Alice & Bob's ePrint 2026/2665 of 28 October 2026 Puts RSA-2048 at 22,593 Cat Qubits and 3.14 Days, Assuming a Bit-Flip Time of About 100 Years
What Alice & Bob posted to the IACR ePrint Archive on 28 October 2026
On 28 October 2026 the Cryptology ePrint Archive received and approved paper 2026/2665, "Shor's algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days". Nine of its ten authors work for Alice & Bob, the Paris company that builds superconducting cat qubits; the tenth, André Schrottenloher, is at Inria and the University of Rennes. The paper compiles Shor's algorithm from its mathematics down to the placement and scheduling of physical qubits on a chip, and reuses the result for Bitcoin's secp256k1 curve: at most 30,000 cat qubits and one hour.
Which assumption carries the 22,593-qubit headline
The headline assumes a 1-microsecond error-correction cycle, phase-flip noise of 5 × 10⁻⁴ per cycle and negligible bit flips, which the authors equate to a characteristic bit-flip time of about 100 years. With an extra distance-3 code, a bit-flip time of about one hour suffices and the count rises to about 45,000 cat qubits. In September 2025 Alice & Bob reported an average bit-flip time of 44 minutes, with a 95% confidence interval of 33 to 60 minutes, for one fully characterized cat qubit, plus preliminary traces above three hours on three other qubits that the company says are not by themselves enough to claim the same level of control.
Why the estimate leaves the 2030 dates where they are
The RSA-2048 resource estimate moves the attack cost again, but NIST's final IR 8547 and the HKMA's 2030 aim were set without it. The paper is a company preprint, not yet peer-reviewed, and its value lies in stating every hardware number an attacker would need.
Claude Mythos 5 Helped Design a Quantum Circuit for Bitcoin's secp256k1 Curve: What arXiv 2610.22367's '17-Fold Fewer Gates' Is Measured Against
What Harvard and Anthropic posted on 15 October 2026
Andi Gu, Alek Kemeny, Susanne Yelin and Mikhail Lukin posted arXiv 2610.22367, "Discovering state-of-the-art quantum circuits with large language models," on 15 October 2026. The paper uses Claude Mythos 5 to propose circuit designs and an independent evaluator to test and score them across eight tasks. Anthropic presented the work on 16 October. The result that drew attention is a reversible point adder over the prime field of secp256k1, the curve behind Bitcoin and Ethereum signatures. The authors' public repository lists it at 4,006,673 Toffoli gates and 935 logical qubits, and press coverage reported about 17-fold fewer Toffoli gates for 12% more qubits.
What the 17-fold figure is measured against
The comparator is the authors' own reconstruction of a 2026 point adder by Luo and colleagues, at 69,529,757 Toffoli gates and 838 qubits. The same repository cites a second published design, by Schrottenloher, at about 1.9 million Toffoli gates and 1,446 qubits. Against that design the new circuit uses more gates and about a third fewer qubits. The repository's implemented circuits were evaluated by a grader that runs 100,000 tests and passes a circuit with up to 20 failures, a budget the authors set so that deliberately approximate arithmetic is allowed; the Schrottenloher figures are cited there, not reproduced. This post sets each claim beside the paper and repository, explains what a cheaper adder means for elliptic-curve cryptography, and shows where the figure is commonly overstated.