Computing 256-bit elliptic curve discrete logarithms in 26 days on a fault-tolerant trapped-ion quantum computer with 20,000 qubits

Abstract: One of the strengths of our recently proposed Walking Cat Architecture for a trapped-ion quantum computer is that it is straightforward to extend and optimize for a specific application. As a proof-of-concept, here we present such optimizations for solving the $256$-bit elliptic curve discrete logarithm problem (ECDLP) on $\mathtt{secp256k1}$, which is the elliptic curve used by blockchain technologies such as Bitcoin, using Shor's algorithm. We optimize the circuits from Schrottenloher's recent work and arrive at a logical quantum circuit for solving the ECDLP using about $1450$ qubits and $40\cdot 10<sup>6$ Toffoli gates, with a rigorous lower bound on the logical-level success probability that holds with confidence at least $1-2<sup>{-128}$. Using our compilation toolchain with manual optimization of the logical layout and integrated routing, we produce estimates for the logical measurement depth and the required number of physical qubits by compiling all components to measurement schedules that obey the architectural constraints. A key ingredient is a fast CCZ magic-state factory and a depth-one CCZ state injection, reducing the execution time of CCZ gates by a factor of $31$. We increase the logical-measurement parallelism using non-overlapping cat-based measurements in parallel, and we leverage the recently proposed logical CliNR protocol to speed up Clifford operations. To reduce the qubit overhead, we introduce a more efficient loss correction protocol, design a layout that allows us to recycle the CliNR ancilla qubits, and provision reusable cat-state resources according to the circuit's peak measurement parallelism. All results and optimizations combined, we conclude that a trapped-ion quantum computer based on our architecture can solve the ECDLP on $\mathtt{secp256k1}$ in approximately 25.7 days using 19,397 physical qubits with an estimated success probability of $63\%$.

• The paper estimates that solving the 256-bit elliptic-curve discrete logarithm problem (ECDLP) on Bitcoin's secp256k1 curve requires approximately 19,397 physical trapped-ion qubits, an expected runtime of 25-26 days per attempt, and a heuristic single-shot success probability of 63.3%.
• The research involves a four-level lowering process and optimization techniques such as arithmetic optimizations and logical circuit reductions, including reduced Toffoli gates and innovative transport and measurement strategies to maximize efficiency.
• They achieved a significant optimization in runtime and memory usage by direct production of the CCZ factory states, introduction of logical CliNR, integrated routing and cached measurement schedules using more detailed simulation than prior methods.

The paper presents an end-to-end resource estimate for solving the 256-bit elliptic-curve discrete logarithm problem on the Bitcoin curve $secp256k1$ with Shor’s algorithm. Its central estimate is 19,397 physical trapped-ion qubits, an expected runtime of 25.7 days per attempt, and a heuristic single-shot success probability of 63.3%. The result is obtained by jointly optimizing the elliptic-curve arithmetic, logical measurement schedules, quantum LDPC fault-tolerance, ion transport, magic-state production, Clifford-frame management, and compiler-level routing. The work builds on optimized ECDLP circuits (Schrottenloher, 1 Jun 2026) and the Walking Cat trapped-ion architecture (Tripier et al., 21 Apr 2026), but differs from conventional resource estimates by compiling the complete application into architecture-constrained measurement schedules rather than extrapolating from Toffoli counts alone.

End-to-end methodology

The paper follows a four-level lowering process. It begins with the mathematical formulation of ECDLP and Shor’s period-finding algorithm, proceeds to a reversible circuit for double-scalar multiplication, compiles that circuit into logical measurement schedules, and finally maps the schedules to a trapped-ion quantum error-correction architecture.

Figure 1: End-to-end lowering from the mathematical ECDLP algorithm to logical circuits, executable measurement schedules, and native fault-tolerant trapped-ion operations.

