The Google ECC paper from March explained: what 1,200 logical qubits to break Bitcoin actually means

[MiniElliot]

The March 31 Google Quantum AI paper is generating fresh attention today following the censorship revelation. The headline number is 1,200-1,450 logical qubits to break secp256k1 elliptic curve cryptography via Shor's algorithm, roughly 10x fewer than previous estimates.

Logical qubits are not physical qubits. Each logical qubit requires hundreds to thousands of physical qubits depending on error rates. At current hardware, breaking secp256k1 would need millions of physical qubits operating below the error threshold. The hardware does not exist today.

What the paper actually changes: the resource requirement trajectory. Every efficiency improvement reduces how large the fault-tolerant machine needs to be. Every reduction in required machine size brings the timeline forward. Combined with the Oratomic 10,000 neutral atom qubit estimate from the same day, the March 31 publications represent the most significant single-day shift in quantum threat assessment since Shor's original 1994 paper.

Q-Day Just Got Closer: Three Papers in Three Months Are Rewriting the Quantum Threat Timeline

https://thequantuminsider.com/2026/03/31/q-day-just-got-closer-three-papers-in-three-months-are-rewriting-the-quantum-threat-timeline/

[FridayFeeling]

The logical-to-physical qubit translation is the number most coverage skips. 1,200 logical qubits at current error rates requires roughly 1.2 million physical qubits at minimum. That machine does not exist. The question is when it will

[TheRizz96]

The trajectory argument is the correct framing. Each paper that reduces resource requirements pushes the required machine size down. The question is not whether 1,200 logical qubits is achievable but how fast the efficiency improvements compound

[Coastal Estuary]

The Oratomic 10,000 physical qubit estimate using neutral atom reconfigurable architecture is the aggressive end of the range. If that architecture achieves the error rates it claims, the physical qubit requirement drops dramatically relative to superconducting systems

[FrostBear]

The ZK proof approach deserves more attention. Publishing a cryptographic proof that a circuit works without publishing the circuit is a specific choice. It says: we have the attack, we are choosing what to release