IonQ's Häner and 13 Colleagues Compile Shor's Attack on secp256k1 Onto 19,397 Walking Cat Trapped-Ion Qubits in 25.7 Days, arXiv 2609.05625, 4 September 2026: TRL 2
Quentir Defense Monitor
Evidence-based insights for quantum defense and security. Published by Quentir Systems LLC · November 8, 2026.
Thomas Häner, Felix Tripier, Jacob Young, Michael Naehrig, Andrii Maksymov, Safwan Alam, Dmitri Maslov, Matthew Parrott, Yvette de Sereville, Jordan Sullivan, Mark Webster, Nicolas Delfosse, John Gamble and Martin Roetteler, all at IonQ, posted a 70-page paper to arXiv on 4 September 2026. It compiles Shor's algorithm for the 256-bit elliptic curve discrete logarithm problem on secp256k1, the curve behind Bitcoin and Ethereum signatures, all the way down to the error-correction circuits of the company's Walking Cat architecture for trapped ions. The result is a machine of 19,397 physical qubits that the authors estimate would recover one 256-bit private key in about 25.7 days per attempt, with a success probability of 63 percent by their heuristic estimate and 40.7 percent by an end-to-end estimate incorporating the rigorous algorithmic lower bound and modeled logical failures. IonQ announced the paper on 8 September 2026, the same day it launched its 256-qubit Superion platform, and the paper returned to the trade press this week when EE Times interviewed its president and two outside experts about the company's 2027 and 2028 roadmap.
This post reads the paper as offensive cryptanalysis capability in the computing pillar. Every published estimate of what a quantum attack on public-key cryptography costs is a planning input for a program office, because elliptic curve signatures and key agreement protect command links, signed firmware and long-lived classified material. Some applications use 256-bit curves, while CNSA 1.0 specifies P-384 for ECDSA and ECDH; this secp256k1 estimate does not establish P-384 resource requirements. What follows sets out what the authors established, what they assumed, where that leaves the work on the readiness ladder, and what still separates a paper compile from a machine anyone can run.
What arXiv 2609.05625 establishes: 1,457 logical qubits, 39 million Toffoli gates, four magic-state factories on 1,276 qubits and a 25.7-day run on 19,397 physical qubits
The paper starts from the logical circuit. Using windowed arithmetic with a window size of 16 and three forward table lookups with measurement-based uncomputation, the authors bring the logical footprint to about 1,457 logical qubits and roughly 39 million Toffoli gates, down from 58 million in the prior trapped-ion estimate they build on. Those two numbers set the problem that the rest of the paper then maps onto hardware.
The mapping is where the work departs from earlier estimates. Four Toffoli factories, consuming 1,276 physical qubits together, produce the magic states that every Toffoli gate needs. A new fast CCZ factory and a depth-one CCZ injection cut the execution time of a CCZ gate by a factor of 31. Multiple cat factories per code block let logical operations run in parallel, and a protocol the authors call CliNR speeds up Clifford operations while allowing its ancilla qubits to be recycled. A revised loss-correction protocol removes the beacon qubits that the earlier architecture used to detect lost ions, which the authors say eliminates about one third of the qubits in each memory block. Sixty-nine memory blocks hold the data throughout the computation.
The paper then adds what resource estimates usually omit: the time each logical measurement takes, the decoder's reaction, and a rigorous algorithmic lower bound on success that is combined with modeled logical failures for an end-to-end estimate. IonQ's release of 8 September 2026 quotes Chris Ballance, its president of quantum computing, calling it an estimate that does not approximate away the parts that dominate a real machine's runtime. The authors' own comparison places earlier trapped-ion estimates for the same problem between 1.2 million and 9.4 million physical qubits, and cites neutral-atom work at under 20,000 physical qubits and superconducting work at fewer than 500,000. Where Jo and Lee's 5n/2 logical-qubit construction gave an asymptotic count with no circuit for any real curve, the IonQ paper gives one curve, one architecture and every operation placed.
