Cost Estimates to Crack Cryptography with a Quantum Computer
Over the last sixteen months there have been five different publications from companies and research groups on cracking common cryptography protocols with a quantum computer. The main story is that the number of physical qubits required is decreasing from millions to sub million to tens of thousands. These are dramatic improvements across superconducting, neutral atom, and trapped ion modalities.
The typical metrics people have been looking at is the number of physical qubits and required runtime. These are published in the papers, and the dramatic decrease in physical qubits as well as the various runtime metrics provide the appearance of improving feasibility. But, there is one missing metric - Cost of Solution.
All papers are theoretical estimates and none of these machines actually exist (yet!). Reaching a verified or conclusive opinion is not possible. Regardless, I thought it would be interesting to construct a cost estimate for each approach as another way to gauge feasibility.
A cost estimate comes with its own theoretical quality. There is no quantum hardware company actually selling machines at this scale. I was able to do some research and come up with cost estimates or ranges of costs. Notably, IonQ’s analyst day deck puts the bill-of-materials cost of their 2,000,000 physical qubit trapped ion system due in 2030 at under $30M, against over $1B for a superconducting system of the same size.[1] BOM cost is not sale price, nor does it include implementation, operation, and maintenance. But it is a good anchor to use for their claim of ~19,400 physical qubits to crack secp256k1. Other vendors have provided various cost estimates for smaller scale systems. And, there is some data available that provides a portrait of costs for cooling the superconducting qubits.
Trapped ion systems from IonQ are by far the lowest cost of solution, at a range of $20M – $50M. Neutral atom systems from Oratomic come in at a range of $40M – $150M. Superconducting is by far the most expensive, with a range of $500M – $10B. Of course, time to solution is another factor.
Superconducting has a fast clock speed and theoretically could deliver results within minutes. While trapped ions and neutral atoms would deliver results within weeks or months.
IBM is making strides in its dilution refrigeration architecture for superconducting systems. Trapped ions and neutral atoms may be able to throw more physical qubits at the problem at a relatively low cost. And, new methods or techniques will emerge in the coming years. For now, I would consider this information directional, not verified or conclusive.
| Year | Source | Target | Qubits[2] | Runtime | Modality | Cost |
|---|---|---|---|---|---|---|
| May 2025 | Gidney[3] | RSA-2048 | <1 million | <1 week | Superconducting | $3B–$10B[1][4] |
| Feb 2026 | Iceberg[5] | RSA-2048 | ~94,000 | ~1 month | Superconducting | $500M–$2B[1][4] |
| Mar 2026 | Google[6] | secp256k1 | <500,000 | 18–23 mins | Superconducting | $2B–$6B[1][4] |
| Mar 2026 | Oratomic[7] | P-256 | ~10,000 | ~264 days | Neutral atom | $40M–$100M[8][9][10] |
| Mar 2026 | Oratomic[7] | P-256 | ~26,000 | ~10 days | Neutral atom | $60M–$150M[8][10][11] |
| Sep 2026 | IonQ[12] | secp256k1 | ~19,400 | 25.7 days | Trapped ion | $20M–$50M[1][13][14] |
IonQ, “2025 Analyst Day Presentation”, September 12, 2025, slide 8: “<$30M BOM Cost” for a 2 million physical qubit system against “>$1B BOM Cost” for superconducting. The slide’s own source line reads “IonQ BOM cost estimates by Kearney; Superconducting data taken from publicly available information using reasonable extrapolation assumptions” — so the superconducting side is an extrapolation, not a vendor figure.
Physical qubits.
Craig Gidney, “How to factor 2048 bit RSA integers with less than a million noisy qubits”, May 2025.
“IBM Launches $100 Million Partnership with Global Universities to Develop Novel Technologies Towards a 100,000-Qubit Quantum-Centric Supercomputer”, May 21, 2023. $100M over ten years toward a 100,000 qubit system expected in 2033 — a research program, not a machine price, but the only public number attached to a superconducting system at that scale.
Paul Webster et al., Iceberg Quantum, “The Pinnacle Architecture: Reducing the cost of breaking RSA-2048 to 100 000 physical qubits using quantum LDPC codes”, February 2026. The ~94,000 figure is the low-qubit end of the paper’s parameter sweep; other choices in the same table trade qubits for speed, running to millions of qubits in hours.
Ryan Babbush et al., Google Quantum AI, “Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations”, March 2026. 18 or 23 minutes depending on the circuit variant (1,450 logical qubits and 70 million Toffolis, or 1,200 and 90 million). The paper separately notes that a primed “on-spend” attack could run in roughly 9 to 12 minutes, competitive with Bitcoin’s ~10 minute block time.
Madelyn Cain et al., Oratomic and Caltech, “Shor’s algorithm is possible with as few as 10,000 reconfigurable atomic qubits”, March 2026. For ECC-256: ~10,000 qubits in the space-efficient architecture and 11,961 in the balanced one, both at roughly 264 days; ~26,000 in the time-efficient architecture at roughly 10 days. All assume a 1 ms stabilizer measurement cycle.
“AIST Selects QuEra’s Neutral-Atom Quantum Computer to Be Installed Alongside NVIDIA-Powered ABCI-Q Supercomputer”, April 30, 2024. 6.5 billion JPY, about $41M, for an on-premises system.
EuroHPC JU, “Inauguration of SOL, a New Quantum Computer Together with LISA”, June 11, 2026: “SOL is co-funded with a total acquisition cost of EUR 13 million.” That buys a Pasqal neutral atom machine with at least 140 qubits in analogue mode — a floor for what neutral atom hardware costs, not a comparable fault-tolerant system.
Oratomic, $300M Series A, July 2026, co-led by ARCH Venture Partners, Spark Capital, and Khosla Ventures.
“Monarch Quantum and Oratomic Announce Quantum Computing Partnership to Accelerate Utility-Scale, Fault-Tolerant Systems by the End of the Decade”, April 28, 2026. Targets “systems with tens of thousands of physical qubits encoding thousands of error-corrected logical qubits.” No financial terms disclosed.
Thomas Häner et al., IonQ, “Computing 256-bit elliptic curve discrete logarithms in 26 days on a fault-tolerant trapped-ion quantum computer with 20,000 qubits”, September 2026. 19,397 physical qubits and 616.6 hours, or 25.7 days, per attempt.
IonQ, “IonQ Announces First Quarter Financial Results”, May 7, 2025: “Announced $22 Million Deal with EPB, Including the Sale of a New Forte Enterprise.” The $22M covers the whole deal, including networking and joint algorithm work, so it is an upper bound on the system price rather than a list price.
IonQ, “IonQ Launches Superion Product Line”, September 8, 2026. The shift from laser-based to semiconductor-based control is expected to “reduce cost-per-qubit by more than 300x across the roadmap.”