratomic, Caltech, and UC Berkeley, 2026, balanced layout | neutral atoms, high-rate codes | 13,255 | up to 1,480 (2025 circuit) | about 10,000 days | below 0.093% | 1 ms |
| Oratomic, Caltech, and UC Berkeley, 2026, parallel layout | neutral atoms, high-rate codes | about 102,000 | about 6,200 plus adder ancillas (2019 circuit) | 97 days | not stated | 1 ms |
| Iceberg Quantum, October 2026 | qLDPC codes | 72,000 | not published | 3.7 days | 0.1% | 1 µs |
| Iceberg Quantum, October 2026, slow cycle | qLDPC codes | 2.1 million | not published | 32 days | 0.1% | 1 ms |
| Alice & Bob, October 2026 | superconducting cat qubits | 22,593 | 1,433 | 3.14 days | 0.05% phase flips, no bit flips | 1 µs |
256-bit elliptic curves
| Estimate | Platform and code | Physical qubits | Logical qubits | Runtime | Physical error rate | Cycle |
|---|---|---|---|---|---|---|
| Google Quantum AI and co-authors, March 2026 | superconducting, surface code | under 500,000 | under 1,200 or under 1,450 | 23 or 18 minutes | 0.1% | 1 µs |
| Oratomic, Caltech, and UC Berkeley, March 2026, smallest layout | neutral atoms, high-rate codes | 9,739 | under 1,200 | about 1,000 days | 0.070% | 1 ms |
| Oratomic, Caltech, and UC Berkeley, March 2026, balanced layout | neutral atoms, high-rate codes | 11,961 | under 1,200 | about 264 days | 0.070% | 1 ms |
| Oratomic, Caltech, and UC Berkeley, March 2026, parallel layout | neutral atoms, high-rate codes | about 26,000 | under 1,200 or 1,450, plus adder ancillas | 10 days | not stated | 1 ms |
| IonQ, September 2026, secp256k1 | trapped ions, qLDPC codes | 19,397 | 1,457 | 25.7 days per attempt | 0.01% two-qubit gates | 5.4 ms (200 µs per operation) |
The authors of these estimates counted runtimes on different bases. Gidney’s 4.96 days covers about nine expected runs, and Alice & Bob’s 3.14 days covers about 9.6 runs of 7.84 hours. Iceberg gave its 3.7 days as an expected runtime. The Oratomic authors based their balanced RSA-2048 figure on the 6.5 billion Toffoli gates of Gidney’s 2025 circuit, a total across runs.
The elliptic-curve figures are single runs. IonQ’s run succeeds about 63% of the time, by its authors’ heuristic estimate. The Oratomic authors gave the 1,000-day and 10,000-day figures only in their Figure 3 and stated no separate error requirement for the parallel layouts.
Apart from the two rows built on the 2019 circuit, every team that published a logical-qubit count started from a circuit of about 1,200 to 1,500 logical qubits. For those teams, physical counts run from 9,739 to 897,864, depending on the code, hardware, and runtime each team assumed.
The teams also assumed different hardware. IonQ’s researchers assumed two-qubit gate errors of 0.01%, a tenth of the rate in most other rows, for a machine the company has not built, as Quantum Observer reported. In their paper, the IonQ authors scheduled 27 physical operation cycles of 200 microseconds each in every round of error checks on their memory code, or 5.4 milliseconds per round. Their rounds are slower than the 1-millisecond cycle in the Oratomic rows.
Alice & Bob builds cat qubits, superconducting circuits that store information in a microwave resonator. Its researchers modeled phase flips, one of the two basic kinds of qubit error, at 0.05% per operation. They put an attack on the secp256k1 elliptic curve at 61.8 minutes on at most 29,588 cat qubits. For RSA-2048, they used 1,433 logical qubits, as Quantum Observer reported in October.
Alice & Bob wrote in its October 29 release that the headline figures “assume no bit flips during the computation, equivalent to a bit flip time of about 1 century.” Its researchers wrote in their preprint that the requirement “can be relaxed to a bit-flip time of about one hour” with an added layer of bit-flip correction, at a cost of about 45,000 cat qubits for RSA-2048.
In an October 14 blog post, the company reported preliminary bit-flip times averaging 44 minutes on a single-qubit chip and ranging from 189 to 252 minutes for three qubits on Helium 2, a processor with 12 physical qubits. The company published no paper with the post and wrote that it still has to replicate the results during an error-correction experiment.
For the elliptic-curve attack, the Oratomic authors used the gate and qubit counts of Google’s March circuits. Google withheld those circuits and attested to the counts with a zero-knowledge proof, a cryptographic method of proving a statement without revealing the details behind it.
What neutral-atom hardware has shown
Laboratories have demonstrated parts of the Oratomic design one at a time. Caltech physicists in the group of Manuel Endres, an author of the Oratomic paper, trapped more than 6,100 atoms in about 12,000 sites and kept them coherent for 12.6 seconds, they reported in Nature in 2025. They moved atoms without disturbing the stored information but reported no entangling operations across the array.
In a June 2026 preprint, researchers at Tsinghua University reported trapping an average of 11,022 atoms in an array of 18,225 tweezers generated by a single metasurface, a flat optical element. The atoms filled about 60% of the sites at random. The team reported no qubit operations and wrote that “the next milestone will be to assemble a defect-free atom array at this scale.”
In April, Harvard and MIT researchers working with QuEra reported in a preprint two-qubit gates with an error of 0.146%, measured across eight gate sites at once. When they discarded runs in which an atom was lost, the error fell to 0.059%. The Oratomic authors required 0.070% to 0.093% on every gate, preparation, and measurement, across thousands of atoms at once.
