IonQ shipped a 256-qubit machine and the paper saying you need 19,397
The same company published a fault-tolerant estimate for breaking bitcoin's curve in under 26 days, on hardware its own roadmap does not reach until 2028.
IonQ spent one day being two different companies.
On 8 September 2026 it unveiled Superion 256, a trapped-ion quantum computer taking orders now for delivery in 2027. The same day it published the first fully compiled, end-to-end fault-tolerant estimate of what it would take to run Shor's algorithm against secp256k1, the elliptic curve bitcoin uses to sign transactions.
Its answer is 19,397 physical qubits and 25.7 days per attempt.
So the machine IonQ is selling is roughly one seventy-sixth of the machine IonQ says the attack needs, and the paper places that scale on the company's own hardware roadmap, in the "~2028 timeframe". Decrypt made the necessary correction, which is that a 256-qubit computer does not break 256-bit security because the two numbers count different things. True, and probably too gentle about how strange the day was.
A hardware vendor published its product launch and its own countdown clock in the same news cycle (and sells post-quantum key distribution to the people reading both).
The research is better than the marketing around it
We are not accusing IonQ of hype. It flagged the shift itself, and its chairman and chief executive Niccolo de Masi said so on the record: "In 2025, I flagged that the Q-Day time horizon was shifting materially earlier - from the 2030s to the 2020s." Their estimate carries a provable lower bound on success probability rather than a heuristic argument, which is more than most vendor research offers.
And IonQ ran responsible disclosure on it. On a resource estimate. For a public curve. That is either admirable or the most elaborate courtesy in computing, and we cannot decide which.
What 26 days means for a coin, which is the part the coverage skipped
IonQ is precise about the kind of exposure this is. In its words the exposure "relates to authentication and integrity rather than to confidentiality", and a signature compromise "is exploitable going forward rather than retroactively".
Bitcoin, in other words, does not have a harvest-now-decrypt-later problem. It has a public-key-already-exposed problem. To steal with Shor you need your target's public key, and then you need the coins to sit still for the better part of a month while you grind.
A pending transaction sits in the mempool for minutes. Nobody is stealing that.
What you can steal, given most of a month, is whatever sits at an address whose public key is already visible on chain and has not moved in years. Start with the earliest outputs, which paid straight to a public key rather than to a hash of one. Reused addresses. Wallets whose owner is dead, or has lost the keys.
Which means the quantum threat to bitcoin is, first of all, a threat to the coins nobody is watching. Satoshi's among them.
That reframes the migration debate rather than accelerating it
Every schedule already in motion protects live users. The Ethereum Foundation has set a December 2029 deadline for quantum-resistant transactions, validators and data storage, and Galaxy put up to $5 million behind bitcoin quantum-security work in July. We wrote about the cryptography underneath the Ethereum side of that in Vitalik's cheap post-quantum signatures come with a canonical ISA attached.
Live users are probably the easy case, because a modern wallet reveals its public key only at the moment it spends. Harder by far are the old exposed-key coins, which no soft fork can migrate, because nobody alive can sign for them.
So we would expect the first serious bitcoin quantum fight to be about what to do with those coins — freeze them, sunset them, or leave them out as a bounty — rather than about which signature scheme replaces the current one. We would expect it to reach a public BIP discussion before the end of 2027. (The arguments are already circulating; they just have no deadline attached.) A credible demonstration of Shor at even trivial scale on a fault-tolerant machine would pull that forward by a year.
The number that decides all the others is a manufacturing number
IonQ says moving from laser control to semiconductor control cuts cost per qubit by more than 300 times across its roadmap, and that working with SkyWater's foundry compressed its design cycle from nine months to two.
Qubit counts now look like a function of manufacturing rather than of physics. Manufacturing is the thing IonQ just bought.
What is your bitcoin's public key doing right now?
