Hadamard Get the app

How Many Qubits to Break RSA-2048? From 20 Million to 22,593

How Many Qubits to Break RSA-2048? From 20 Million to 22,593 — Hadamard

How many qubits does it take to break RSA-2048? Published estimates have dropped from 20 million noisy qubits in 2019 to 22,593 cat qubits in an Alice & Bob paper from October 2026, with a runtime of 3.14 days. That lowest figure only holds for hardware that almost never suffers bit-flips, and no machine anywhere near that size exists yet.

Below we explain what the new estimate claims, why the number keeps falling, how it compares with the other estimates, and what it means for your post-quantum migration timeline.

How many qubits to break RSA-2048? The short answer

Each estimate rests on its own assumptions about error rates, error-correction codes and how long you’re willing to let the computation run. That makes the numbers hard to compare directly. Even so, the trend is clear:

  • 2019: 20 million noisy qubits, 8 hours (Gidney and Ekerå)
  • 2025: fewer than one million noisy qubits, under a week (Gidney)
  • 2026: fewer than 100,000 physical qubits with QLDPC codes (Iceberg Quantum’s Pinnacle architecture)
  • October 2026: 22,593 cat qubits, 3.14 days (Alice & Bob)

Every estimate from 2025 and 2026 on this list is a preprint or an ePrint. None has been peer-reviewed, and none has been demonstrated on hardware. They are engineering blueprints, not working attacks.

What Alice & Bob actually claimed

The paper is titled “Shor’s algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days”. It was published as IACR ePrint 2026/2665 on 28 October 2026. The authors are Axel Pappalardo, Dahmun Goudarzi, Victor Hertz, Hugo Jacinto, Larissa Kroell, André Schrottenloher, Peter Shanahan, Élie Gouzien, Rémi de La Vieuville and Vivien Londe.

The paper covers two architectures, repetition cat codes and LDPC cat codes. It doesn’t start from scratch. It adapts the adder from Gidney’s 2025 estimate and borrows factory and lookup designs from Kroell et al.’s FeMoco estimate.

The headline figure depends on these assumptions:

  • a 1 µs error-correction cycle
  • a 10 µs reaction time
  • circuit-level phase-flip noise of pZ = 5×10⁻⁴
  • no bit-flips, which the paper models as a bit-flip time of about 100 years

In the company’s blog post, CEO Théau Peronnin rounds the result to “about 23 000 physical qubits and about three days to break RSA-2048”. The post also traces how the company’s own estimates have fallen: about 350,000 qubits in 2023, just under 100,000 in 2024 and about 23,000 now.

The same machine, tuned for size or for speed

The paper doesn’t offer a single number. It describes a trade-off curve. In Peronnin’s words, “The same design can trade one for the other.” The paper gives several points on that curve:

  • About 611,000 cat qubits could factor RSA-2048 in 1.25 hours.
  • If the bit-flip requirement is relaxed to about one hour, roughly 45,000 qubits are needed. That version adds a distance-3 bit-flip code as an extra layer of concatenation.
  • Breaking ECDLP on secp256k1, the elliptic curve used by Bitcoin, takes at most 30,000 qubits in about 1 hour.
  • FFDLP-512, a 512-bit finite-field discrete logarithm, takes about 6,700 qubits in 21 minutes. The authors suggest it as an intermediate benchmark.

The Quantum Insider’s coverage, based largely on the company’s press release, gives the elliptic-curve figure more precisely: 29,588 physical qubits in 61.8 minutes. The same article reports that Alice & Bob claims about 40 times fewer physical qubits than Gidney’s 2025 estimate. A footnote says this comparison is the company’s own extrapolation.

Why cat qubits need fewer qubits for Shor’s algorithm

An ordinary qubit can fail in two ways. A bit-flip swaps 0 and 1. A phase-flip corrupts the relative sign between them. General-purpose error-correcting codes such as the surface code have to catch both kinds of error, which costs a lot of physical qubits for every logical qubit.

Cat qubits are designed to suppress bit-flips in the hardware itself. The error-correcting code then only has to deal with phase-flips. Because there is effectively one error type to correct, the code can be much simpler, and that is where most of the savings in Shor’s algorithm on cat qubits come from.

The catch sits in the assumptions. The 22,593 figure treats bit-flips as essentially absent, with a bit-flip time of about 100 years. If hardware only manages about one hour, the paper’s own estimate roughly doubles to about 45,000 qubits, because an extra bit-flip code layer is needed. So “22,593 cat qubits” is not the same claim as “22,593 qubits”. It describes a specific kind of hardware with a very demanding performance target.

The phase-flip noise assumption, pZ = 5×10⁻⁴, is also stricter than the 10⁻³ gate error that the surface-code and QLDPC estimates below assume. The comparison is therefore not like-for-like. Each paper is optimising for a different hardware platform.

