Q-Day: A Timeline and Four Milestones

In 2019, Google's Sycamore processor used superconducting qubits to perform random circuit sampling in roughly seconds. The Nature paper estimated about years for a state-of-the-art classical supercomputer at the time [1]. That result made quantum advantage concrete, even if random circuit sampling remained a benchmark problem.

One holy grail of quantum computation is a direct attack on public-key cryptography: factoring for RSA, and elliptic-curve discrete logarithms for ECC. That task requires a different level of machine. Running Shor-style algorithms against real cryptosystems needs long, structured, fault-tolerant computation. In practice, that means logical qubits with very low failure rates, often discussed at the level of per logical operation or below depending on circuit depth, and quantum error correction is the path to those logical qubits.

This is why Google's sequence of error-correction results matters. In 2023, a larger distance- surface-code logical qubit modestly outperformed distance- logical qubits [2]. In 2024, Willow pushed the same trend further: larger surface-code patches produced lower logical error rates [3,4]. In addition, Google's Quantum Echoes experiment probed structured many-body dynamics through out-of-time-order correlators, a more physics-facing benchmark than random circuit sampling [5].

In parallel with rapid experimental progress, theory and architecture work have compressed the apparent hardware demand for realistic cryptosystems. In 2026, Google Quantum AI, the Ethereum Foundation, Stanford, and collaborators estimated the resources needed to attack , the elliptic curve used by Bitcoin and Ethereum account signatures. Their estimate gives a concrete envelope: about - logical qubits and - million Toffoli gates, under specific circuit assumptions [6].

These developments raise the question this article tries to answer:

How far is realistic quantum computation from the resources needed for a cryptocurrency attack?

The rest of the article treats that question as a gap analysis: demonstrated hardware on one side, attack requirements on the other, and neutral-atom roadmaps moving into the middle.

1. What is exposed in the crypto stack?

Crypto is no longer only a payment experiment. It is a large attempt to coordinate ownership, governance, settlement, and financial infrastructure without relying on a single central operator. That ambition rests on cryptography at several layers. User accounts need signatures. Validators need signatures. Bridges and custodians need threshold keys. DAOs need multisig policies. Rollups and privacy systems need proof systems. Tokenized real-world assets add another layer of administrative keys, oracle keys, and legal wrappers around the same cryptographic substrate.

The main quantum-sensitive surface is elliptic-curve public-key cryptography. Bitcoin has long used ECDSA over , and Taproot adds Schnorr signatures over the same curve [7,8]. Ethereum externally owned accounts use ECDSA over [9,10]. Other systems may use Ed25519, BLS signatures, pairing-based commitments, or threshold variants of the same general idea: possession of a private key authorizes state transitions.

Shor's algorithm targets the elliptic-curve discrete logarithm problem behind these schemes. Once a public key is visible, a sufficiently large fault-tolerant quantum computer can, in principle, derive the corresponding private key. That is the attack path. Hash functions sit in a different category. SHA-256, Keccak, Poseidon, and related primitives mainly face Grover-style quadratic speedups, which change security margins without creating the same immediate signature-forgery route.

Table 1 summarizes where quantum-sensitive cryptography appears across the crypto stack.

Table 1. Quantum exposure across crypto components

Component	Cryptography today	Quantum exposure	Practical concern
Bitcoin spending authorization	ECDSA / Schnorr over	High, via Shor on elliptic-curve discrete log	Public-key exposure depends on output type: P2PKH/P2WPKH reveal at spend, while P2PK and Taproot-style outputs expose public keys earlier
Ethereum externally owned accounts	ECDSA over	High, via Shor	Account public keys are recoverable from signatures; reused accounts expose long-lived keys
Ethereum validators	BLS signatures, using BLS12-381 in Ethereum proof of stake	High in principle	Validator and consensus-layer signatures would need migration planning [11]
DAOs and multisigs	ECDSA, Schnorr, BLS, or threshold variants	High if based on elliptic curves	Treasury keys tend to be long lived and politically hard to rotate
Bridges and custodians	Often threshold ECDSA, BLS, or MPC around ECC keys	High	Bridges are already high-value targets; quantum risk compounds operational risk
Many deployed zk-SNARK / KZG systems	Elliptic curves, pairings, or polynomial commitments over pairing-friendly curves	Medium to high, design-dependent	Pairing-based systems face different migration issues than hash-oriented systems [12,13]
ZK-STARK / transparent proof systems	Finite-field arithmetic, hash/Merkle commitments, and FRI-style low-degree testing	Lower than ECC-based signatures	Larger symmetric-security parameters may be enough, but full system design still matters [14]
Proof-of-work mining	Hash preimages / repeated hashing	Lower near-term exposure	Grover gives a quadratic speedup in theory, but mining is parallel, economic, and hardware-bound

The table separates "crypto" into concrete attack surfaces. Quantum risk would arrive unevenly. Bitcoin outputs with already exposed public keys, newly spent P2PKH/P2WPKH outputs, reused Ethereum accounts, validator keys, bridge administrators, custodial infrastructure, DAO treasuries, and upgrade-resistant contracts would sit near the front of the queue. The common variable is public-key exposure plus slow migration.

