Lead story
IonQ Publishes End-to-End Fault-Tolerant Resource Estimate for Shor’s Algorithm on 256-Bit Elliptic Curves
IonQ has published a study describing a fault-tolerant quantum computing architecture called 'Walking Cat' that uses qLDPC codes and 19,397 physical qubits. The estimate indicates the architecture could break 256-bit elliptic curve cryptography, including schemes used to secure Bitcoin, in 25.7 days. The publication highlights the future vulnerability of current cryptographic standards and urges migration to quantum-resistant alternatives.
Why it matters
Previous resource estimates for cryptographically relevant Shor's algorithm implementations have typically relied on surface-code architectures and required millions of physical qubits for 256-bit elliptic curve targets. IonQ's estimate is orders of magnitude lower, suggesting that qLDPC codes combined with architectures exploiting long-range connectivity could dramatically reduce the hardware footprint for cryptanalytic tasks. If validated, this moves the practical threat timeline earlier and strengthens the case for urgent post-quantum migration.
AI analysis — not reported by the source
What this could make possible
0–2 years
- Plausible
This resource estimate could prompt standards bodies and regulated industries to accelerate post-quantum cryptography migration timelines, treating 256-bit ECC as breakable with fewer physical qubits than previously assumed.
If the estimate survives peer review, it changes risk models that currently use surface-code-derived qubit counts. Bitcoin and other financial systems rely on secp256k1; a credible sub-20,000-qubit attack makes the security margin thinner and could shift regulatory deadlines.
2–5 years
- Plausible
The Walking Cat architecture could become a near-term target for trapped-ion testbeds, with qLDPC codes validated on small logical qubit arrays before scaling toward cryptanalytic sizes.
IonQ has long-range ion transport, which can implement the non-local connectivity qLDPC codes require. If physical gate fidelities and shuttling times meet simulation assumptions, small logical qubit demonstrations within five years are credible.
5+ years
- Speculative
If the estimate holds and trapped-ion systems scale to around 20,000 high-quality physical qubits, 256-bit elliptic curve schemes like secp256k1 could be broken within days, making them fully obsolete.
The study specifies a clock time of 25.7 days using 19,397 physical qubits, but current IonQ systems have on the order of tens of qubits. Scaling by three orders of magnitude while maintaining the assumed error rates and connectivity is a multi-year engineering problem that has not yet been demonstrated.
What would have to be true
- The qLDPC code constructions must be physically realizable on trapped-ion hardware without excessive shuttling overhead or crosstalk beyond what is modelled.
- Physical two-qubit gate fidelities must remain below the threshold assumed in the simulation, and decoding latency must not dominate the logical clock.
- Scaling trapped-ion systems from tens to approximately 20,000 qubits requires advances in ion loading, trap arrays, and control electronics that are not yet demonstrated.
- The estimate's architectural assumptions, including qubit connectivity and error models, must survive independent replication and scrutiny.
Who’s positioned
- IonQ — The study positions IonQ as a leader in fault-tolerant architecture and qLDPC code implementation for cryptanalysis, potentially attracting funding and partnerships.
- Post-quantum cryptography solution providers — Increased urgency around ECC vulnerability accelerates adoption of quantum-resistant algorithms and migration services.
- Bitcoin core developers and cryptocurrency exchanges — They receive a concrete signal for migration planning, making the threat more tangible and actionable.
What could change this
- The validity of the simulation's noise model and gate fidelity assumptions is unverified on real trapped-ion hardware at the scale modelled.
- The 19,397 physical qubit count may omit overheads for magic state factories, routing, shuttling, or error decoding.
- Competing architectures, such as superconducting qLDPC or photonic approaches, may achieve similar or better resource reductions.
- Classical attacks or algorithmic improvements could further weaken or strengthen ECC security independently of quantum hardware.