Shor, and the billQuantum

In 1994 Peter Shor showed that a quantum computer could split any number in a number of steps that grows like a small power of its length — not the L(1/3) curve, not anything near it [42]. The quantum part of the algorithm does one thing: it finds how often a sequence repeats. Here is that one thing, then every claim to have done it on hardware, then the bill.

The period

Pick a number a with no factor in common with N and write down a, a², a³, … each reduced mod N. The sequence has to repeat, because there are only N remainders. Call the spacing r, the period. Then, half the time or better, a^r/2 is a square root of 1 mod N that is not ±1, and

N divides (a^r/2 − 1)(a^r/2 + 1), gcd(a^r/2 ± 1, N) are the factors

Reading it: the same two-squares trick as the methods page: a^(r/2) squared is 1, so a^(r/2) and 1 are two numbers whose squares agree mod N.

For N = 15 and a = 7: the sequence runs 1, 7, 4, 13, 1, 7, 4, 13, … with period 4; 7² mod 15 = 4, and gcd(3, 15) = 3, gcd(5, 15) = 5. That is the arithmetic the 2001 IBM experiment did [43]. For 21 with a = 2 the period is 6 and the factors are 7 and 3 [44].

Finding r classically means walking the sequence, which for a 2048-bit N is a walk as long as trial division. A quantum register holds all the values a^x at once, and the quantum Fourier transform turns that into a set of readings that peak at multiples of Q/r — the frequency of the beat. Read one, do a little arithmetic with continued fractions, and you have r. That is the whole quantum step.

Watch the period

Top: the sequence. Bottom: what the quantum computer reads — the Fourier transform of the beat, computed here on 128 points the slow way. Some choices of a fail (odd period, or the trivial root); Shor's algorithm picks another a and goes again.

Every claim, beside what was done

The largest number split by Shor's algorithm on real hardware, as of 2026-09-23, is 21, in 2012 — and that run, like every hardware run of Shor so far, was 'compiled' with knowledge of the answer, which Smolin, Smith and Vargo showed lets two qubits 'factor' any number you like [47]. Everything larger in the press was one of: an adiabatic minimisation with no known scaling advantage, a classical method with a small quantum step bolted on, a number chosen to be easy, or a toy curve key.

date	who	what was said	what was done	verdict
2001-12	Vandersypen and others, IBM Almaden and Stanford	15 = 3 × 5 by Shor's algorithm	Seven nuclear spins in a molecule ran a circuit compiled with the answer known. The first hardware Shor.	Real, tiny, compiled. [43]
2012-03	Xu and others, USTC	143 factored on four qubits	An adiabatic minimisation, not Shor; the problem was reduced to a few unknown bits first. In 2014 Dattani and Bryans showed the same run had also 'factored' 56,153, because the trick only depends on how the factors' bits differ.	No route to big numbers. [45][46]
2012-10	Martín-López and others, Bristol	21 = 3 × 7 by Shor's algorithm	Photons and a recycled qubit; compiled. Still the largest Shor factorisation on hardware in 2026.	Real, tiny, compiled. [44]
2016-03	Monz and others, Innsbruck	A scalable Shor's algorithm on five trapped ions — 15	The first run of the full Kitaev-style period finding without shortcuts in the quantum part, on 15.	Real, tiny, cleaner. [48]
2019-03	Amico, Saleem and Kumph, IBM	35 on IBM Q hardware	The attempt failed: noise swamped the answer. An honest negative result.	Did not work. [49]
2021-03	Claus Peter Schnorr	'This destroys the RSA cryptosystem' (a classical lattice method)	No challenge number was factored; the sentence was dropped in a revision; later work found the method fails past about 80 bits.	Nothing was destroyed. [53][103]
2022-12	Yan and 23 others	372 qubits could challenge RSA-2048	Schnorr's method with a small quantum optimiser in the loop; the hardware run split a 48-bit number on ten qubits. The classical part is the part that does not scale.	Aaronson: 'cargo cult quantum factoring'. [54][55]
2024-05	Wang Chao and others, Shanghai University	RSA broken on a D-Wave annealer (the October 2024 headlines)	A 22-bit number, 2,269,753, on a quantum annealer. Annealing has no known advantage at scale.	22 bits against 2048. [77]
2024-12	Wang Chao and others	'A first successful factorization of RSA-2048 integer by D-Wave'	On integers whose two primes differ in two low bits — every one of which Fermat's 1643 method splits in milliseconds. Not an RSA key.	The number was chosen to be easy. [78]
2025-04	Wang Chao's group, reported by the SCMP	A 90-bit RSA number on a D-Wave machine	No paper located as of September 2026.	Unconfirmed. [82]
2025-07	Steve Tippeconnic	A 5-bit elliptic-curve key broken on IBM's 133-qubit machine	A 15-qubit circuit over a 32-element group; the answer, k = 7, is found by classical post-processing of the readouts.	A toy key, run for real. [85]
2026-04	Giancarlo Lelli; the Q-Day Prize	A 15-bit curve key recovered on IBM Heron processors — one bitcoin awarded	About 98,000 gates on cloud hardware. Bitcoin developers reproduced the recovery from random bits, since 32,767 candidates can simply be checked; the hardware output was 'statistically indistinguishable from coin flips'.	Project Eleven's CEO: 'not Q-Day'. [95][96]