The target problem is to recover $d$ from $Q=[d]P$ in a prime-order subgroup of the curve

$y^2=x^3+7$

over the 256-bit pseudo-Mersenne field with

$p=2^{256}-2^{32}-977.$

The quantum oracle computes

$[k]P+[l]Q$

in superposition. The implementation uses a windowed semi-classical inverse QFT with window size $w=16$. A direct table lookup replaces the first point addition, and the final three of the nominal 32 windows are removed in favor of classical postprocessing. The resulting computation contains 28 windowed point additions, plus the initial lookup and semi-classical Fourier-transform operations.

This decomposition is important because the point-addition oracle, rather than the QFT, dominates both non-Clifford cost and logical depth. The paper consequently optimizes the complete arithmetic-and-architecture stack around repeated affine point addition.

Logical circuit reductions

The logical circuit uses approximately 1,457 logical qubits and 39 million Toffoli gates. Relative to the starting circuits of (Schrottenloher, 1 Jun 2026), the Toffoli estimate decreases from approximately 58 million to 39 million without increasing the logical width beyond the previously reported 1,462-qubit target.

Two arithmetic transformations provide most of the circuit-level savings. First, the binary-gcd-based in-place multiplication and division circuits are rewritten so that controlled additions become conditionally inverted additions. In the relevant adder constructions, conditionally inverted operations require substantially fewer non-Clifford resources than controlled additions. Second, modular squaring is specialized to the pseudo-Mersenne modulus using a single Karatsuba split. The resulting squarer reduces the non-Clifford cost of the direct multiplier by approximately 50% for the relevant subroutine.

The point-addition circuit uses three table lookups and measurement-based uncomputation. Random offsets are added both to the initial accumulator and to the classical lookup tables. These offsets eliminate explicit handling of the point at infinity and randomize the scalar inputs at which exceptional elliptic-curve cases or approximate arithmetic failures occur.

The resulting point-addition circuit requires approximately $1.196\times 10^6$ Toffoli gates, excluding the three lookup costs. With 28 point additions and lookup overhead, the paper obtains

$$28\left(1.196\times10^6+3\cdot2^{16}\right) \approx39.0\times10^6$$

Toffoli gates. This count is a logical-gate estimate; the architecture-level runtime is determined by the measurement schedule, where measurement-based uncomputation and Clifford processing contribute materially.

Approximate arithmetic and success probability

The arithmetic is intentionally approximate. Truncated carry propagation, shortened comparisons, approximate modular reduction, approximate phase repair, and bounded binary-gcd iterations can produce either computational-basis errors or residual $(-1)$ phases. The paper therefore analyzes algorithmic success separately from logical hardware errors.

For the concrete parameter choices $d$0 and $d$1, the authors derive component-level bounds for approximate modular addition, subtraction, negation, square subtraction, and binary-gcd multiplication and division. The binary-gcd bound is obtained through a Monte Carlo experiment with one million uniformly sampled input pairs. Twenty-one failures are observed for each of multiplication and division. A Clopper–Pearson analysis yields, with confidence at least $d$2, a failure probability below $d$3 for each operation under the simulated input distribution. The paper then introduces a factor-of-four correction to account for the nonuniform distribution induced by elliptic-curve coordinate differences.

For one affine point addition, the combined failure probability is bounded by

$d$4

A union bound over the 28 point additions gives

$d$5

with confidence at least $d$6. Exceptional affine-addition cases contribute less than $d$7 under the random accumulator and table masks and are therefore negligible relative to approximate-arithmetic failures.

The paper’s principal analytical contribution is a translation from this per-input failure bound to a bound on the success probability of Shor’s algorithm. Random masks ensure that every fixed scalar pair $d$8 fails with probability at most $d$9 over the classical randomization. If $Q=[d]P$0 is the ideal-oracle success probability, the approximate-oracle success probability satisfies

$Q=[d]P$1

This bound is stronger than a generic state-distance argument, which would yield a degradation proportional to $Q=[d]P$2. Using Mosca’s rigorous ideal-oracle lower bound of approximately 0.657 gives an approximate-arithmetic success lower bound of 0.553 before hardware errors. Using Ekerå’s heuristic ideal-oracle estimate of 0.99 gives an approximate-oracle estimate of approximately 0.861.