2. Shor attacks are now a resource-estimation problem

Shor's algorithm is the canonical quantum algorithm for public-key cryptanalysis because it gives a polynomial-time route to problems that support modern public-key cryptography. In the cryptocurrency setting, the relevant version attacks the elliptic-curve discrete logarithm problem. For a signature system such as ECDSA or Schnorr over , the public key is derived from a private scalar. Classically, reversing that map is assumed infeasible. A fault-tolerant quantum computer changes the cost model: the public key becomes enough information to recover the private key.

The operational detail is public-key visibility. A quantum attack begins to matter when the target public key is available and the machine can finish the computation before the attacker loses the opportunity to use the recovered private key.

There are two useful attack windows:

Attack window	What the attacker sees	Time pressure	Examples
At-rest attack	A public key that has already been exposed	Days, weeks, or longer may still matter	Reused Ethereum accounts, P2PK or Taproot-style Bitcoin outputs, bridge keys, DAO treasuries
On-spend attack	A public key revealed during a pending transaction	Minutes, or less in fast settlement systems	P2PKH/P2WPKH-style Bitcoin mempool races after a spend reveals the public key

This distinction matters because resource estimates depend on architecture. A slow-clock machine may still threaten at-rest keys. An on-spend attack needs fast logical operations, enough parallelism, and a system that can complete the full private-key recovery inside the live transaction window.

As algorithms, compilation methods, error-correcting codes, and architecture assumptions improve, the estimated resources for realistic cryptographic attacks have moved downward. In 2026, two estimates became especially useful for this article: the Google team's estimate and the Oratomic team's reconfigurable-atom estimate.

Babbush et al. from the Google-led team made the attack envelope unusually concrete. They give two representative circuits: one with fewer than logical qubits and fewer than million Toffoli gates, and another with fewer than logical qubits and fewer than million Toffoli gates. Under one superconducting architecture assumption with physical error rate and planar connectivity, they estimate execution in minutes using fewer than million physical qubits [6].

Cain et al. from Oratomic give a different marker for the neutral-atom path. Their architecture uses high-rate codes, reconfigurable atomic arrays, and optimized logical instructions. They estimate that cryptographically relevant Shor computations could run with as few as reconfigurable atomic qubits, and that a P-256 elliptic-curve discrete-log instance could take a few days with about physical qubits under their assumptions [15].

Table 2. Two resource estimates to watch

Estimate	Target	Scale	Runtime signal	Use in this article
Google / Babbush et al. 2026		- logical qubits; - M Toffoli gates	Minutes under fast-clock superconducting assumptions	Main cryptocurrency attack envelope
Oratomic / Cain et al. 2026	P-256 discrete log on reconfigurable atoms	As few as atoms; about atoms for faster ECC	A few days under their neutral-atom assumptions	At-rest threat scale and high-rate neutral-atom benchmark

Neither estimate is a prediction that an attack is imminent. They are scale markers. They turn the question from "can Shor break ECC in theory?" into a comparison among logical qubits, logical error rates, non-Clifford gates, runtime, and migration speed.

3. Measuring the gap

To make the gap less abstract, we read it in two ways. First, we compare the public experimental record with cryptographic resource estimates: physical qubits, logical qubits, error rates, and timelines. Then we look at the neutral-atom roadmap, because it gives one of the clearest public paths from QEC testbeds toward fault-tolerant logical machines.

3.1 Hardware progress versus cryptographic requirements

Raw qubit count is a weak proxy for cryptographic risk. A useful attack machine needs encoded logical qubits, low logical memory error, reliable logical gates, enough non-Clifford resources, fast decoding, and enough parallelism to meet the relevant attack window.

Figure 1 is our working map of that gap. Panel A tracks the physical scale of superconducting, trapped-ion, and neutral-atom systems. Panel B compares demonstrated logical-qubit counts with the resource band of roughly - logical qubits from Babbush et al. [6]. Panel C separates physical-gate, logical-memory, and high-rate-code error metrics, which are easy to mix up. Panel D shows that cryptographic resource estimates have moved downward as algorithms, compilation, codes, and architecture assumptions improve.