Which assumptions carry the 25.7 days: a two-qubit error rate of one in ten thousand, quantum LDPC codes on a grid of transported ions and no errors outside the model
The Walking Cat architecture, published by Tripier, Chung, Young, Alam, Bjork and colleagues as arXiv 2604.19481 on 21 April 2026, is a two-dimensional grid of trapped ions, each holding a qubit, that can be moved across the grid. Instead of surface codes it uses quantum low-density parity-check codes, which encode many logical qubits in one block, and a cat factory that distributes entangled states across the device to perform logical operations. The secp256k1 paper is the architecture's proof-of-concept application.
The physical assumptions are stated plainly. The two-qubit gate error rate is 10⁻⁴ and the single-qubit operation error rate is 10⁻⁵, which the authors describe as rates demonstrated on small trapped-ion devices. Beyond the error channels they analyze, the model assumes no other errors are introduced. Every logical measurement is treated as lasting as long as a Toffoli injection, qubits are not reallocated between memory and gate resources, and all 69 memory blocks stay active for the whole run. The traps, the control electronics and the vacuum system are outside the paper's scope.
Quantum pillar: computing (cryptanalysis). Use posture: offensive. Technology readiness: TRL 2 of 9. For the reader this means the attack on secp256k1 exists as a complete compiled circuit with resource counts checked on paper and in classical simulation, while the 19,397-ion fault-tolerant machine it assumes has not been built or run at any scale and no encoded operation of this design has been executed on hardware.
Why the panel reads computing (cryptanalysis), offensive and TRL 2
The pillar is computing because a quantum processor runs the calculation, and the sub-branch is cryptanalysis because the calculation is Shor's algorithm against a public-key system. Quentir's capability map defines the offensive posture as value that lies in acting against an adversary's systems, and breaking their cryptography is the map's own first example. Nothing in the paper protects anyone's data; it prices an attack. IonQ frames the work as a benchmark for fault-tolerant computing, and Jordan Shapiro, its president of quantum platform, calls it a capability milestone first and a security finding second. Neither framing changes who gains if the machine is built: its operator, against anyone still relying on 256-bit elliptic curve signatures or key agreement.
The readiness level is 2. The shared ladder places theory and resource estimates at levels 1 and 2 and reserves level 3 for a run on real hardware. This paper sits at the top of level 2: the circuit is complete, the mapping to physical qubits is explicit, and the end-to-end success estimate incorporates a rigorous algorithmic lower bound and modeled logical failures. It cannot reach level 3 because no part of the compiled design has been executed on an IonQ processor, and the platform announced on the same day holds 256 physical qubits against the 19,397 the design requires.
What it would let a force do and who gains: recovery of any 256-bit elliptic curve private key from its public key, with recorded ECDH traffic and signed firmware as the targets
The paper is written for secp256k1, the curve of Bitcoin and Ethereum, and that is where the trade coverage has stayed. For a defense reader the relevant fact is the problem size. NIST P-256 is a prime-field curve of the same 256-bit size, so a reader should expect a cost of the same order, though the paper states no P-256 figure and the curve constants differ. CNSA 1.0 specifies P-384 for both ECDSA and ECDH, and this secp256k1 estimate does not establish the resources required to attack those systems. A machine that solves the 256-bit discrete logarithm problem turns any public key into its private key: a forged signature on firmware, a software update or a command message, and the decryption of key-agreement traffic recorded years earlier, the harvest-now-decrypt-later exposure every migration policy cites.
The defensive side is already written into policy. NIST's final Internal Report 8547, published 27 October 2026, sets the transition to ML-KEM, ML-DSA and SLH-DSA, with quantum-vulnerable public-key algorithms deprecated after 2030 and disallowed after 2035, and supports Executive Order 14412 and OMB memorandum M-26-15, which direct agencies to move their most sensitive systems first. IonQ's own release states that ML-DSA and SLH-DSA are unaffected by its result, and notes that many organizations sequenced signatures last in their migration plans because replacing a root of trust is the hardest step. The paper does not change the destination of that migration. It changes the argument about how much time the migration has, from a hardware company with a stated plan to build a fault-tolerant 10,000-physical-qubit system in 2027 and a 20,000-qubit system in 2028. Alice & Bob's 22,593-qubit estimate for RSA-2048 of late October is the same kind of document for cat qubits, and together the two show platform-specific compilation replacing the generic million-qubit figure in how these estimates are argued.