The distinction between these two values is consequential. After hardware-level logical failures are included, the paper reports a rigorous-style end-to-end lower estimate of 40.7% based on Mosca’s bound and a heuristic end-to-end estimate of 63.3% based on Ekerå’s postprocessing analysis. Five independent devices would raise the probability that at least one attempt succeeds to approximately 99.3% under the 63.3% estimate, but this assumes independent failures and does not reduce the per-device runtime.

Architecture and fault-tolerant instruction set

The target machine is a specialized extension of the Walking Cat architecture. It uses trapped ions transported on a two-dimensional grid and quantum LDPC codes rather than surface codes. The principal memory code is Q102, a $Q=[d]P$3 generalized bicycle code encoding 22 logical qubits per block. The architecture also uses Q66, a $Q=[d]P$4 code for CCZ factories, and Knill’s $Q=[d]P$5 C6 code for zero-level magic-state preparation.

At physical error rate $Q=[d]P$6, the reported logical error rates per syndrome-extraction cycle are

Code	Parameters	Syndrome-extraction depth	Logical error rate
Q102	$Q=[d]P$7	27 POCs	$Q=[d]P$8
Q66	$Q=[d]P$9	17 POCs	$y^2=x^3+7$0
C6	$y^2=x^3+7$1	5.4 POCs	$y^2=x^3+7$2

The architecture introduces the CLAW instruction set, which exploits the particular Pauli operators generated by the compiled ECDLP circuits. Instead of guaranteeing efficient representatives for every possible Clifford-frame trajectory, the compiler samples and verifies the trajectories encountered by the application. The authors report that all sampled logical operators have accessible physical representatives of weight at most 30.

Three disjoint logical measurements can be executed concurrently when their physical representatives have disjoint supports. This capability is used for CCZ injection, whose three joint logical-$y^2=x^3+7$3 measurements are executed in a single measurement layer for most gates. In Monte Carlo sampling of compiled circuits, 93.6% of Toffoli gates have measurement depth one, while the remainder have depth two, giving an average depth of 1.07 measurement layers per Toffoli.

Figure 2: Measurement-based routing of an entangling Pauli-controlled-Pauli operation, illustrating the mechanism used to avoid naïve cross-block Clifford decompositions.

The architecture also uses logical CliNR to clear accumulated Clifford frames. Rather than allocating two dedicated Q102 resource blocks for every memory block, the paper pipelines CliNR along the serial structure of the arithmetic. Four additional Q102 blocks suffice, reducing the overhead by approximately 39,200 physical qubits relative to the naïve allocation. Two CliNR instances operate in alternation along the ordered memory register and clear frames while arithmetic proceeds on other blocks.

The authors further replace the baseline loss-propagation model with a swap-loss model. A two-qubit operation involving one lost ion may exchange the loss location with the surviving ion but does not propagate the loss to both locations. A modified leakage-detection unit detects computational, leaked, and lost states under this model. This assumption eliminates loss cascades and reduces each code block from a threefold data-plus-ancilla-plus-beacon allocation to a twofold data-plus-ancilla allocation.

The swap-loss assumption is a substantial architectural dependency. It corresponds physically to sufficiently deep trapping potentials in which a surviving ion is not necessarily ejected after interaction with an empty or damaged site. The authors explicitly acknowledge that the actual behavior depends on the QCCD microarchitecture and requires experimental validation.

Direct CCZ production and measurement parallelism

A major runtime improvement comes from producing CCZ states directly rather than synthesizing Toffoli gates from seven $y^2=x^3+7$4 states. The dedicated Eastinthillation factory combines zero-level C6 magic-state preparation with Eastin Toffoli-state synthillation. Accepted Toffoli states are converted to CCZ states by a Hadamard on the target.

Figure 3: A Gidney-style ripple adder with measurement-based uncomputation, showing the arithmetic structure exploited by the compiler.

Each factory occupies 319 physical qubits and has an average accepted-state production time of 555.75 POCs. Four factories are sufficient to sustain the application’s consumption rate. The resulting CCZ injection has an average duration of 147.48 POCs, or approximately 29.5 ms. This is reported as a 31-fold speedup relative to the baseline implementation based on sequential $y^2=x^3+7$5-state injections and Clifford operations.

