The $20 Million Question: Why a Special-Purpose Quantum Computer Built to Break Encryption Is Closer Than Most Enterprise Planning Cycles Assume

On March 30 and March 31, 2026, two independent research teams published preprints that redraw the resource map for quantum cryptanalysis. Google Quantum demonstrated a construction requiring fewer than 500,000 physical qubits to break elliptic-curve cryptography in approximately 9 minutes. Caltech and Oratomic, using a fundamentally different approach based on quantum low-density parity-check (qLDPC) codes, showed a balanced configuration of roughly 26,000 physical qubits that could accomplish the same task in about 10 days.

The funding implications are immediate. A neutral-atom quantum computer built to these specifications could require between $13 million and $40 million, depending on architecture and engineering maturity. The base case lands near $20 million—roughly the spend level of a mid-tier Super Bowl ad buy.

This is not a theoretical exercise. These are engineering estimates derived from published resource counts, applied to hardware platforms that exist today in prototype form. The physics is settled. What remains is engineering, manufacturing, and money.

The hard science is done. The engineering is not.

Peter Shor published his factoring algorithm in 1994. In the 32 years since, no one has found a flaw in it. The mathematical foundation for quantum cryptanalysis is not speculative—it is proven. What has been uncertain is the engineering: how many physical qubits, at what error rates, with what overhead for error correction, at what cost, in what timeframe.

Error correction itself is no longer theoretical either. Google's Willow chip demonstrated below-threshold error correction in late 2024. Multiple groups have shown that adding more physical qubits to a logical qubit can suppress errors exponentially, not linearly. The question has shifted from “can quantum error correction work?” to “how efficiently can we implement it for specific circuits?”

This distinction matters. Physics breakthroughs are unpredictable. Engineering challenges—reducing cost per qubit, improving gate fidelity, scaling control electronics—follow learning curves. They are measurable. They are fundable. They have timelines.

The resource estimates are collapsing

The history of quantum resource estimation is a history of numbers getting smaller. In 2012, the best estimates for breaking RSA-2048 required roughly 1 billion physical qubits. In 2019, Gidney and Ekerå published the landmark paper showing it could be done with 20 million noisy qubits in 8 hours. By May 2025, Gidney and Schmieg had pushed estimates for breaking elliptic-curve cryptography below 1 million physical qubits.

Then, this week, two papers dropped the floor again.

To put this in perspective: in seven years, the resource estimate for quantum cryptanalysis has dropped from 20 million physical qubits to fewer than 500,000 (Google) or as low as 26,000 (Caltech/Oratomic). That is a 40–800x reduction.

This is not just a cryptocurrency problem

The headline-grabbing application is Bitcoin. Secp256k1, the elliptic curve used by Bitcoin and most cryptocurrencies, is the most obvious target because the private key directly controls assets. A single key recovery equals a direct financial payout.

But secp256k1 is the easiest case, not the most important one. RSA-2048, ECDSA P-256, ECDH, and Ed25519 protect virtually everything else: TLS sessions, code signing, VPN tunnels, certificate authorities, inter-service authentication, firmware verification, email encryption, document signing, and PKI chains across every enterprise and government on Earth.

There is an asymmetry that matters here. Cryptocurrency wallets can be migrated by their owners in hours. Enterprise cryptographic infrastructure—embedded in thousands of applications, APIs, certificates, HSMs, and third-party dependencies—takes years to migrate. The organizations with the most to lose are the ones that will take the longest to protect themselves.

Government agencies are even further behind

Federal systems hold the most sensitive long-lived data on Earth: classified intelligence, defense plans, diplomatic communications, healthcare records, tax data, and critical infrastructure controls. The legal framework for migration has been in place since 2022. NSM-10, OMB M-23-02, the Quantum Computing Cybersecurity Preparedness Act, and CNSA 2.0 all require federal agencies to inventory cryptographic systems, prioritize assets, and begin migration.

The deadlines are concrete. CNSA 2.0 requires all new National Security System acquisitions to be PQC-compliant by January 2027. NIST targets deprecation of quantum-vulnerable algorithms by 2030 and full disallowance by 2035. The Department of Defense aims to implement NIST-approved PQC algorithms by 2030.