Dolev Bluvstein and colleagues at Harvard reported in Nature in November 2025 on a neutral-atom architecture they tested on arrays of up to 448 atoms. In a four-round test, the team measured 2.14 times lower error per round in a distance-5 surface code than in a distance-3 one. By that measure, their hardware was below threshold, the error rate under which larger codes make fewer logical errors, as Quantum Observer explained in its guide to logical-qubit claims.
Another Harvard-led team kept more than 3,000 atoms in an array for over two hours by reloading atoms at 300,000 a second, in work published in Nature in 2025. The Oratomic machine would have to run for 10 days at its fastest.
In the experiments cited here, the highest-rate codes run on neutral atoms stored three or six logical qubits per block. Bluvstein’s team used [[16,6,4]] blocks, in which 16 atoms store six logical qubits. Infleqtion entangled 30 logical qubits in September in blocks of eight atoms, with a code that, Chief Technology Officer Pranav Gokhale wrote, “can detect any error or correct for a lost atom.” The Oratomic memory code stores 1,480 logical qubits per block.
No team cited here has moved logical qubits between high-rate blocks by code surgery. Bluvstein’s team moved them between [[16,6,4]] blocks by transversal teleportation, a different method. Each team met part of one assumption, on a different machine. The Oratomic authors assumed all of them at once, in one system of at least 9,739 atoms that runs for 10 days or longer.
The case that small machines are close
Builders of neutral-atom and trapped-ion machines argue that the hardware in these estimates is within reach. Bluvstein said in a Caltech announcement that the road map arrived faster than the team had expected. Caltech’s Institute for Quantum Information and Matter wrote in the same announcement that the lower qubit count means quantum computers could, in theory, be operational by the end of the decade. Martin Roetteler, IonQ’s vice president of quantum applications R&D, said in a September release that a computation that once needed millions of physical qubits now fits on a machine of 20,000 physical qubits on IonQ’s roadmap.
The builders have evidence for part of that case. Laboratories went from 6,100 trapped atoms in Caltech’s 2024 preprint to 11,022 in Tsinghua’s 2026 preprint. Harvard and MIT researchers brought gate errors to within about a factor of two of the Oratomic requirement.
Google’s team cut qubits and runtime together. In 2022, Mark Webber and three co-authors estimated in AVS Quantum Science that breaking the 256-bit elliptic-curve encryption of a Bitcoin key within one day would take 13 million physical qubits, at a 0.1% gate error and a 1-microsecond cycle. With the same error rate and cycle time, Babbush’s team put the attack at minutes on fewer than 500,000 physical qubits. Below 25,000 physical qubits, the authors of every published estimate accepted attacks lasting days or longer and assumed hardware that no laboratory has shown.
A machine that needs 10 days per key cannot read traffic at scale. It could still recover a signing key that stays in use for years, or the key to a recorded session chosen for its value. Summarizing a September call to action by G7 cybersecurity agencies, the Canadian Centre for Cyber Security wrote that organizations “face immediate risks such as ‘harvest now, decrypt later’ attacks.” In such an attack, an adversary records encrypted traffic today and decrypts it once a capable machine exists, however long each key takes.
On hardware, none of the groups cited here has reported the error rate, cycle time, array size, continuous operation, and high-rate logic together in one system. The Oratomic authors gave no date for that integration.
What security teams should watch
Security teams can read these papers as a list of five results that researchers would have to report before a slow-clock attack machine of the Oratomic kind, one with millisecond cycles, is within reach:
- Error rates below 0.093%, and below 0.070% for the smallest designs, on every gate and measurement across thousands of atoms in one array, measured during error correction.
- Error-correction cycles near 1 millisecond, several times faster than the cycles the Oratomic authors cited.
- Logical operations by code surgery between blocks of a high-rate code, decoded in real time.
- Continuous operation for days, with lost atoms replaced during the computation.
- Independent checks of the Oratomic codes, including those found by computer search, and peer review of the estimate.
Iceberg would have to show a decoder that keeps pace with 1-microsecond cycles. Alice & Bob would have to show bit-flip times of an hour or more during error correction, the level at which its researchers put RSA-2048 at about 45,000 cat qubits.
Neither set of estimates, for slow clocks or fast ones, is a reason to move migration deadlines later. In its final transition plan, published on October 27, NIST deprecates RSA and elliptic-curve algorithms at every approved key size after 2030 and disallows them after 2035, as Quantum Observer reported. Under Executive Order 14412, federal agencies must move high-value assets and high-impact systems to post-quantum key establishment by December 31, 2030, and to post-quantum signatures by December 31, 2031.
What would change this reading
Security teams should revisit this reading if either of two results appears. The first would be a neutral-atom system that keeps error rates below the 0.093% the Oratomic authors required, or 0.070% for the smallest designs, across thousands of atoms in one array, with cycles near 1 millisecond and logical operations on a high-rate code. The 10-day machine of 26,000 physical qubits would then become a question of scale and money. Owners of signing keys that stay in use for years would have reason to replace them well before 2030.
The second would be an estimate, well below 100,000 physical qubits, for an attack that finishes in under a day at error rates and cycle times already demonstrated. With such an estimate, researchers would no longer need slow runs or untested hardware to reach low qubit counts.
Until either result appears, security teams can read the figure of 9,739 physical qubits as a list of what laboratories must demonstrate next and keep to the 2030 dates.
An earlier version of this analysis appeared on PostQuantum.com, the author’s own publication, on March 31, 2026. It is republished here with permission and was revised and updated for Quantum Observer in November 2026.