The factory’s per-attempt restart probability is at most 15.94%, dominated by error-detection rejection rather than undetected logical error. The estimated logical error rate of an accepted CCZ state is at most $y^2=x^3+7$6. The paper notes that Q66 memory errors dominate this bound by roughly two orders of magnitude over the intrinsic Eastin synthillation contribution. Thus, the quoted factory reliability depends more on the memory-code and decoder model than on the second-order error suppression of the synthillation protocol itself.

The QFT stage requires arbitrary-angle $y^2=x^3+7$7 rotations synthesized into $y^2=x^3+7$8 gates. The authors adapt the same factory resources to produce $y^2=x^3+7$9 states. With an optimized rotation precision of $p=2^{256}-2^{32}-977.$0, the expected 464 rotations consume approximately 5,684 $p=2^{256}-2^{32}-977.$1-state pairs. The resulting union-bound contribution to failure is at most

$p=2^{256}-2^{32}-977.$2

Compiler and integrated routing

The compiler lowers hierarchical component specifications into measurement schedules whose operations are limited to logical Pauli measurements, tracked Clifford updates, and magic-state consumption. Each component has a semantic specification and one or more architecture-specific decompositions. The compiler verifies these decompositions through contracts that describe basis actions, basis-plus-phase actions, or full operators.

For the reversible arithmetic that dominates the application, most verification reduces to classical simulation of basis-state mappings. Small components are exhaustively checked; large approximate components are sampled. For example, the approximate 256-bit modular adder is verified on 100,000 reproducibly sampled input pairs. The schedules are also checked for memory-block capacity, measurement compatibility, magic-state availability, and architectural constraints.

The principal compiler optimization is integrated routing. Instead of decomposing every cross-block CNOT or CZ into a generic three-measurement gadget, the compiler combines logical data movement with neighboring ripple arithmetic. Copy, fanout, move, swap, and measurement-based uncomputation operations are scheduled during periods in which the arithmetic would otherwise leave blocks underutilized.

Figure 4: Integrated routing of the phase-approximate modular adder, with relay operations hidden under the ripple schedule.

For the phase-approximate modular adder, the serial arithmetic lower bound is approximately 669 measurement layers, while the compiled schedule has depth 674. The five-layer difference is hidden by the CliNR seam penalty and the routing schedule. Across the complete point-addition computation, routing contributes only approximately 5% of total runtime. This result directly challenges resource estimates that count Toffoli gates while omitting Clifford gates, measurement-based uncomputation, transport, and layout changes.

The component-level runtime accounting is dominated by in-place multiplication and table lookup:

Component	Runtime
In-place multiplication	376.691 h
Unary lookup	179.686 h
Square-subtract	28.339 h
Unary phase-fix lookup	11.205 h
CliNR operations	10.255 h
Other arithmetic, routing, and iQFT	0.440 h
Initial lookup and setup	8.938 h
Total	616.555 h

The two dominant components account for more than 90% of the reported runtime. This distribution implies that further reductions in Toffoli count would not automatically translate into proportional wall-clock improvements unless they also shorten the serial measurement schedules of multiplication and lookup.

Device-level resource estimate

The final device contains 69 Q102 memory blocks, four Q102 CliNR blocks, 24 mobile cat-state bundle pairs, 12 Bell-state bundles for LM2 measurements, four Eastinthillation factories, and a 34-ion global loading reservoir.

Figure 5: Full-scale $p=2^{256}-2^{32}-977.$3 trapped-ion device, including Q102 memory, CliNR resources, cat-state factories, Bell-state bundles, magic factories, and ion reservoirs.