But the inventory is not done. Federal agencies were directed to submit cryptographic inventories of high-value assets beginning in 2023. As of early 2026, whether agencies are still submitting annual inventories under M-23-02 is unclear. CISA's own strategy for automated cryptographic discovery tools is still being piloted, not deployed at scale.

The migration cost is massive. The Biden administration estimated the cost of migrating all U.S. federal civilian agencies to PQC at over $7 billion. Defense and intelligence systems add to the total. No comparable budget line has been publicly allocated.

Most agencies are still in the inventory phase, four years after the mandate was issued. Enterprise vendors selling to the federal government face CNSA 2.0 procurement deadlines starting January 2027. The gap between mandate and execution is wider in government than in any other sector.

Why neutral atoms change the cost equation

The resource estimates above describe logical requirements—how many qubits and gates are needed algorithmically. The cost depends on the physical platform used to implement them.

Superconducting qubits—the technology used by Google, IBM, and most current quantum computers—require dilution refrigerators that cool chips to 15 millikelvin, colder than outer space. Each refrigerator costs $500,000 to $3 million, supports a limited number of qubits, and requires continuous helium-3 supply. Scaling to 500,000 physical qubits on superconducting hardware is a formidable engineering and cost challenge.

Neutral-atom quantum computers take a fundamentally different approach. Individual atoms are trapped and manipulated by laser beams at or near room temperature. No cryogenics. No dilution refrigerators. No helium-3 supply chain. The lasers are commodity components derived from the telecom and lithography industries. The scaling path is optical, not cryogenic.

The Caltech/Oratomic paper is significant precisely because it maps the qLDPC construction onto neutral-atom hardware, where the ~26,000 physical qubit count is within the architectural roadmap of multiple companies building neutral-atom machines today.

Here is what a purpose-built neutral-atom Shor machine might cost at the component level:

These figures carry wide error bars. First-of-kind engineering always costs more than projections. But the relevant comparison is not zero—it is the prior estimate of $1 billion or more for a superconducting machine at the 20-million-qubit scale.

Mapped across scenarios:

In all three scenarios, the cost of a purpose-built Shor machine falls within the budget range of a nation-state intelligence program or a well-funded private effort. The question is not whether it is affordable. The question is when the engineering matures enough to build it. Economically plausible is not the same as operationally imminent. But for organizations whose migration timelines are measured in years, the distinction between “plausible by 2029” and “certain by 2029” may not matter as much as the planning window it creates.

Special-purpose machines ship first

This is not without precedent. D-Wave shipped the first commercial quantum computer in 2011—a special-purpose quantum annealer that could not run Shor's algorithm or any gate-based algorithm at all. By 2017, the D-Wave 2000Q had 2,048 qubits and was reported at approximately $15 million per unit. Publicly reported users included Lockheed Martin, Google, NASA, and Los Alamos National Laboratory.

The D-Wave machines were special-purpose devices optimized for a narrow class of optimization problems. They proved the market model: a single-application quantum machine, available at an acquisition level accessible to large organizations, years before general-purpose quantum computing becomes practical.

The first ECC-breaking quantum computer will follow the same pattern. It will not be a general-purpose machine. It will be a single-purpose Shor machine—a quantum device designed from the ground up to do nothing but compute discrete logarithms on elliptic curves. Every architectural decision, every qubit layout, every error-correction scheme will be optimized for that one computation. And because it is single-purpose, it will arrive years before a universal quantum computer of equivalent capability.

The hardware roadmap supports the trajectory

The neutral-atom quantum computing sector has hit a series of milestones in rapid succession:

Endres et al. (Caltech) demonstrated arrays of 6,100 neutral atoms in a Nature paper in 2025—the largest controlled qubit array in any platform.

Pasqal has demonstrated 1,000-atom processors and published a roadmap targeting 10,000 atoms.

Atom Computing demonstrated 1,200+ atom arrays with 40-second coherence times—orders of magnitude longer than superconducting qubits.

QuEraraised $230 million in 2025 to build error-corrected neutral-atom quantum computers and was selected for DARPA's Quantum Benchmarking Initiative (Stage B).