Figure 1. Quantum hardware milestones and cryptographic resource estimates. The four panels compare physical scale, demonstrated logical scale, reported error-rate milestones, and cryptographic resource estimates.

The figure makes the main point visually: the gap has become quantitative. It is smaller than it looked a decade ago, yet it is still multi-dimensional. A real attack machine needs the right logical scale, logical error rate, non-Clifford throughput, and runtime together.

3.2 The neutral-atom roadmap

Recently, QuEra, a major neutral-atom quantum computing company, released an updated roadmap that translates neutral-atom progress into explicit fault-tolerant targets. It moves from Aquila and Gemini into planned Libra and Next Gen systems, with MegaQuOp and GigaQuOp labels tied to logical operation budgets [16,17].

Figure 2. QuEra's neutral-atom roadmap. The roadmap moves from Aquila and Gemini into planned fault-tolerant systems: Libra as a MegaQuOp-class machine in 2028 and a next-generation GigaQuOp-class system in 2028/29. These are roadmap targets rather than achieved benchmarks.

The numbers matter. Gemini is described as a QEC testbed with physical qubits, fewer than logical qubits, and physical gate fidelity. Libra is planned for 2028 with more than physical qubits, logical qubits, high-rate QEC, and a target logical error near . The next-generation system is planned for 2028/29 with more than physical qubits, logical qubits, ultra-high-rate QEC, and a target logical error near [16,17].

Libra would still sit below the logical-qubit envelope. Next Gen would approach the lower edge of that envelope in logical-qubit count. Count alone is insufficient, though. A cryptographic attack also needs the right logical operations, non-Clifford throughput, routing, decoding, and wall-clock runtime.

The reason neutral atoms deserve attention is architectural. Reconfigurable atom arrays can move qubits and create nonlocal interactions, which makes high-rate QEC and qLDPC-style constructions more plausible than in a fixed nearest-neighbor layout. Cain et al. use that flexibility in their Shor architecture [15]. Zhao et al. push the idea further in theory and simulation, with ultra-high-rate codes for reconfigurable atom arrays [18].

4. Three milestones that would make the risk concrete

The following milestones are our reading of what would change the risk model. Based on current hardware development and the resource estimates above, we anticipate that these experimental steps will matter more than another raw-qubit-count announcement. Each one connects a theoretical requirement for fault tolerance to an experimental capability that a cryptographic attack would need.

4.1 A memory logical qubit below

A Shor-scale computation has to keep quantum information alive through a long circuit. If a logical qubit fails too often while acting as memory, the computation fails before the expensive arithmetic finishes.

Threshold theorems explain why quantum error correction can scale. Under suitable noise assumptions, increasing the code size can suppress logical error rates if the physical error rate is below a threshold [19]. The assumptions carry weight. Noise should be local or weakly correlated, leakage needs control, crosstalk needs control, measurement errors need decoding, and the classical decoder must keep up with the device.

This is why correlated errors matter. A code can look healthy under a simple independent-error model and then hit an error floor in hardware. Google's below-threshold experiment is a good example of both progress and caution. It reported a distance- surface-code memory with logical error per cycle and an error suppression factor of when increasing code distance by two [3].

The repetition-code part of the same experiment is narrower but still important. A repetition code cannot correct the full set of quantum errors, so it is not a complete logical qubit. Even so, rare correlated events appeared at roughly once per hour or cycles [3]. That result tells us that a - scale memory error is at least visible in a restricted setting, which is exactly the kind of signal the field needs before moving to full two-dimensional codes.

The surface-code memory error rate is still above . The point is the trend: larger codes reduced logical error on a real processor. A clean demonstration of a memory logical qubit below per well-defined round, cycle, or operation would change how the field reads the risk. It would tell a much wider technical audience that QEC is behaving like an engineering scaling law rather than staying a theoretical construction.

This is also where the roadmap pressure becomes concrete. QuEra's Libra target is a logical error rate near , and its Next Gen target is near [16,17]. A reasonable near-term bet is that a clearly defined memory logical qubit could appear on a superconducting or neutral-atom platform within the next - years. If that happens with transparent metrics, the crypto discussion will become less speculative.

4.2 High-rate neutral-atom QEC that goes below threshold

So far, the clearest below-threshold experimental evidence comes from surface-code-style scaling: increase the code distance, then observe the logical error rate go down. That is the experimental signature that matters. It is different from simply reporting more logical qubits. Several points in Fig. 1 panel B show encoded or logical-qubit demonstrations, while below-threshold scaling with increasing code distance has only appeared in a smaller subset of experiments.

