Magic States and Record Error Rates: Quantum Error Correction Keeps Pace

Breaking Bitcoin's elliptic curve cryptography (ECC) would require a quantum computer running Shor's algorithm on roughly a thousand logical qubits, each built from many error-prone physical qubits. On paper, that requirement keeps falling, and Google's March estimate for Bitcoin's curve came in under 500,000 physical qubits. The result that would remove reasonable doubt is quantum error correction that holds up across every operation Shor's algorithm depends on, measured end to end on a full computation, repeatedly and improving with scale. No hardware has demonstrated that yet. 

But within four days of each other in October, Google and Quantinuum published hardware results that each address part of that challenge. Google demonstrated a more efficient way to produce the magic states Shor's algorithm depends on, while Quantinuum reported record-low logical error rates that fell sharply as code distance increased. However, neither result completes the picture on its own.

On October 15, Google Quantum AI published in Science the results of an experiment on its Willow processor demonstrating magic state cultivation, a major milestone toward universal fault-tolerant quantum computing. 

To achieve cryptographic relevance, Shor's algorithm needs tens of millions of Toffoli gates, which are built from T gates and Clifford operations. Error correction protects Clifford operations directly. T gates can't be protected that way, so each one consumes a magic state, a quantum state prepared separately to very high quality and used up in the process. A machine running Shor's algorithm therefore needs a constant supply of magic states, and producing them takes up a large share of its qubits. 

The previously established method, magic state distillation, combines many noisy copies into fewer, superior ones at a high cost in qubits. By contrast, cultivation, proposed by Google researchers in 2024, grows a single encoded state while checking it repeatedly, and discards any attempt in which an error appears. On Willow, it cut errors about 40-fold compared with uncultivated states and reached a fidelity of at least 99.99%. 

This matters for Bitcoin because Google's March estimate of under 500,000 physical qubits assumes cultivation, which until now had only been simulated. 

Google prepared and tested the cultivated magic states but did not use them to run an error-protected T gate, which the team lists as future work. The experiment also cultivated its states in the smallest version of its error-correcting code, reaching about one error in 10,000.  The far lower error rates a cryptographic attack needs would come from running cultivation in larger codes, which Google also lists among its next steps.

Four days later, Quantinuum reported a quantum error correction record on Helios, its trapped-ion quantum computer. Error correction works by encoding, where the information of one logical qubit is spread across a group of physical qubits so that errors in individual qubits can be detected and corrected. This happens in repeated rounds, and Quantinuum's logical qubits failed as rarely as five times per million rounds. That is a record, but still far from the roughly one error in a trillion that running Shor's algorithm against ECC requires. 

Closing that gap depends on code distance, which sets the size of the group: a larger distance means more physical qubits per logical qubit. Quantinuum tested three distances, and each step up cut errors by a remarkably high factor of 12 on average. The more each step reduces errors, the fewer physical qubits a logical qubit needs to reach a given level of reliability. 

The record measures a logical qubit that only stores its state, without running any computation, which the paper addresses separately, in the form of operations between two encoded logical qubits. These had about 70 errors per million operations, and each step up in distance cut that rate by a factor of about 9. Compared with the same operations run on unprotected physical qubits, encoding reduced errors 14-fold, up from 4.3-fold in Quantinuum's September result. 

The experiments also stop short of a working fault-tolerant computer. Decoding, which identifies errors from each round's checks, was done after each run rather than while the computer operated,  although Helios runs slowly enough that I do not expect decoding to hold it back. 

Magic states fall outside the paper’s scope, but Quantinuum prepared high-fidelity ones in 2025. It has yet to show their quality improving as codes grow, a step its paper names as still to come. Quantinuum says the work validates its path to a fault-tolerant computer by 2029, and that it will need far fewer physical qubits than other approaches, though that comparison refers to commercial workloads such as chemistry and finance.

The two machines also differ in speed, and speed determines which kind of attack on Bitcoin a quantum computer could carry out first. Trapped ions have lower error rates, but a round of error correction on Quantinuum’s Helios takes around 200 milliseconds, against the one microsecond Google assumes for machines built on superconducting qubits. Google's whitepaper expects a fast machine to enable on-spend attacks, deriving a key in the minutes between a transaction's broadcast and its confirmation.  Against such a machine, hiding a public key behind its hash offers little protection, because the key becomes visible as soon as its coins are spent. 

 A slow machine would need millions of additional qubits to attack that quickly, so keys already exposed would be its first targets. IonQ's September estimate for a trapped-ion machine of about 20,000 qubits put each attempt on Bitcoin's curve at 26 days. Against a machine like that, keeping public keys hidden until coins are spent remains effective protection.

Both results are significant, and I do not think either changes the timeline. They are the kind of progress I expected from two of the companies leading quantum hardware, and my estimate already assumed it; had they failed to appear, I would have pushed it back. 

Taken together, they show where the remaining work sits. Quantinuum corrected operations between logical qubits at record quality, and Google showed that cultivation, the cheaper way of producing the magic states T gates consume, works on their hardware. The threshold I watch needs the two combined: magic states fed into an error-corrected computation, decoded in real time, at growing scale. Both companies name that as their next step.  

With the requirement falling on paper and the hardware moving toward it, the skeptical view remains reasonable only because the distance to the goal is still large. There might be unknown unknowns in front of us that make this more than “just an engineering problem.” Still, these results reinforce the optimistic roadmaps. Progress across several hardware approaches means that an unforeseen barrier could stop one without ruling out the others. With that in mind, I put the probability of a cryptographically relevant quantum computer by 2030 at around 10%. 

All of this rests on what the labs choose to publish. If the flow of results slowed, there would be no telling whether progress had stalled or stopped being disclosed, and I can only assess what I can see.

None of this changes what Bitcoin holders should do today. The address practices we recommend remain the right ones, whichever kind of machine arrives first. The hardware is advancing at the pace the credible roadmaps assumed, and that is the pace Bitcoin's migration has to beat. Progress delivered on schedule is the case a migration plan has to be built for. We follow these developments on our Quantum Hub and track them each month in the Quantum Update.