Googlehired Adam Kaufman, one of the world's leading neutral-atom physicists, on March 24, 2026—one week before the Babbush et al. preprint. The timing is not coincidental. Google is hedging its superconducting bet with a parallel neutral-atom program.

Infleqtion demonstrated 12 logical qubits using neutral atoms with error correction.

Atom Computing and Microsoft demonstrated 24 logical qubits in a joint project in 2024, the largest error-corrected system to date on any platform.

The trajectory is clear: neutral-atom qubit counts are scaling at roughly 2–3x per year, coherence times are already sufficient for deep circuits, and the error-correction results are tracking the theoretical models. The 26,000 physical qubits required by the Caltech/Oratomic construction is within the extrapolated roadmap of at least three companies.

What could go wrong

These projections are not guarantees. Four categories of technical risk could delay or prevent the construction of a special-purpose Shor machine:

What would have to be true for this thesis to be wrong? Three things. First, qLDPC error correction codes would have to underperform at scale, with the physical-to-logical ratio landing at 30:1 instead of 10:1, requiring roughly 78,000 physical qubits and pushing cost above $60 million. Second, two-qubit gate fidelity would have to stall below 99.9%, meaning fault-tolerant operation across 26,000 atoms simultaneously remains out of reach. Third, classical control electronics would have to hit a scaling wall, with real-time feedback across 26,000 qubits at microsecond precision proving more stubborn than current trajectories suggest. If all three hold, the thesis is wrong. If any two close, the machine becomes a question of cost and calendar, not feasibility.

These risks are real. But they are engineering risks, not physics risks. The difference matters: physics risks are binary (it works or it doesn't), while engineering risks are continuous (it costs more, takes longer, or requires more resources than projected). Engineering risks get solved with funding and time.

The economics of quantum attack

To understand whether a $20 million quantum computer changes the threat landscape, compare it to other things that cost $20 million:

China has invested over $15 billion in quantum technology. The United States has allocated billions through the National Quantum Initiative and DARPA. At that rough funding level, a Shor machine is a rounding error in these budgets.

But nation-states are not the only actors who can write a $20 million check. Criminal syndicates that run ransomware operations generating hundreds of millions per year could fund this. Sovereign wealth funds could fund it as a strategic intelligence asset. Large corporations could fund it for competitive advantage. And cost curves only go in one direction: the second machine will cost less than the first.

The implications for every organization

The shelf life of your secrets determines your urgency. If your organization handles data that must remain confidential for 5, 10, or 25 years—trade secrets, national security information, patient records, attorney-client communications—the migration clock started years ago. Data encrypted today with classical cryptography and intercepted today can be stored and decrypted when the hardware arrives.

Enterprise is more exposed than crypto. Cryptocurrency wallets can be migrated to post-quantum addresses by their owners quickly. Enterprise cryptographic infrastructure is embedded in thousands of systems, managed by dozens of teams, subject to compliance frameworks, and entangled with third-party dependencies. The migration is measured in years, not days.

Harvest Now, Decrypt Later is happening now. Intelligence agencies and sophisticated threat actors are already intercepting and storing encrypted traffic for future decryption. This is not speculation—it is documented in public intelligence assessments and acknowledged by CISA, NSA, and NIST. Every day of delay adds to the stockpile.

Migration takes years, not months. The NIST post-quantum standards (FIPS 203, 204, 205) were finalized in August 2024. But standards are not implementations. Migrating a large enterprise from classical to post-quantum cryptography requires cryptographic inventory, dependency mapping, algorithm replacement, testing, compliance validation, and vendor coordination. The federal government has set a 2035 deadline. Most enterprises have not started.

The time to start is now. Not because quantum computers will break encryption tomorrow. But because the migration itself takes 3–7 years for a large organization, and the hardware timeline is now measured in years, not decades. The window in which “we'll start when it's closer” remains a viable strategy is closing.

Disclaimer: This article is for informational purposes only. The preprints cited have not been peer-reviewed. Cost estimates are projections based on published resource counts and current hardware cost curves, and carry significant uncertainty. Nothing in this article constitutes professional, legal, financial, or technical advice. Consult qualified professionals for decisions affecting your organization's cryptographic infrastructure.

© 2026 Qtonic Quantum Corp. All rights reserved.