RSA-2048 quantum resource estimates side by side

Estimate Date Physical qubits Runtime Key assumptions
Gidney & Ekerå May 2019 (Quantum, 2021) 20 million 8 hours 10⁻³ gate error, 1 µs surface-code cycle, 10 µs reaction time
Gidney May 2025 Fewer than 1 million Under a week 0.1% error, 1 µs cycle, 10 µs reaction time, nearest-neighbour square grid
Iceberg Quantum, Pinnacle Feb 2026 (v2 May 2026) Fewer than 100,000 About one month (for the roughly 100,000-qubit configuration) QLDPC codes, 10⁻³ error, 1 µs cycle, 10 µs reaction time
Cain et al. (Oratomic/Caltech) Mar 2026 26,000 physical qubits (the configuration the abstract gives runtimes for; the title says Shor’s algorithm is possible with as few as 10,000) One to two orders of magnitude longer than P-256’s “few days” Neutral-atom architecture
Alice & Bob Oct 2026 22,593 cat qubits 3.14 days pZ = 5×10⁻⁴, 1 µs cycle, 10 µs reaction time, bit-flip time about 100 years

Gidney million qubits RSA: the 2019 and 2025 papers

Craig Gidney and Martin Ekerå’s 2019 paper, “How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits”, set the reference point for years. Gidney’s May 2025 follow-up kept the same hardware assumptions and cut the count to under one million qubits, with a runtime under a week. Much of that came from algorithmic work: it uses over 100x fewer Toffoli gates than the 2024 approach by Chevignard, Fouque and Schrottenloher.

qLDPC: the Pinnacle architecture and 100,000 qubits

Iceberg Quantum’s Pinnacle Architecture paper by Webster et al. kept the same 10⁻³ error, 1 µs cycle and 10 µs reaction-time assumptions. It swapped the surface code for quantum LDPC codes, which store logical qubits more efficiently. The result is fewer than 100,000 physical qubits. The figure caption in the v2 paper says that configuration “allows factoring in one month”, so the smaller machine comes with a longer runtime.

Neutral atoms: Cain et al.

The paper by Cain, Xu, King, Picard, Levine, Endres, Preskill, Huang and Bluvstein is titled “Shor’s algorithm is possible with as few as 10,000 reconfigurable atomic qubits”. Its clearest result concerns elliptic curves: P-256 could be solved with 26,000 physical qubits in a few days. RSA-2048 takes one to two orders of magnitude longer.

The pattern across all five papers is consistent. The numbers fall because of better arithmetic circuits, more efficient codes (QLDPC and cat codes) and a willingness to accept runtimes of days or weeks instead of hours.

Where real quantum hardware stands today

Compare those blueprints with machines that have actually been built:

The gap is still large. The biggest arrays have thousands of qubits that are not yet entangled. The best demonstrations of error correction use around a hundred qubits. Every resource estimate above assumes a fault-tolerant machine running continuously for hours to weeks.

Alice & Bob itself expects improving hardware and shrinking resource requirements to meet in the early 2030s, according to The Quantum Insider. That is the company’s projection, not an observed trend.

What it means for RSA, elliptic curves and Bitcoin

The more important number for many systems may be the elliptic-curve result, not RSA. Both the Alice & Bob and the Cain et al. papers estimate elliptic-curve attacks at roughly the same qubit counts as RSA or lower, with shorter runtimes. That affects ECDSA keys in TLS, code signing and blockchains.

For Bitcoin, The Quantum Insider notes that an ECDLP attack taking about an hour is longer than Bitcoin’s 10-minute block time. That matters most for an attacker who tries to crack a key from a transaction before it is confirmed. It gives no comfort for public keys that are already visible on-chain. Our article on BIP-360 P2MR and Bitcoin’s bc1z address looks at one proposed response and its limits.

The policy timeline hasn’t changed: US and UK guidance aims to complete the post-quantum transition by 2035. As PQShield’s Ali El Kaafarani told The Quantum Insider, “The post-quantum standards to replace vulnerable cryptography already exist.” Peronnin’s post adds a caution: “Post-quantum standards already exist, but they have not been tested nearly enough”. Both points argue for starting migration early, because large systems take years to move. You can follow where browsers, messengers and blockchains stand in our post-quantum migration tracker.

This is the problem Hadamard works on. BB84 is a Layer 2 rollup on Ethereum that uses no ECDSA. Accounts are one-time addresses built on hash commitments, so their security doesn’t rest on the elliptic-curve problem that these estimates target.

FAQ

Can a quantum computer break RSA-2048 today?

No. The largest arrays hold thousands of qubits that are not yet entangled, and the best error-correction demonstrations use around 100 qubits. Every estimate assumes a large, fault-tolerant machine that doesn’t exist yet.

Why do estimates keep falling from 20 million to 1 million to 23,000?

For three reasons: more efficient arithmetic in Shor’s algorithm, error-correcting codes that need fewer physical qubits (QLDPC and cat codes), and accepting longer runtimes. Alice & Bob’s 3.14-day figure takes much longer than the 8 hours in the 2019 estimate.

Are 23,000 cat qubits the same as 23,000 ordinary qubits?

No. The figure assumes the hardware almost eliminates bit-flips, with a bit-flip time of about 100 years. If that time is only about one hour, the same paper estimates roughly 45,000 qubits.

Are Bitcoin and elliptic-curve keys at risk sooner than RSA?

Possibly. The ECDLP estimate for secp256k1 is about 30,000 qubits in about an hour, which is still longer than Bitcoin’s 10-minute block time. Public keys that are already exposed have no such time limit. Official guidance targets a full post-quantum transition by 2035.

Sources