What stands between the paper and a program office relying on it: a 256-qubit machine against a 19,397-qubit design, error rates shown only on small devices, and two outside views on the 2028 date
Five items separate this compile from an attack a planner must assume exists. The first is scale. The design needs 19,397 physical qubits holding a two-qubit error rate of 10⁻⁴ while ions are transported across a grid for 25.7 days; the hardware IonQ announced alongside the paper holds 256. Ballance told EE Times on 6 November 2026 that chips at the 10,000-physical-qubit scale are designed and heading to the fab, which is a statement about design, not about measured error rates on those chips.
The second is the model's edge. The analysis assumes no error sources beyond the ones it treats, and leaves crosstalk, calibration drift, control electronics and the vacuum system out of scope. A trapped-ion quantum computer of this size has never been characterized, so the gap between the modeled and the real error budget is unknown in both directions. The third is the success probability: 63 percent per 25.7-day attempt by the heuristic estimate and 40.7 percent by an end-to-end estimate incorporating the rigorous algorithmic lower bound and modeled logical failures, so the expected time to one key is longer than 26 days. The algorithmic lower bound is 55.3 percent assuming no logical errors; the end-to-end estimate additionally assumes statistical independence among five failure mechanisms. The fourth is independent evaluation: the paper is a company preprint without peer review.
The fifth is the roadmap itself, and the EE Times piece puts two outside voices beside the company's. Jungsang Kim, who co-founded IonQ in 2015, served as its chief technology officer until 2024 and is now chief science and technology strategist for the provost at Duke University, said he is not sure any fundamental physics questions remain, and also that he is still quite optimistic that these codes will not be cracked by the late 2020s. Thomas Prest, senior cryptographic researcher at PQShield, said the migration takes years rather than months and should be finished by 2030. Both views fit the paper, which establishes that the circuit fits on 20,000 trapped ions under stated assumptions and does not establish that 20,000 ions will hold those assumptions in 2028.
What the sources support is this. Fourteen IonQ researchers have published a complete, hardware-specific compile of Shor's algorithm for a 256-bit elliptic curve: 1,457 logical qubits, 39 million Toffoli gates, four factories and a 25.7-day run on 19,397 physical qubits at a two-qubit error rate of 10⁻⁴, with an end-to-end success estimate incorporating a rigorous algorithmic lower bound and modeled logical failures. The company intends to build systems of that size by 2028, and NIST's final transition report already requires the migration that would make the result moot. A measured error rate on a 10,000-qubit IonQ chip, an encoded logical operation from this design run on hardware, and an independent reproduction of the resource count are the next three pieces of evidence a planner should wait for.
Sources
Primary source: Thomas Häner, Felix Tripier, Jacob Young, Michael Naehrig, Andrii Maksymov, Safwan Alam, Dmitri Maslov, Matthew Parrott, Yvette de Sereville, Jordan Sullivan, Mark Webster, Nicolas Delfosse, John Gamble and Martin Roetteler (IonQ), "Computing 256-bit elliptic curve discrete logarithms in 26 days on a fault-tolerant trapped-ion quantum computer with 20,000 qubits," arXiv 2609.05625, submitted 4 September 2026, 70 pages, 20 tables and 22 figures. The Walking Cat architecture paper by Tripier, Chung, Young, Alam, Bjork and colleagues, arXiv 2604.19481 of 21 April 2026, is cited in the text. Other material: IonQ's press release of 8 September 2026, College Park, Maryland; NIST Internal Report 8547, Transition to Post-Quantum Cryptography Standards, final version of 27 October 2026; Rebecca Pool, "The Countdown to Q-Day Has Begun," EE Times, 6 November 2026. The capability reading, the posture argument, the readiness placement and the buyer items are Quentir analysis.