A new estimate puts breaking Bitcoin’s signature curve at 19,397 physical qubits. Previous trapped-ion estimates were 1.2–9.4 million. Not because somebody suddenly built a quantum computer 100× better. Because the estimated cost of fault tolerance collapsed. And it wasn’t the only paper this month. Days later, another team estimated RSA-2048 could be factored with roughly 120,800 superconducting qubits in about one month. Neither machine exists today. But that’s not the interesting part. The interesting part is where all those qubits went. 1/ Bitcoin’s curve IonQ compiled Shor’s algorithm against secp256k1 — the elliptic curve behind Bitcoin signatures — down to a proposed trapped-ion architecture: • 19,397 physical qubits • 1,457 logical qubits • ~39 million Toffoli gates • 25.7 days per attempt The paper gives a 40.7% conservative success bound and a 63.3% heuristic estimate. Earlier trapped-ion estimates for the same problem were in the 1.2–9.4 million physical-qubit range. 2/ RSA-2048 Iceberg Quantum took a very different route using superconducting hardware: • 120,820 physical qubits • ~1 month runtime • 10⁻³ assumed physical error rate • 1 μs error-correction cycles Two different cryptographic targets. Two very different quantum architectures. Both now landing in roughly the same order of runtime: weeks, not years. 3/ Where the numbers went Many older resource estimates relied heavily on 2D surface codes for quantum error correction. Surface codes are attractive because they can work with local connectivity. But the physical-qubit overhead is enormous. Both new architectures instead make heavy use of much denser quantum LDPC codes. IonQ gives a particularly striking comparison. Storing roughly 1,500 logical qubits with its surface-code comparison would require about: 243,000 physical qubits just for memory. Its complete qLDPC-based machine — including memory, computation, routing and magic-state infrastructure — comes out at: 19,397 physical ions. Its Q102 code encodes 22 logical qubits into 102 data qubits. Iceberg uses a different construction protecting 16 logical qubits with 510 data qubits, or 1,020 physical qubits when syndrome ancillas are included. The hardware didn’t suddenly leap forward. The fault-tolerance stack got cheaper. That distinction matters. 4/ The necessary reality check These are engineering blueprints, not working quantum computers. IonQ assumes two-qubit error rates around 10⁻⁴ across a large fault-tolerant trapped-ion machine involving thousands of ions, transport and repeated error correction. That has not been demonstrated at this scale. Iceberg assumes 10⁻³ physical errors, 1 μs cycles and degree-8 fixed connectivity, while extrapolating the performance of its full-size code from smaller simulations. And all fourteen authors of the secp256k1 paper work at IonQ. Its hardware assumptions deserve the same scrutiny we would apply to any vendor-authored roadmap. So no: this does not mean Bitcoin can be broken today. But dismissing these papers because the machines don’t exist yet misses the more important signal. Hardware capability is moving upward while the estimated resource threshold for an attack is moving downward. Both sides of the equation are moving. 5/ What does a 26-day attack actually mean for Bitcoin? At this runtime, it is not a practical 10-minute mempool race. The more interesting targets are coins whose public keys are already exposed while the coins remain at rest: • early P2PK outputs • bare multisig • Taproot outputs • reused addresses whose public keys have already been revealed Glassnode recently estimated that roughly 6.04 million BTC — 30.2% of issued supply — is currently exposed at rest under this broader definition. About 1.92M BTC is structurally exposed through output types such as P2PK, P2MS and P2TR. Another 4.12M BTC comes from operational exposure such as address reuse. An attacker doesn’t need to outrun the next block when the relevant public key has already been sitting on-chain for years. 6/ The real problem: migration debt The exact quantum threshold will keep moving. Someone may publish a 10,000-qubit architecture next year. Someone else may discover an overlooked engineering cost and push the estimate back upward. The number is uncertain. The migration problem is not. Moving a live decentralized monetary network from elliptic-curve signatures to post-quantum signatures means much more than choosing another cryptographic primitive. It touches: • wallet and address formats • transaction sizes • validation costs • software compatibility • hardware wallets and custody infrastructure • and legacy UTXOs whose owners may never migrate That is cryptographic migration debt. Tidecoin took a different path. When Tidecoin launched on December 27, 2020, transaction signatures already used Falcon-512 instead of elliptic-curve cryptography. Falcon was later selected by NIST and is now being standardized as FN-DSA. So Tidecoin does not have a legacy ECC transaction-signature set that must someday be swept into post-quantum addresses. Choosing a post-quantum algorithm is only part of the problem. The harder part is surviving the migration. Tidecoin started on the other side of it. The Tide was early.

While @solana just chose Falcon for post-quantum security… Tidecoin has been running Falcon 512 natively from genesis since Dec 27, 2020. ✅ 5+ years live ✅ 2.3M+ blocks secured ✅ Zero incidents ✅ Smallest PK+sig (~1,563 bytes) ✅ NIST Category 1 quantum resistance