What was shown
The authors took an existing design for the attack, which needs 2871 reliable qubits, and asked how many real, error-prone qubits would be needed to build them. Think of a committee of unreliable clerks who check each other's work until the group answers reliably: many physical qubits together make one reliable one. The authors assumed such a machine, with each checking round taking a millionth of a second and each physical operation failing in one case in a thousand. They then added up the physical qubits for two deadlines, one hour and one day. This is a calculation on paper. No machine was built or run.
“It would require approximately 317 million physical qubits to break the encryption within one hour using the surface code, a code cycle time of 1 μ s, a reaction time of 10 μ s, and physical gate error of 10⁻³. To break the encryption instead within one day it would require 13 million physical qubits.”
— Abstract; Section 3.2 and Figure 2A, in: The Impact of Hardware Specifications on Reaching Quantum Advantage in the Fault Tolerant Regime1
- How it was done: a calculation on paper, not run on any machine
- Qubits: The attack needs 2871 reliable qubits as input; the physical counts of 317 million and 13 million are estimates, not hardware.
- Error correction: A fault-tolerant machine is assumed, in which many physical qubits are combined into each reliable one; none was built.
- Compared against classical computing: no comparison stated in the paper
Who it affects
Cryptocurrency networks such as Bitcoin, and any organization whose security rests on the same kind of key encryption. The task is stealing or forging digital keys within a short time window. For someone in this field today, nothing changes operationally. The paper gives a measurable yardstick: how large a machine would have to be before the attack becomes a threat.
Every organization that relies on public-key cryptography: no market estimate is used here. What sets the pace are official deadlines to replace today's public-key encryption: NSA by 2030 and 2035; UK National Cyber Security Centre by 2031 and 2035; European Commission by 2030; BSI and partner agencies of European states by 2030; Canadian Centre for Cyber Security by 2035. These are government deadlines, not forecasts, and they do not depend on this paper.
What is still missing
The gap is the machine itself. The paper is a resource estimate, not a demonstration. The attack assumes a fault-tolerant machine with 317 million physical qubits for the one-hour case, or 13 million for the one-day case, with each physical operation failing in one case in a thousand. Whether and when such a machine exists is not addressed by the paper. No hardware run supports any of these figures.
Against published roadmaps: the task needs 317 million physical qubits. No announcement we have on file reaches that many physical qubits. The furthest any of them goes:
An announcement is not a delivered machine, and this one would still fall short of what the task needs.
Who is working on it
The paper (August 2021) lists its authors' affiliations as: Sussex Centre for Quantum Technologies, Department of Physics and Astronomy, University of Sussex; Universal Quantum; Qu & Co B.V. That is who signed this work — it is not a ranking of who is ahead.
The result strengthens hardware with slower correction rounds, such as trapped ion machines that shuttle their qubits around. They can still reach desirable run times given enough physical qubits, which makes scalability decisive for them.
How this brief was made
This brief was written by software, not by a person: a language model read the full text of the paper, and code then checked every quotation, number and name in this brief against that text before it was published. The rules are set out under Method. Responsible for the rules and for this page: Georg Singer. The paper is a preprint that has not been peer-reviewed. Georg Singer holds no shares in any company or institution named in this brief (as of October 2026).