The bill

Since nobody can run Shor at scale, the field publishes estimates: how many physical qubits, at what error rate, for how long. The estimates have fallen a thousandfold in fourteen years, all on paper. Each one assumes a physical error rate of about one in a thousand and a code that turns many noisy qubits into one reliable one; the newest ones assume codes and wiring that do not exist yet at scale.

date	who	target	physical qubits	logical	time	note
2012-09	Fowler, Mariantoni, Martinis, Cleland	RSA-2048	1,000,000,000	—	about a day	the surface-code review's headline: a billion physical qubits for a 2000-bit number [50]
2017-06	Roetteler, Naehrig, Svore, Lauter	256-bit curve key	—	2,330	1.26 × 10^11 Toffoli gates	the first precise count for a 256-bit curve key: about 2,330 logical qubits [59]
2019-05	Gidney and Ekerå	RSA-2048	20,000,000	—	8 hours	twenty million noisy qubits, 0.1% error, 1 µs cycle [51]
2021-03	Gouzien and Sangouard	RSA-2048	13,436	—	177 days	plus a quantum memory of 28 million modes that does not exist; time traded for space [52]
2022-01	Webber, Elfving, Weidt, Hensinger	256-bit curve key	317,000,000	—	1 hour (13 million qubits for a day; 1.9 billion for 10 minutes)	the paper that first priced a Bitcoin key against the ten-minute block [60]
2023-06	Litinski	256-bit curve key	6,900,000	—	about 10 minutes per key	50 million Toffoli gates in a photonic 'active volume' model [61]
2024-02	Chevignard, Fouque, Schrottenloher	RSA-2048	—	1,730	about 40 runs of 2^36 Toffoli gates	a third of the logical qubits at the price of a thousand times more gates [76]
2025-05	Gidney	RSA-2048	1,000,000	—	under a week	fewer than a million noisy qubits; same 0.1% error assumption as 2019 [58]
2026-02	Webster and others, Iceberg Quantum	RSA-2048	100,000	—	not the headline	fewer than 100,000 on qLDPC codes with long-range wiring; about 22,000 at 0.01% error [88]
2026-03	Babbush, Zalcman, Gidney, Broughton, Khattar, Neven, Bergamaschi, Drake, Boneh	256-bit curve key	500,000	1,450	18–23 minutes; about 9–12 from a primed state	fewer than half a million superconducting qubits; fast enough for the ten-minute block on a fast-clock machine [91]
2026-03	Caltech and Oratomic	256-bit curve key	10,000	—	about 10 days per key	ten to twenty-six thousand neutral atoms; slow clock, so days not minutes [93]
2026-04	Mundada and others, Q-CTRL	RSA-2048	381,000	—	9.2 days	idle logical qubits parked in slower memory tiers [94]
2026-09	Häner and others, IonQ	256-bit curve key	19,397	1,457	25.7 days, 63% success	a trapped-ion blueprint; IonQ's largest machine is 256 qubits [100]

A scatter of amber and rose dots high on a log scale, the qubits papers ask for, falling from a billion in 2012 toward a hundred thousand in 2026; and a teal step low on the chart, the qubits real machines have, reaching about a thousand. — The gap. Amber and rose dots: what a paper says would break a key. The teal step: the most physical qubits any named machine has had. Note the vertical scale — each gridline is ten times the last. The 2026 estimates and the 2026 machines are still two to three gridlines apart, before counting that the machines’ qubits are far noisier than the papers assume.

The machines

year	machine	physical qubits	logical
2002	IBM Almaden NMR	7	—	[43]
2016	Innsbruck ion trap	5	—	[48]
2020	Google Sycamore	53	—	[62]
2022	IBM Eagle	127	—	[87]
2023	IBM Osprey	433	—	[87]
2024	IBM Condor	1,121	—	[87]
2025	Quantinuum H2 (with Microsoft)	56	12	[79]
2025	Google Willow	105	1	[62]
2026	Quantinuum Helios	98	48	[86]
2026	IBM Nighthawk	120	—	[87]

Physical qubits are the noisy ones a chip has. Logical qubits are the reliable ones built from them by error correction, and the exchange rate has been about a thousand to one for the surface code. Google's Willow (December 2024) was the first chip clearly past the point where adding physical qubits makes the logical one better instead of worse [62]; Quantinuum's Helios (November 2025) holds 48 logical qubits, the most anywhere [86]. The papers want more than a thousand logical qubits running billions of operations. IBM's roadmap puts 200 logical qubits in 2029 [84].

The wallet page has the 2026 estimates for a curve key specifically, and the ten-minute question.