This distinction is exactly why high-rate QEC is a separate milestone. Surface-code overhead is large. A low encoding rate means many physical qubits per logical qubit, which pushes a thousand-logical-qubit machine toward enormous physical scale. High-rate codes promise better space efficiency, and the experiment has to prove that this efficiency can coexist with scalable error suppression.

Neutral atoms are interesting here because reconfiguration changes the geometry problem. Atom movement and long-range operations can support codes that are awkward on static nearest-neighbor chips. This is why the Oratomic and QuEra papers are worth tracking together: one estimates an attack-scale architecture, the other explores ultra-high-rate QEC codes for the same hardware family [15,18].

Table 3. High-rate QEC signals for neutral atoms

Work	Platform	Encoding rate / logical scale	Error target or result	Status
Oratomic / Cain et al. 2026	Reconfigurable atom arrays	More than logical qubits, about encoding rate	Architecture-level estimate for Shor-scale computation	Theoretical architecture
QuEra / Zhao et al. 2026	Reconfigurable atom arrays	`[[1152,580,<=12]]`, rate about	Around per logical per round at in simulation	Theory and simulation
QuEra / Zhao et al. 2026	Reconfigurable atom arrays	`[[2304,1156,<=14]]`, rate about	Around per logical per round at in simulation	Theory and simulation

The milestone is an experiment: high encoding rate plus below-threshold behavior on a neutral-atom processor. The field needs to see logical error decrease as code size increases while the encoding rate stays high. That would show that better encoding efficiency and scalable error suppression can coexist. If that happens, the physical-qubit overhead in attack estimates changes quickly.

4.3 A non-Clifford resource below

Reliable memory is only one piece of universal quantum computation. Clifford operations and stabilizer circuits have a special structure: the Gottesman-Knill theorem says they can be simulated efficiently on classical computers [20]. A machine that only does Clifford-style fault tolerance is scientifically useful for QEC experiments, but it cannot run general Shor arithmetic.

Universal fault-tolerant quantum computation needs a non-Clifford resource. The common route is Clifford+ , where gates are supplied through injected or distilled magic states. Bravyi and Kitaev's magic-state construction is the standard reference point for this logic [21].

Recent work on magic state cultivation makes this bottleneck more concrete. Gidney, Shutty, and Jones proposed growing a single state inside a surface-code patch, with roughly the physical-gate cost of a lattice-surgery CNOT at comparable reliability. Their estimates reach logical error rates near under circuit noise, using about an order of magnitude fewer qubit-rounds than prior approaches [22]. A later superconducting experiment tested cultivation directly and reported a factor- error reduction, state fidelity , and retained attempts [23].

This is why cryptographic resource estimates count Toffoli gates, T gates, or magic-state throughput. Babbush et al.'s estimate lands in the range of - million Toffoli gates [6]. Those gates are more than a line item in a circuit table. They imply factories, routing, scheduling, decoding, and enough parallelism to finish inside the attack window.

The milestone is a logical gate or injected/distilled magic state with error below , together with a credible path to producing many of them. One beautiful magic state is a physics result. Attack-scale computation needs a steady stream of low-error magic states.

Table 4. Milestones for a cryptographically relevant machine

Milestone	What it would show	Why crypto cares
Memory logical qubit below	Logical information can survive long enough for deep circuits	Shor arithmetic has long depth
High-rate QEC below threshold	Physical-to-logical overhead can shrink	Thousands of logical qubits become less physically expensive
Low-error non-Clifford resource	The machine can move beyond Clifford dynamics	Toffoli and T-like resources dominate ECC attack cost
Integrated runtime	Decoding, routing, factories, and gates work together	Attack feasibility depends on wall-clock time and qubit count together

5. Q-Day as a dashboard

A better question than "which year does crypto collapse?" is whether the migration clock is slower than the hardware and resource-estimate clock.

Today's evidence says practical attacks are still out of reach. The strongest public results show quantum advantage on benchmark tasks, early below-threshold QEC behavior, and roadmaps toward fault-tolerant neutral-atom machines. The resource estimates for ECC attacks are also specific enough to monitor. That combination deserves attention without panic.

The first memory logical qubit below could become quantum computing's ChatGPT moment. That milestone alone leaves cryptocurrency intact, while making the scaling argument feel real to people outside the QEC community. The next two milestones, high-rate QEC below threshold and scalable low-error non-Clifford resources, matter just as much for cryptographic relevance.

