Only 10,000 qubits needed, 69 million dormant Bitcoins face "opening box" countdown

According to 1M AI News monitoring, on the same day the Google Quantum AI white paper was released, the neutral-atom quantum computing startup Oratomic published a paper on arXiv, saying that Shor’s algorithm can be run on a cryptography-relevant scale using only about 10,000 reconfigurable atomic qubits. The paper directly takes the low-depth Shor circuit optimized by Google as input, and on that basis optimizes another layer of the quantum computing stack: Google compresses the number of logical qubits required by the algorithm (from the thousands down to about 1,200), while Oratomic compresses the number of physical qubits required for each logical qubit. With both layers of optimization combined, the hardware scale required to break encryption has been pushed to an unprecedented low point.

Oratomic’s key approach is to replace the traditional surface code with a high code-rate qLDPC code. The surface code is the leading quantum error correction scheme today; Google’s superconducting approach uses it as well, but its encoding efficiency is low—each logical qubit needs about 400 physical qubits, for a total of roughly 500,000. The qLDPC code has an encoding rate of about 30%, meaning it can protect the same number of logical qubits with far fewer physical qubits, compressing total demand from the million-quantum-bit level by about two orders of magnitude.

The paper presents multiple sets of architecture options (assuming a stabilizer measurement cycle of 1 millisecond):

1. About 10,000 physical qubits can run Shor’s algorithm to break 256-bit elliptic-curve encryption (the encryption scheme used by Bitcoin and Ethereum); runtime depends on the level of parallelism
2. With about 26,000 physical qubits, the runtime for breaking elliptic-curve encryption is about 10 days
3. With about 102,000 physical qubits, the runtime for breaking RSA-2048 is about 97 days

The tradeoff is speed: the clock frequency of neutral atoms is far lower than that of superconducting systems, so breaking once takes days rather than minutes. But this doesn’t mean the threat is smaller. Google’s superconducting approach (500,000 qubits, 9 minutes) is suitable for hijacking actively broadcast real-time transactions; Oratomic’s neutral-atom approach (10,000–26,000 qubits, a few days) is suitable for attacking public keys that have already been exposed in dormant wallets, and such attacks do not require racing against time. The Google white paper estimates that about 6.9 million Bitcoins fall into this category.

The hardware gap is narrowing. The paper notes that neutral-atom experiments have already demonstrated physical capture arrays of more than 6,100 qubits, though these arrays have not yet enabled quantum computation. Neutral-atom systems with fault-tolerant computing capability currently have about 500 qubits. From 500 to the 10,000 qubits required by the paper, the gap is about 20x—far smaller than the superconducting route’s gap of about 5,000x (currently about 100 versus needing 500,000). The paper’s authors are from Oratomic and are also affiliated with the California Institute of Technology; members include quantum computing authority John Preskill and Manuel Endres. The corresponding author is Dolev Bluvstein. The paper’s conclusion says that further hardware speedups and error-correction improvements could shorten runtime by another order of magnitude—possibly down to the scale of hours or minutes.