Alice & Bob: 30,000 Cat Qubits Could Break Bitcoin Key

Alice & Bob, a quantum computing company based in Paris and Boston, has published an estimate that a quantum computer built from its “cat qubits” could break the elliptic-curve cryptography behind Bitcoin’s signatures in about an hour using no more than 29,588 physical qubits. It is a theoretical figure for a machine that does not exist, but it is far smaller than earlier estimates for the same task.

The work appears in a preprint on the IACR Cryptology ePrint Archive, titled “Shor’s algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days”. The company announced it on 29 October in a press release and a blog post by chief executive Théau Peronnin.

The numbers in the paper

The paper’s main result concerns RSA-2048, the encryption standard that protects much of the web. The ten authors, nine of them at Alice & Bob, estimate that about 22,593 physical cat qubits could factor an RSA-2048 key in 3.14 days. The release says that is 40 times fewer physical qubits than the 2025 estimate by Google Quantum AI’s Craig Gidney, which put the figure below one million.

The Bitcoin figure comes second. Bitcoin signatures rely on the elliptic-curve discrete logarithm problem on a curve called secp256k1. Reusing the operations built for RSA, the paper says solving that problem “requires at most 30 000 cat qubits and 1 hour”. The release gives the balanced setting as up to 29,588 qubits and 61.8 minutes. A slower setting uses up to 28,183 qubits and takes 146 minutes.

These numbers rest on stated assumptions. The paper assumes a one-microsecond error-correction cycle, a fixed level of phase-flip noise, and no bit flips at all during the run. The release’s notes to editors say that is equivalent to a bit flip about once a century. If bit flips happened about once an hour, RSA-2048 would need about 45,000 qubits.

This is not Alice & Bob’s 2023 estimate. That paper, published in Physical Review Letters, put the same elliptic-curve problem at 126,133 cat qubits and nine hours using a simpler error-correcting code. The new work swaps in LDPC-cat codes, first described in 2024, and a redesigned adder circuit that draws on Gidney’s 2025 work. According to the release, the code change alone more than halves the RSA-2048 count, from 49,649 to 22,593.

Why an hour matters for Bitcoin

Bitcoin produces a block roughly every ten minutes. The release says an attack that takes about an hour is too slow to target “transactions in progress”. The concern is older coins whose public keys are already visible on the blockchain, which gives an attacker as much time as needed. TSN has covered how Europol framed exposed keys as the main risk, and the BIP 361 proposal to retire Bitcoin’s old signature types.

Dahmun Goudarzi, a senior cryptanalyst at Alice & Bob and one of the paper’s contact authors, told CoinDesk that “it becomes of utmost importance that migration starts now”. He said the team had not yet worked out whether more qubits could bring the attack below ten minutes, adding: “There is no architectural floor.” CoinDesk compared the new figure with a Google estimate from March of fewer than 500,000 physical qubits, while noting that the two studies assume different hardware.

A smaller target, on hardware still to be built

This is TSN’s analysis. The paper shrinks the target, not the gap. Every figure here assumes a fault-tolerant cat-qubit machine with error rates and bit-flip protection that nobody has shown at scale. Earlier this month, Alice & Bob’s own PROQCIMA results showed errors not yet below threshold. The release itself says “substantial engineering challenges remain”, and the company expects hardware and falling resource needs to meet “in the early 2030s”. That is a forecast from a firm that builds the hardware, not an independent finding, and the preprint has not been peer reviewed.

What the paper does show is how fast the estimates are falling. Peronnin’s blog traces Alice & Bob’s own RSA-2048 figure from about 350,000 cat qubits in 2023 to just under 100,000 in 2024 and about 23,000 now. Other groups are moving the same way, as with Iceberg Quantum’s sub-100,000-qubit RSA estimate last week. Each design rests on different assumptions, so the figures are not like-for-like, but the direction is consistent.

For Bitcoin, the practical point is time. Replacing signature schemes on a decentralised network needs agreement from developers, miners, exchanges and holders, and coins in lost or dormant wallets cannot be moved at all. The release cites US and UK guidance to finish moving to post-quantum cryptography by 2035, and NIST’s transition plan deprecates ECDSA after 2030. If a machine of this size arrives around the early 2030s, as Alice & Bob expects, that leaves little slack.