The physical-qubit allocation is

Allocation	Physical qubits
69 Q102 memory blocks	14,283
24 cat-state bundle pairs	2,880
Bell-state bundles	96
Four Q102 CliNR blocks	828
Four Eastinthillation factories	1,276
Global loading reservoir	34
Total	19,397

The cat-state reduction is particularly large. The naïve architecture would provision cat-state resources locally for every memory block. The proposed mobile bundle scheme provisions only the peak measurement parallelism and transports bundles between target blocks. For the three simultaneous measurements needed by CCZ injection, two bundles per measurement stream suffice, yielding a factor of 36.5 reduction in the spatial cat-state overhead relative to the default local allocation.

The compiled measurement depth corresponds to an expected runtime of approximately 616.555 hours, or 25.690 days, when every layer is conservatively charged at the 29.5 ms CCZ-injection duration. This is explicitly an upper-bound-style assignment: many non-Toffoli measurement layers are shorter, but the paper charges them at the longest critical-path duration.

The logical failure budget includes Q102 memory errors, logical measurement errors, CCZ-state errors, QFT $p=2^{256}-2^{32}-977.$4-state errors, and reservoir exhaustion. The reported aggregate logical failure probability is approximately 26.45%, implying an end-to-end hardware survival probability near 73.55%. Combining this with the algorithmic success estimates yields the 40.7% rigorous-style and 63.3% heuristic single-shot probabilities.

Limitations and open questions

The principal limitations concern the modeling assumptions rather than the logical circuit construction.

First, the physical resource estimate depends on the swap-loss model. The model prevents loss cascades and permits a lower-overhead leakage-detection protocol, but the paper does not establish experimentally that the relevant trapped-ion QCCD operations satisfy this model. The authors explicitly leave the detailed heating, ejection, and reloading dynamics to future microarchitectural analysis.

Second, several reliability estimates are extrapolated. Q102 and Q66 logical error rates at $p=2^{256}-2^{32}-977.$5 are inferred from simulations at higher physical error rates using a fitted fifth-order ansatz. The binary-gcd failure bound is Monte Carlo-based and assumes a uniform input distribution before applying a structural correction for elliptic-curve inputs. These procedures are quantitatively explicit, but they are not substitutes for exhaustive verification over the full input domain.

Third, the architecture uses application-specific sampling to establish that all encountered Clifford-frame trajectories have accessible low-weight physical representatives. The reported confidence bound is $p=2^{256}-2^{32}-977.$6 per component for an inaccessible trajectory after 10,000 samples, not a formal proof over all trajectories. The performance claims therefore depend on the adequacy of this sampling procedure.

Fourth, the runtime estimate charges every logical measurement layer at CCZ-injection duration. This is conservative, but it obscures the sensitivity of the result to the detailed distribution of measurement types and classical feed-forward delays. Conversely, the estimate assumes that transport, factory throughput, and reloading can sustain the compiled schedule without unmodeled control-system bottlenecks.

Finally, the reported 63.3% success probability is heuristic because it uses Ekerå’s ideal-oracle success estimate. The more conservative bound is 40.7%. The paper therefore does not establish a single unconditional probability of successfully recovering the discrete logarithm; it provides a rigorous-style lower estimate under one postprocessing bound and a higher heuristic estimate under another.

Conclusion

The paper develops a complete architecture-aware estimate for a fault-tolerant trapped-ion implementation of Shor’s ECDLP algorithm on $p=2^{256}-2^{32}-977.$7. Its main quantitative result is a 25.7-day, 19,397-physical-qubit implementation with approximately 39 million Toffoli gates, based on 1,457 logical qubits and a specialized quantum LDPC architecture. The reduction from prior trapped-ion estimates is produced by coordinated improvements: pseudo-Mersenne arithmetic, conditionally inverted adders, Karatsuba squaring, randomized approximate-oracle analysis, direct CCZ factories, depth-one CCZ injection, mobile cat-state resources, logical CliNR, integrated routing, and an altered ion-loss model.

The strongest methodological contribution is the replacement of gate-count extrapolation with executable measurement schedules that include Clifford operations, routing, transport, magic-state throughput, leakage, loss, and memory occupancy. The central open issue is whether the assumed trapped-ion noise and loss model, together with the compiler’s sampled logical-operator accessibility guarantees, can be validated at the scale required by the estimate.