Google says elliptic-curve encryption could be broken with under 500,000 qubits

Why it matters

Google calls this about a 20-fold cut in the qubits needed. Each drop in the estimated size of a code-breaking quantum computer brings the threat closer and adds urgency to the switch to post-quantum cryptography.

Sources (3)

• Google Research Blog Safeguarding cryptocurrency by disclosing quantum vulnerabilities responsibly
  Primary sourceMar 31, 2026

  “We estimate that these circuits can be executed on a superconducting qubit CRQC with fewer than 500,000 physical qubits in a few minutes, given standard assumptions about hardware capabilities that are consistent with some of Google’s flagship quantum processors.”

• arXiv (Babbush et al., Google Quantum AI) Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations
  Primary sourceMar 30, 2026

  “On superconducting architectures with 1e-3 physical error rates and planar connectivity, those circuits can execute in minutes using fewer than half a million physical qubits.”

• The Quantum Insider Google Suggests Quantum Attacks on Cryptocurrency Encryption May Require Fewer Resources
  Independent coverageMar 31, 2026

  “According to the white paper, solving the elliptic curve discrete logarithm problem may require roughly 1,200 logical qubits and under 500,000 physical qubits, with attack times measured in minutes on sufficiently advanced systems.”