No Outside Team Has Derived Google's Bitcoin Qubit Floor

Google Quantum AI's March 30 whitepaper claims Bitcoin's secp256k1 cryptography falls to fewer than 500,000 physical qubits, in an attack running nine minutes under idealized assumptions.

The compression is roughly an order of magnitude below prior estimates for the same elliptic curve problem, in a paper co-authored with the Ethereum Foundation and Stanford. The qubit-lean variant needs under 1,200 logical qubits and 90 million Toffoli gates; the gate-lean variant needs under 1,450 qubits and 70 million gates. Both use surface codes at an assumed physical error rate of 10⁻³.

Google's Willow chip, released December 2024 with 105 physical qubits, puts the hardware gap at roughly 4,750 Willow-class chips' worth of scale.

The Verification Problem

The 500,000-qubit floor is not on the same compression curve as RSA-2048. Craig Gidney's 2019 baseline of 20 million physical qubits to break RSA-2048 fell to under one million in a May 2025 update. In February 2026, Iceberg Quantum, a Sydney startup, pushed that figure below 100,000 using quantum low-density parity-check codes.

Google's March paper targets the secp256k1 elliptic curve discrete log problem, not RSA-2048, and uses surface codes. The paper judges surface codes better understood and more feasible than Iceberg's QLDPC approach, given QLDPC's undemonstrated non-planar connectivity requirements.

Google withheld the attack circuits and published instead a zero-knowledge proof using SP1 zkVM and Groth16 SNARK, allowing external verification of the estimate's internal consistency. No outside team has independently derived the same qubit floor from different circuit assumptions.

Quantinuum's 94 error-corrected logical qubits, drawn from 98 physical qubits on its Helios processor, are the best public hardware demonstration as of March 2026. The attack's minimum circuit requires 1,200 logical qubits before the first gate operation.

The Disclosure Logic

Google's choice of ZK proof over published circuits closes off the usual peer-review path. The enterprise procurement calendar runs on a different deadline: NCSC guidance sets 2035 as the completion date for post-quantum migration, a deadline published alongside NIST's August 2024 standards. The qubit floor's independent derivation is still open; the 2035 migration deadline is not.

Watch IBM's Cockatoo in 2027, when the company tests entanglement between fault-tolerant modules for the first time. Any delay there shifts Starling's 200-logical-qubit target past 2029. Starling arriving on schedule still lands six times below the attack floor.