IonQ Models 26-Day Quantum Attack on Bitcoin Cryptography

Did IonQ break Bitcoin? No. On September 8, the company released a spreadsheet, powered by a physics engine and presented as a warning. Their press release states that a fault-tolerant trapped-ion machine with approximately 20,000 physical qubits could solve the secp256k1 elliptic-curve discrete logarithm problem in 25.7 days per attempt. This machine does not exist yet, which is a critical detail that reframes the entire narrative.

Therefore, this should be understood as a modeled-attack projection. It serves as a useful planning threshold, not proof that wallets can be compromised today. IonQ itself acknowledges this, using cautious language beneath a headline that suggests otherwise.

The Source of the Claim and Its Motivations

The figures originate from IonQ, a publicly traded company with a vested interest in demonstrating the value of its technological roadmap. Though this doesn’t inherently invalidate the numbers, it does highlight the company’s incentives. IonQ sells full-stack quantum systems and increasingly offers post-quantum security services, so a credible near-term quantum threat benefits both aspects of its business.

The company reported a 287% year-over-year increase in second-quarter 2026 revenue from a small base, and recently moved to acquire SkyWater Technology to gain greater control over its manufacturing stack. When a company positions itself as both the threat modeler and the mitigation provider, its claims warrant close scrutiny.

It’s important to first acknowledge the genuine work involved. IonQ compiled Shor’s algorithm, specifically addressing the actual error-correction primitives of its Walking Cat architecture. Chris Ballance, IonQ’s President of Quantum Computing, accurately described the novelty:

“This is the first time anyone has taken a utility-scale quantum algorithm and estimated its cost without approximating away the parts that usually dominate a real machine’s runtime. Today’s paper proved a lower bound on the probability that the full computation succeeds. It should be noted that no deployed digital asset nor crypto platform was affected during IonQ’s research.”

Physical Qubits, Logical Qubits, and Common Misinterpretations

The 20,000 figure refers to physical qubits. IonQ specifies a device footprint of 19,397 physical qubits, which map to 1,457 logical qubits and 39 million logical Toffoli gates. These are distinct units, as physical qubits are the raw hardware components. Logical qubits are error-corrected abstractions constructed from many physical ones, and the ratio between them represents the overhead that frequently inflates resource estimates.

IonQ’s assertion is that its high-rate quantum LDPC codes keep this overhead low, explaining how 1,457 logical qubits can be achieved with approximately 19,000 physical ones. A surface code for the same computation would require significantly more. This claim is plausible, and the codes are based on legitimate research. However, it remains unproven at this scale on hardware that has yet to be implemented.

Assumptions Behind the 26-Day Estimate and Unverifiable Details

The press release provides headline figures without disclosing the underlying parameters that generated them. We lack information on the assumed logical error rate, the decoder, the error-correction cycle time, gate speeds, circuit depth, or whether 25.7 days applies to a single private key or a batch. The release states that IonQ withheld specific circuits, consistent with similar work. Understandable, but a resource estimate is only as strong as its assumptions, and these assumptions reside entirely within a paper whose peer-review status is not mentioned in the announcement.

Therefore, the 26-day figure is a modeled output with undisclosed inputs, pending independent reproduction. No external cryptographer has yet assessed whether the estimate is conservative or aggressive compared to previous secp256k1 work. Until such an assessment happens, the figure remains a claim, not a verified finding.

The Discrepancy Between Model and Machine

IonQ’s own roadmap clearly illustrates this gap. CEO Niccolo de Masi states that the company is on track for a fully fault-tolerant 10,000-physical-qubit system by 2027, with more to follow in 2028. The attack model, however, requires roughly double that, error-corrected and operating coherently for weeks. These are roadmap targets, presented as projections based on a much earlier demonstrated state of technology.

Trapped-ion systems circumvent one bottleneck that plagues superconducting machines: they do not require millikelvin dilution refrigerators like superconducting qubits do. Thus, cooling capacity is not a specific limitation for IonQ. However, qubit count alone has never been the sole challenge. Control wiring, calibration, large-scale ion transport, packaging, and sustained logical operation over 26 days are the difficult aspects, none of which this demonstrates. Europe’s drive to translate laboratory strength into deployable systems, as observed in coverage of the proposed Quantum Act, exists precisely because the engineering chasm between theoretical paper and functional product is substantial.

What Truly Warrants Attention

IonQ’s security framing is accurate. This issue pertains to signatures, not encrypted data. secp256k1 authorizes Bitcoin spending, which means the exposure is to future authentication and integrity, not to currently recorded traffic. The “harvest-now-decrypt-later” scenario is not well-suited for confidential data in this context, as a Bitcoin public key is primarily exposed during spending. Reused addresses, dormant coins, and lengthy migration cycles are the genuine concerns, justifying immediate preparation. Mitigation already exists. IonQ notes that ML-DSA and SLH-DSA, both standardized, are immune to this class of attack.

All things considered, IonQ has produced a rigorous cost model for a future attack on a machine that has yet to appear, based on assumptions not fully disclosed, against a threat for which standard bodies already have solutions. Consider it a compelling reason to prioritize signature migration. Do not, however, interpret it as the day Bitcoin broke. Those remain distinct events, and only one has occurred.