For crypto systems, the rational response is boring and necessary: inventory exposed public keys, reduce key reuse, design post-quantum migration paths, and test account-abstraction or signature-upgrade mechanisms before pressure arrives. NIST has already finalized the first post-quantum cryptography standards, which gives the broader security community a migration anchor even though blockchains have their own consensus, wallet, and state-transition constraints [24].

A useful quantum computer can change crypto's risk model before anyone agrees that Q-Day has arrived. It only has to make private-key recovery economically plausible for exposed keys before the ecosystem has finished migrating.

References

[1] F. Arute et al., "Quantum supremacy using a programmable superconducting processor," Nature 574, 505-510 (2019). https://www.nature.com/articles/s41586-019-1666-5

[2] Google Quantum AI, "Suppressing quantum errors by scaling a surface code logical qubit," Nature 614, 676-681 (2023). https://arxiv.org/abs/2207.06431

[3] R. Acharya et al., "Quantum error correction below the surface code threshold" (arXiv, 2024). https://arxiv.org/abs/2408.13687

[4] Google Quantum AI, "Meet Willow, our state-of-the-art quantum chip" (2024). https://blog.google/technology/research/google-willow-quantum-chip/

[5] A. Morvan et al., "Observation of constructive interference at the edge of quantum ergodicity," Nature (2025). https://www.nature.com/articles/s41586-025-09526-6

[6] R. Babbush et al., "Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations" (arXiv, 2026). https://arxiv.org/abs/2603.28846

[7] Bitcoin BIP-0340, "Schnorr signatures for secp256k1." https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki

[8] Bitcoin BIP-0341, "Taproot: SegWit version 1 spending rules." https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki

[9] Ethereum developer docs, "Accounts." https://ethereum.org/en/developers/docs/accounts/

[10] G. Wood, "Ethereum: A Secure Decentralised Generalised Transaction Ledger," Ethereum Yellow Paper. https://ethereum.github.io/yellowpaper/paper.pdf

[11] Ethereum consensus specs, "Phase 0: Beacon Chain." https://github.com/ethereum/consensus-specs/blob/dev/specs/phase0/beacon-chain.md

[12] Ethereum EIP-4844, "Shard Blob Transactions." https://eips.ethereum.org/EIPS/eip-4844

[13] Zcash Protocol Specification. https://zips.z.cash/protocol/protocol.pdf

[14] E. Ben-Sasson, I. Bentov, Y. Horesh, and M. Riabzev, "Scalable, transparent, and post-quantum secure computational integrity" (IACR ePrint 2018/046, 2018). https://eprint.iacr.org/2018/046

[15] M. Cain et al., "Shor's algorithm is possible with as few as 10,000 reconfigurable atomic qubits" (arXiv, 2026). https://arxiv.org/abs/2603.28627

[16] QuEra, "Our quantum roadmap" (accessed 2026-06-30). https://www.quera.com/our-quantum-roadmap

[17] Quantum Computing Report, "QuEra Updates Neutral-Atom Quantum Roadmap with 2028 Fault-Tolerant Launch on Amazon Braket" (2026). https://quantumcomputingreport.com/quera-updates-neutral-atom-quantum-roadmap-with-2028-fault-tolerant-launch-on-amazon-braket/

[18] C. Zhao et al., "Towards Ultra-High-Rate Quantum Error Correction with Reconfigurable Atom Arrays" (arXiv, 2026). https://arxiv.org/abs/2604.16209

[19] D. Aharonov and M. Ben-Or, "Fault-Tolerant Quantum Computation With Constant Error Rate" (arXiv, 1999). https://arxiv.org/abs/quant-ph/9906129

[20] S. Aaronson and D. Gottesman, "Improved Simulation of Stabilizer Circuits," Physical Review A 70, 052328 (2004). https://arxiv.org/abs/quant-ph/0406196

[21] S. Bravyi and A. Kitaev, "Universal Quantum Computation with ideal Clifford gates and noisy ancillas," Physical Review A 71, 022316 (2005). https://arxiv.org/abs/quant-ph/0403025

[22] C. Gidney, N. Shutty, and C. Jones, "Magic state cultivation: growing T states as cheap as CNOT gates" (arXiv, 2024). https://arxiv.org/abs/2409.17595

[23] E. Rosenfeld, C. Gidney, G. Roberts, et al., "Magic state cultivation on a superconducting quantum processor" (arXiv, 2025). https://arxiv.org/abs/2512.13908

[24] NIST, "NIST Releases First 3 Finalized Post-Quantum Encryption Standards" (2024). https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards