Pith. Sign in

REVIEW

Computing 256-bit elliptic curve discrete logarithms in 26 days on a fault-tolerant trapped-ion quantum computer with 20,000 qubits

PaperPDF from arXiv

data files

ReviewThe objections and verdict, as JSON Paper breakdownThe authors' claims, conditions and measurements, as JSON Signed receiptProof this review has not been altered
X Bluesky LinkedIn Reddit Hacker News
Thomas Häner, Felix Tripier, Jacob Young, Michael Naehrig, Andrii Maksymov, Safwan Alam, Dmitri Maslov, Matthew Parrott
show 6 more authors
Yvette de Sereville, Jordan Sullivan, Mark Webster, Nicolas Delfosse, John Gamble, Martin Roetteler

Quantum Physics · Submitted 4 Sep 2026 · 90 references

Pith's verdict: The most complete ECDLP resource estimate yet — 19,397 qubits / 25.7 days for secp256k1 with internally consistent numbers and a real verification pipeline; the success probability leans on an extrapolated logical error rate with no quantified uncertainty, which is a fixable gap, not a fatal one.

T0 · AI review

How this review was made: An AI referee (deepseek/deepseek-v4-flash) read the paper on September 9, 2026 and answered a fixed list of questions about it. T0 is the starting level every paper gets. The levels describe how deeply Pith has checked the paper, never the authors.

  1. T0 AI review An AI read the paper and answered a fixed list of questions.
  2. T1 Audit Automatic checks that the references and files the paper relies on exist and match.
  3. T2 Compute The paper's code or calculations re-run with the same results.
  4. T3 Formal statement The claims written out in a formal math language a computer can read.
  5. T4 Proof Those claims proved, and the proof checked by computer.

How Pith checks papers →

· 2 major objections · 6 minor · Ask about this paper · The compiled record · Read the full review →
Challenge this review Comment (0) Read on arXiv ↗
Cite ▾
arXiv ID2609.05625 (version 1)
Pith IDMY53FHFY, Pith's permanent record of this paper and its review
CitationAndrii Maksymov, Dmitri Maslov, Felix Tripier, Jacob Young, John Gamble, Jordan Sullivan, Mark Webster, Martin Roetteler, Matthew Parrott, Michael Naehrig, Nicolas Delfosse, Safwan Alam, Thomas H\"aner, Yvette de Sereville. "Computing 256-bit elliptic curve discrete logarithms in 26 days on a fault-tolerant trapped-ion quantum computer with 20,000 qubits." arXiv:2609.05625 (2026). https://pith.science/paper/MY53FHFY
Cite this reviewBibTeX for Pith's review of this paper
Claim paper

Why Pith says this

Highlight any text to comment on it.

Referee report

How Pith checks papers → · Full audit of this paper →

The paper

The paper claims

A fault-tolerant trapped-ion quantum computer with 19,397 physical qubits can solve the 256-bit elliptic curve discrete logarithm on secp256k1 in 26 days, given a physical error rate of 10^-4.

The reading

Shor's algorithm threatens elliptic-curve cryptography, but prior resource estimates for breaking 256-bit curves required millions of physical qubits. This paper argues that a specialized trapped-ion architecture—the Walking Cat—can reduce that to under 20,000 qubits by optimizing every layer: circuit design, logical compilation, and physical error correction. The claim is that 19,397 qubits running for 26 days would compute a discrete logarithm on secp256k1, the curve securing Bitcoin. If true, it tightens the timeline for post-quantum migration.

What carries the argument

The Walking Cat Architecture for trapped-ion quantum computing, extended with the CLAW ISA (Clifford-frame and Logical-operator Acceleration for Workloads). Key components: the Q102 quantum LDPC code ([ [102,22,9]) for memory blocks, the Eastinthillation CCZ magic-state factory directly producing CCZ states in a Q66 code block, and the swap-loss model for qubit loss and leakage. Together they enable depth-one CCZ injection, parallel logical measurements with disjoint supports, and efficient frame clearing via logical CliNR, reducing Toffoli gate time by a factor of 31.

Extended reading notes

Core claim

The paper demonstrates that a fault-tolerant trapped-ion quantum computer with 19,397 physical qubits, using the Walking Cat Architecture, can solve the ECDLP on secp256k1 in approximately 25.7 days with a single-run success probability between 40.7% (rigorous lower bound) and 63.3% (heuristic estimate). This is achieved through a 31× reduction in Toffoli gate execution time via a fast CCZ magic-state factory, depth-one CCZ injection, and parallel cat-based measurements; a 39,200-qubit saving by pipelining the logical CliNR scheme; and a more efficient loss correction protocol that eliminates beacon qubits.

Load-bearing premise

Physical two-qubit gate error rate is $10^{{-4}}$ and single-qubit error rate is $10^{{-5}}$, with loss/leakage rates at p/1000 and p/10; logical error rates are extrapolated from noise simulations at higher p using an ansatz p_log = $p^{5}$ exp(a+bp+$cp^{2}$), making the results sensitive to the accuracy of that extrapolation.

Editorial extensions

If this is right

  • Bitcoin's elliptic-curve cryptography (secp256k1) would be breakable by a moderately-sized quantum computer, implying a need for urgent migration to post-quantum signatures.
  • The resource estimates set a new low bar for breaking 256-bit ECDLP, potentially accelerating the timeline for quantum advantage in cryptanalysis.
  • The optimized circuits and architecture components (fast CCZ factory, CliNR pipelining, swap-loss model) are transferable to other quantum algorithms, reducing the qubit count and runtime for Shor's factoring and other applications.
  • A five-device parallel run would raise the success probability to 99.3%, making single-attack failure not a barrier to practical breakage.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's assumed physical error rates (10^{-4} for two-qubit gates, 10^{-5} for single-qubit) are at the edge of current experimental demonstrations; extrapolating logical error rates from higher-noise simulations using a three-parameter ansatz introduces uncertainty that could raise the qubit count or runtime by a factor of 2-3 if physical noise is higher.
  • The reliance on a single family of adders (Gidney-style) and conservative design choices suggests that further optimization could lower resource estimates, but also that the architecture is not yet fully optimized for runtime or qubit count.
  • The swap-loss model assumption (p_swap=0.5) may not capture all physics of ion trap merges; a more detailed microarchitecture model could modify loss correction overheads.
  • If the architecture scales to the 20,000-qubit level, other cryptographically relevant problems (e.g., 256-bit elliptic curves not pseudo-Mersenne) would require more qubits or time, limiting the immediate threat to curves like Curve25519.
Original abstract

One of the strengths of our recently proposed Walking Cat Architecture for a trapped-ion quantum computer is that it is straightforward to extend and optimize for a specific application. As a proof-of-concept, here we present such optimizations for solving the $256$-bit elliptic curve discrete logarithm problem (ECDLP) on $\mathtt{secp256k1}$, which is the elliptic curve used by blockchain technologies such as Bitcoin, using Shor's algorithm. We optimize the circuits from Schrottenloher's recent work and arrive at a logical quantum circuit for solving the ECDLP using about $1450$ qubits and $40\cdot 10^6$ Toffoli gates, with a rigorous lower bound on the logical-level success probability that holds with confidence at least $1-2^{-128}$. Using our compilation toolchain with manual optimization of the logical layout and integrated routing, we produce estimates for the logical measurement depth and the required number of physical qubits by compiling all components to measurement schedules that obey the architectural constraints. A key ingredient is a fast CCZ magic-state factory and a depth-one CCZ state injection, reducing the execution time of CCZ gates by a factor of $31$. We increase the logical-measurement parallelism using non-overlapping cat-based measurements in parallel, and we leverage the recently proposed logical CliNR protocol to speed up Clifford operations. To reduce the qubit overhead, we introduce a more efficient loss correction protocol, design a layout that allows us to recycle the CliNR ancilla qubits, and provision reusable cat-state resources according to the circuit's peak measurement parallelism. All results and optimizations combined, we conclude that a trapped-ion quantum computer based on our architecture can solve the ECDLP on $\mathtt{secp256k1}$ in approximately 25.7 days using 19,397 physical qubits with an estimated success probability of $63\%$.

The compiled record

The paper's own sentences, arranged, kept beside the review and separate from it. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.

Compiled by classifier-1.13.0 via TypeSafe API, question bank abstract-p1-20260923, 2026-09-23: 1 request, 6,821 input tokens.

What the abstract itself states, as probabilities: claims first 0.05 · states limitation 0.42 · human participants 0.02 · controlled comparison 0.04 · randomized assignment 0.01 · states quantitative result 0.99 · compares with prior results 0.31 · mentions code or data availability 0.04.

The abstract, sentence by sentence

arXiv listing abstract v1. Results and the main claim are underlined; .

One of the strengths of our recently proposed Walking Cat Architecture for a trapped-ion quantum computer is that it is straightforward to extend and optimize for a specific application. As a proof-of-concept, here we present such optimizations for solving the $256$-bit elliptic curve discrete logarithm problem (ECDLP) on $\mathtt{secp256k1}$, which is the elliptic curve used by blockchain technologies such as Bitcoin, using Shor's algorithm. We optimize the circuits from Schrottenloher's recent work and arrive at a logical quantum circuit for solving the ECDLP using about $1450$ qubits and $40\cdot 10^6$ Toffoli gates, with a rigorous lower bound on the logical-level success probability that holds with confidence at least $1-2^{-128}$. Using our compilation toolchain with manual optimization of the logical layout and integrated routing, we produce estimates for the logical measurement depth and the required number of physical qubits by compiling all components to measurement schedules that obey the architectural constraints. A key ingredient is a fast CCZ magic-state factory and a depth-one CCZ state injection, reducing the execution time of CCZ gates by a factor of $31$. We increase the logical-measurement parallelism using non-overlapping cat-based measurements in parallel, and we leverage the recently proposed logical CliNR protocol to speed up Clifford operations. To reduce the qubit overhead, we introduce a more efficient loss correction protocol, design a layout that allows us to recycle the CliNR ancilla qubits, and provision reusable cat-state resources according to the circuit's peak measurement parallelism. All results and optimizations combined, we conclude that a trapped-ion quantum computer based on our architecture can solve the ECDLP on $\mathtt{secp256k1}$ in approximately 25.7 days using 19,397 physical qubits with an estimated success probability of $63\%$.

background contribution method result interpretation main claim

What the classifier reports for each sentence. The number is the probability it gave the label.
#sentencerolethe authors' own workstates the main conclusionstrength
s0 One of the strengths of our recently proposed Walking Cat Architecture for a trapped-ion quantum computer is that it is straightforward to extend and optimize for a specific application. background 0.87 0.27 0.02 asserted 1.00
s1 As a proof-of-concept, here we present such optimizations for solving the $256$-bit elliptic curve discrete logarithm problem (ECDLP) on $\mathtt{secp256k1}$, which is the elliptic curve used by blockchain technologies such as Bitcoin, using Shor's algorithm. contribution 0.97 0.83 0.06 asserted 0.99
s2 We optimize the circuits from Schrottenloher's recent work and arrive at a logical quantum circuit for solving the ECDLP using about $1450$ qubits and $40\cdot 10^6$ Toffoli gates, with a rigorous lower bound on the logical-level success probability that holds with confidence at least $1-2^{-128}$. result 0.70 0.94 0.07 asserted 1.00
s3 Using our compilation toolchain with manual optimization of the logical layout and integrated routing, we produce estimates for the logical measurement depth and the required number of physical qubits by compiling all components to measurement schedules that obey the architectural constraints. method 0.99 0.95 0.02 asserted 0.97
s4 A key ingredient is a fast CCZ magic-state factory and a depth-one CCZ state injection, reducing the execution time of CCZ gates by a factor of $31$. method 0.86 0.79 0.02 asserted 1.00
s5 We increase the logical-measurement parallelism using non-overlapping cat-based measurements in parallel, and we leverage the recently proposed logical CliNR protocol to speed up Clifford operations. method 0.93 0.82 0.02 asserted 1.00
s6 To reduce the qubit overhead, we introduce a more efficient loss correction protocol, design a layout that allows us to recycle the CliNR ancilla qubits, and provision reusable cat-state resources according to the circuit's peak measurement parallelism. method 0.78 0.94 0.02 asserted 1.00
s7 All results and optimizations combined, we conclude that a trapped-ion quantum computer based on our architecture can solve the ECDLP on $\mathtt{secp256k1}$ in approximately 25.7 days using 19,397 physical qubits with an estimated success probability of $63\%$. result 1.00 0.93 0.97 asserted 0.88

What kind of paper the classifier reports this is: method or tool 0.52 · evidence from simulation or computation 0.95.

What was examined, and what was not

sources read
  • arXiv listing abstract v1
not examined
  • full text
  • figures and tables
  • references and citing sentences
  • relations to other papers
levels run
  • P abstract
not run
  • S sections
  • T body sentences
  • C citations
  • R cross-paper relations

Every quoted sentence on this record is the authors'. Every label is from Pith's closed vocabulary, with the probability shown beside it. Every number in the measurements table is the authors', checked by code. Record as JSON

Figures
Figure 1. FIG. 1: Overview of the paper in terms of an end-to-end
Figure 2. FIG. 2: An arbitrary Pauli-controlled-Pauli (PcP) gate
Figure 3. FIG. 3: Gidney adder layout and circuit.
Figure 4. FIG. 4: Routing of the phase-approximate modular adder as described in algorithm 2.
Figure 5. FIG. 5: Full-scale
Figure 6. FIG. 6: Swap-resilient LDU for data qubit
Figure 7. FIG. 7: Memory performance of the [[102
Figure 8. FIG. 8: Local cat-state circulation for Q102. Three
Figure 9. FIG. 9: Device-level handoff schedule for reusing two cat-state bundles in a measurement stream. Each memory
Figure 10. FIG. 10: Parallel cat-state measurement of two disjoint
Figure 11. FIG. 11: Logical CliNR and its compiler-level motion primitive. (a) The logical CliNR circuit of Webster and
Figure 12. FIG. 12: Schematic temporal structure of the compiled elliptic-curve point-addition circuits. Time runs from left to
Figure 13. FIG. 13: Idle frame clearing around a serial component. Time runs from left to right, and vertical position denotes
Figure 14. FIG. 14: Logical CliNR for three serial components with partially overlapping supports. Each pair (
Figure 15. FIG. 15: Logical CliNR on consecutive serial components with overlapping support. Time runs from left to right,
Figure 16. FIG. 16: Circuit equivalence between a Toffoli gate, a CCZ gate conjugated by Hadamard gates on the target qubit,
Figure 17. FIG. 17: Preparation of two logical
Figure 18. FIG. 18: The Eastinthillation factory circuit.
Figure 19. FIG. 19: Physical measurement schedule for the Eastinthillation factory. C6
Figure 20. FIG. 20: Layout of the four Eastinthillation factories
Figure 21. FIG. 21: Routing of the point-addition algorithm, continued: stages 3–5. The windowed point add ends in the same
Figure 22. FIG. 22: Swap-loss sensitivity of the [[102

Figures reproduced from arXiv:2609.05625 by the authors.

References

Discussion

Disagree with the review, or know something it missed? Leave a comment, highlight any passage above to comment on it, or challenge this review formally.