Google Quantum AI has demonstrated a new error-suppression technique on its Willow processor that addresses one of the major resource bottlenecks facing fault-tolerant quantum computers. The experiment reduced magic-state errors by roughly 40 times and produced T-states with 99.99% logical fidelity, moving a previously theoretical technique onto physical hardware.
In its official October 15 announcement, Google described magic-state cultivation as a way to prepare the high-quality quantum states required for universal fault-tolerant computation more efficiently. The result removes part of an engineering bottleneck, but Google explicitly says cultivation still needs to be demonstrated at larger scale before it becomes practical.
That limitation is crucial for crypto. The experiment does not show that Willow can recover Bitcoin private keys, nor does it establish a date when cryptographically relevant quantum computers will exist. It does, however, strengthen the case for treating post-quantum migration as a long-lead engineering problem rather than waiting for a working attack.
Resource Estimates for Elliptic Curves Keep Falling
The concern is amplified by separate research published in March. A whitepaper involving Google researchers, Dan Boneh and Ethereum researcher Justin Drake estimated that solving the 256-bit elliptic-curve discrete logarithm problem could require fewer than 1,200 logical qubits and, under specified superconducting assumptions, fewer than 500,000 physical qubits. Those estimates cover the mathematical problem underlying secp256k1, the curve used by Bitcoin and Ethereum signatures, rather than demonstrating a practical key-recovery attack on current hardware.
A second paper from researchers including Caltech’s John Preskill found that cryptographically relevant Shor computations could theoretically run with as few as 10,000 reconfigurable neutral-atom qubits under a different fault-tolerant architecture. For P-256, the authors modeled execution in a few days with 26,000 physical qubits. The papers substantially reduce previous resource estimates, but both depend on hardware quality, error rates, connectivity and fault-tolerant capabilities that existing machines do not yet provide.
Bitcoin’s exposure is consequently more specific than a general “quantum break.” Shor’s algorithm threatens ECDSA and Schnorr signatures once an attacker has the associated public key. Efforts such as BIP-360 aim to reduce routine public-key exposure, but hiding a public key until spending reduces one attack surface without making Bitcoin post-quantum secure.
Industry Migration Is Already Moving Toward 2029
The broader cybersecurity industry is preparing before such hardware exists. Google announced in March that it is targeting 2029 for its post-quantum cryptography migration, while Cloudflare independently moved its full PQ-security target, including authentication, to the same year.
NIST takes the same precautionary approach. Its finalized ML-KEM, ML-DSA and SLH-DSA standards are available for deployment now, and the agency explicitly recommends beginning migration rather than waiting for a cryptographically relevant quantum computer. NIST notes that large cryptographic transitions historically take 10 to 20 years, which is why uncertain attack timing does not justify delaying preparation.
Crypto developers are already responding through several approaches. Bitcoin research is testing reduced public-key exposure and future signature migration, while Ethereum has placed post-quantum cryptography higher on its long-term roadmap. Earlier Google and Caltech resource estimates had already intensified the Bitcoin debate.
Google’s Willow result therefore narrows an engineering bottleneck without turning quantum attacks on Bitcoin into a present capability. Its significance for crypto lies in the direction of travel: resource estimates are improving while protocol migrations remain slow, increasing the value of building post-quantum upgrade paths before hardware makes them urgent.
