From 20 Million Qubits to About 10,000: Why Every Big Platform Moved Its Quantum Deadline to 2029

· Threat Intel · 7 min read

The number that keeps shrinking

In 2019 the best public estimate for breaking RSA-2048 was around 20 million noisy physical qubits. By 2025 it was under one million. In March 2026, two papers moved it again.

  • Google Quantum AI (31 Mar 2026) published new resource estimates showing elliptic-curve cryptography on 256-bit curves could fall to roughly 1,200 logical qubits and fewer than 500,000 physical qubits on a superconducting machine, about 20 times fewer than earlier estimates.
  • Oratomic, Caltech and UC Berkeley (same day), with authors including John Preskill and Dolev Bluvstein, showed that on a neutral-atom architecture, Shor's algorithm could run with roughly 10,000 to 26,000 physical qubits for ECC-256 and about 11,000 to 13,300 for RSA-2048 in space-efficient designs.

What actually changed, and what did not

The big gain came from error correction, not new physics. The Oratomic design uses high-rate quantum LDPC codes that pack far more logical qubits into each physical qubit than the surface codes used in earlier estimates.

The honest caveats matter, and the authors state them:

  • It is slower. Neutral-atom machines run error-correction cycles about a thousand times slower than superconducting ones. The low-qubit designs trade qubits for runtime measured in days to months, not minutes.
  • Nobody has built it. The hardware targets, such as the cycle time assumed, are engineering goals, not demonstrated systems.
  • Estimates are not machines. A lower resource estimate shortens the plausible timeline. It does not tell you the date.

Why platforms reacted anyway

For a defender, a days-long attack is still an attack. Harvested data does not expire while the attacker waits. So the rational response to "the machine is smaller than we thought" is to move the finish line forward, and that is what happened:

  • Google announced it plans to complete its post-quantum migration across internal and customer-facing systems by 2029 (March 2026).
  • Cloudflare moved its target for full post-quantum security, including authentication, to 2029 (April 2026), citing the Google and Oratomic results.
  • Microsoft pulled its Quantum Safe Program target from 2033 to 2029 (30 June 2026). Azure CTO Mark Russinovich wrote that cryptographically relevant quantum computers "could arrive sooner than previously expected."

What a bank should take from this

  1. Your planning date should not be later than your vendors'. If your cloud and CDN providers finish in 2029, a 2033 bank plan leaves you as the weak link in your own supply chain.
  2. ECC is not the safe fallback. The March results hit elliptic curves hardest. ECDHE, ECDSA and Ed25519 are all on the same list as RSA.
  3. Lead with key exchange. Harvest-now-decrypt-later targets confidentiality today. Hybrid X25519 + ML-KEM-768 on long-lived data flows is the first move with the highest return.
  4. Plan for the estimate to fall again. Each year of the last seven, it has. Build the inventory and the agility now, so the next revision is a policy change, not a crisis.

Qypher inventories every RSA and ECC dependency across your estate, ranks it by data lifetime and exposure, and generates the hybrid ML-KEM and ML-DSA artifacts your team deploys. Get a free assessment →

Sources: Google Quantum AI research blog and whitepaper (31 Mar 2026); Cain et al., "Shor's algorithm is possible with as few as 10,000 reconfigurable atomic qubits," arXiv 2603.28627; Cloudflare blog, post-quantum roadmap (Apr 2026); Microsoft Security blog (30 Jun 2026); PostQuantum.com analysis.