Loading story…
New quantum-computing research has significantly reduced the estimated resources needed to break widely used public-key cryptography, increasing pressure on organizations still relying on RSA-2048 and 256-bit elliptic-curve cryptography. A 2025 Google Quantum AI preprint reported that RSA-2048 factoring could, in theory, be achieved in less than a week with fewer than 1 million noisy qubits, down roughly 20× from earlier estimates, by combining techniques such as approximate residue arithmetic, yoked surface-code storage, and magic state cultivation. Separate reporting also described architectural work that could cut the hardware needed for RSA-2048 attacks by about tenfold, reinforcing the trend that algorithmic and engineering advances are shrinking the gap between theory and practical cryptanalytic capability.
A 2026 paper on the elliptic-curve discrete logarithm problem similarly reduced the logical-qubit footprint for Shor-based attacks, estimating that a 256-bit prime-field curve could be targeted with about 1,333 logical qubits, down from 2,124 in a prior low-width design. Commentary on the new results highlighted an additional Caltech advance in lower-overhead fault tolerance and argued that, taken together, these developments could bring quantum attacks against systems such as Bitcoin signatures closer than previously expected, with some estimates dropping from millions of physical qubits to around 25,000 under favorable assumptions. While the work remains theoretical and depends on future fault-tolerant hardware, the direction of travel is clear: advances in quantum algorithms and error correction are accelerating the case for migration to post-quantum cryptography.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
An April 2026 research paper introduced a space-efficient quantum algorithm for elliptic-curve discrete logarithms that reduced logical-qubit requirements by improving reversible modular inversion. For a 256-bit prime-field curve, the authors estimated their design would use 1,333 logical qubits, down from 2,124 in a prior low-width implementation.
On April 1, 2026, Scott Aaronson summarized two quantum-computing announcements: a Caltech fault-tolerance result using high-rate codes and a Google result on a lower-overhead implementation of Shor's algorithm for breaking 256-bit elliptic-curve cryptography. He said the combined effect made systems such as Bitcoin signatures appear vulnerable sooner than previously estimated, with Caltech reportedly projecting roughly 25,000 physical qubits instead of millions.
By February 2026, reporting described a new architecture that could cut the quantum hardware needed to break RSA-2048 by about tenfold. This represented a further resource-efficiency development in quantum attacks against RSA, though the provided reference includes no additional technical detail.
In May 2025, a Google Quantum AI preprint by Craig Gidney reported that RSA-2048 could theoretically be factored in less than a week using fewer than 1 million noisy qubits on a fault-tolerant quantum computer. The reduction was attributed to techniques including approximate residue arithmetic, yoked surface-code storage, and magic state cultivation.
A 2019 resource estimate by Google Quantum AI scientist Craig Gidney assessed that factoring RSA-2048 would require roughly 20 million physical qubits under fault-tolerant assumptions. This estimate later became the baseline for subsequent reductions in projected quantum resources.
4 references tracked. Mallory keeps watching after this page renders.
arxiv.org
Open sourcescottaaronson.blog
Open sourcethequantuminsider.com
Open sourcepostquantum.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Quantum AI reported that breaking the `secp256k1` elliptic-curve cryptography used by Bitcoin, Ethereum, and other cryptocurrencies may require far fewer quantum resources than previously estimated. In a new whitepaper co-authored with researchers from the Ethereum Foundation, Stanford, and UC Berkeley, the team said an attack could need fewer than 500,000 physical qubits rather than the millions often cited, with optimized circuits using roughly 1,200 to 1,450 high-quality logical qubits. Under idealized conditions, the research suggests a primed attacker could recover a private key in about nine minutes, making an on-spend attack against a Bitcoin transaction theoretically possible within the network’s typical 10-minute confirmation window. The paper warns that Bitcoin’s 2021 **Taproot** upgrade may have increased long-term quantum exposure by making public keys visible on-chain by default, and estimates that about **6.9 million bitcoin** are already held in wallets with exposed public keys. Google said it did not publish the attack circuits, instead releasing a zero-knowledge proof using **SP1 zkVM** and **Groth16** so the results could be validated without providing weaponizable details, and said it notified the U.S. government before publication. While the researchers stressed that no cryptographically relevant quantum computer exists today, they argued that the engineering threshold for attacking ECC-based blockchain systems is materially lower than expected and called for migration toward post-quantum cryptography across cryptocurrency ecosystems.
Jun 29, 2026
A multi-institutional roadmap has outlined how **neutral-atom quantum computing** could reach practical quantum advantage within a decade if current scaling trends continue, arguing that recent gains in qubit counts and gate fidelity are beginning to converge with falling theoretical resource estimates for fault-tolerant workloads. The roadmap maps application regimes by computational scale and places cryptanalysis tasks such as `RSA-2048` factoring and `ECC-256` discrete logarithms in the highest resource band, while highlighting **qLDPC** error-correction codes as a potential advantage for neutral-atom systems because their reconfigurable connectivity may reduce physical-qubit overhead compared with surface-code approaches. A related *Nature* paper also reports a fault-tolerant neutral-atom architecture for universal quantum computation, reinforcing the platform’s technical momentum. At the same time, the reporting stresses that cryptanalytically relevant quantum capability is **not imminent**. Major engineering gaps remain in integrating scale, fidelity, decoding, readout, and sustained fault-tolerant operation into a single system, and some roadmap claims still rely on preprints rather than fully matured results. Separate industry analysis argues that while quantum computing often appears to be a "perpetual five-year technology," concrete thresholds such as machines capable of breaking `RSA-2048` are already definable enough for enterprise planning, and that organizations should not use uncertainty over timelines or winning architectures as a reason to delay **post-quantum cryptography** migration.
Aug 2, 2026
Post-quantum security researchers warned that public reporting is becoming an unreliable measure of progress toward cryptographically relevant quantum computers, after high-profile disclosures on Shor-based attacks against elliptic-curve cryptography exposed tensions between openness and national-security concerns. Oratomic publicly released resource estimates and a responsible-disclosure statement for fault-tolerant quantum cryptanalysis, while Google published `ECDLP-256` resource estimates only after consulting the U.S. government and withheld the underlying circuits behind a zero-knowledge proof. The disclosures were presented as evidence that publication decisions around quantum cryptanalysis are becoming sensitive in their own right, with U.S. export controls, executive actions, and other intervention mechanisms cited as tools that could further limit what becomes public. Google’s partial-disclosure approach quickly unraveled: André Schrottenloher independently reconstructed the concealed circuits, and Trail of Bits reportedly forged a proof by exploiting bugs in Google’s prover code, undermining the attempt to reveal results without fully exposing implementation details. Commentaries tied those events to a broader warning that future breakthroughs may be selectively disclosed or kept secret altogether, echoing older intelligence-era norms around cryptanalytic advances. For defenders, the practical message was to stop using public quantum milestones as the trigger for post-quantum migration and instead treat published capability as a lower bound while accelerating cryptographic inventory, dependency mapping, and migration planning.
Jul 12, 2026