Google Cut Quantum Magic-State Errors 40-Fold on Willow. The Gap to Breaking Bitcoin Is Still About a Million-Fold in Error Rate

Google Quantum AI reported on 15 October 2026, in a paper in Science, that it cut the error rate of 'magic states' roughly 40-fold on its Willow chip, reaching what it calls a record 99.99 per cent logical fidelity. Headlines turned that into a step toward breaking Bitcoin. The arithmetic says something more specific. A fidelity of 99.99 per cent is an error of about 1 in 10,000. Decrypt reports that breaking RSA-2048 would need magic states with an error near 1 in 10 billion, 'roughly a million times cleaner'. A forty-fold improvement is real progress, and it leaves a gap of six orders of magnitude.

This article uses Decrypt's report of the paper (the Science DOI it gives is 10.1126/science.aee7961) as its main source, with a secondary roundup for context. We have not read the paper itself. Decrypt notes it found no independent expert commentary, so the claims below are Google's. Figures that are our own arithmetic are labelled.

What a magic state is, and why it dominates the bill

A quantum computer built from error-prone physical qubits can protect information by spreading it across many of them, which produces 'logical' qubits. Most of the basic operations on logical qubits are cheap in this scheme. A few essential ones are not, and they are performed by consuming a special resource called a magic state. Each magic state is used up once. Decrypt reports Google saying that some estimates put the cost of producing magic states at up to 95 per cent of a quantum computer's capacity. Whatever the exact share, the practical consequence is that the quality and cost of magic states largely set how big a machine has to be.

The standard way to make them, proposed by Sergey Bravyi and Alexei Kitaev in 2004, is distillation: take many noisy states and combine them into fewer cleaner ones. It works, but needs dedicated qubit 'factories'. Google researchers proposed an alternative in 2024 called cultivation, described in Decrypt's report as a cheaper, filter-style method, with their paper suggesting further distillation 'may never be needed in practice'. Until this experiment, cultivation had been tested only in theory and simulation.

How cultivation works, and why only 8 per cent of attempts survive

Cultivation grows a state and keeps checking it. If a check detects an error, the attempt is thrown away and started over. This is called post-selection, and it trades attempts for quality. Decrypt reports that about 8 per cent of attempts passed every check, so more than 90 per cent were discarded. On average that is about 12.5 attempts for each accepted state (1 divided by 0.08, our arithmetic).

The trade is a good one only if attempts are cheap. Cultivation needs few qubits per state, which is its attraction compared with a distillation factory, but it spends time. The experiment used at most 54 of Willow's 105 qubits, about half the chip (our arithmetic). The reported result was a roughly 40-fold reduction in error compared with un-cultivated states, giving states with 99.99 per cent logical fidelity. If both figures refer to the same error measure, the un-cultivated starting point would have been around 4 in 1,000 (40 times 1 in 10,000, our inference, not a reported number).

The gap, in numbers

Here is the comparison the news coverage did not make explicit. Today's reported error is about 1 in 10,000. Decrypt reports Google's projection that halving Willow's underlying hardware noise would push the error to about 2 in 100,000, because magic-state errors scale with the cube of the noise level. That projection has not been demonstrated. Taken at face value, halving the noise would reduce the error by a factor of eight, which on a clean 1 in 10,000 would give about 1.25 in 100,000. The slightly higher 2 in 100,000 in the report is consistent with '99.99 per cent' being a rounded figure for an underlying error nearer 1.6 in 10,000 (our inference).

Even Google's projection leaves a distance to cover. From 2 in 100,000 to the 1 in 10 billion that RSA-2048 would need is a factor of about 200,000 (our arithmetic). If the cube law held across that whole range, which nobody has shown, getting from today's 1 in 10,000 to 1 in 10 billion would require physical noise about 100 times lower, since the cube root of a million is 100. That is roughly seven halvings of hardware noise (our arithmetic).

The counter-argument: the requirement is also shrinking

There is a reasonable objection to measuring progress only against a fixed target. The target has been moving. Decrypt reports Craig Gidney's 2025 estimate that RSA-2048 could be broken with under a million noisy qubits, down about 20-fold from his 2019 estimate of 20 million. It also cites a March 2026 Google Quantum AI whitepaper, with co-authors Justin Drake of the Ethereum Foundation and Dan Boneh of Stanford, estimating that breaking Bitcoin's elliptic-curve cryptography would take fewer than 500,000 physical qubits. Better algorithms and better error correction each lower the bar from the other side, and cleaner magic states are one input to those estimates.

Set against the hardware, the distance is still large in a different currency. Willow has 105 qubits. The Bitcoin estimate of fewer than 500,000 is about 4,800 times that number, and the RSA estimate of under a million about 9,500 times (our arithmetic). Qubit counts and state quality are separate problems, and the estimates assume that the hardware error rates needed for those counts are achieved. The two gaps are not additive, but neither is closing automatically.

What this means for Bitcoin, and for everyone else

Decrypt stresses that nobody can drain wallets with this result, and that is consistent with the numbers. The practical consequence is a planning one. A cryptographic migration takes years, and estimates of the required machine size have fallen quickly. The 'harvest now, decrypt later' risk, in which encrypted data is stored today for decryption by a future machine, applies to long-lived secrets regardless of whether a machine arrives next year or in twenty. The 2025 and 2026 estimates above are why post-quantum migration plans exist; this paper is one input that makes the machine marginally less distant, not an event that changes a schedule.

For the specific case of Bitcoin, the vulnerable parts are the elliptic-curve signatures that protect coins whose public keys are exposed. We found no source in this research quantifying how many coins that covers, so we make no estimate. Any such number would need its own analysis.

What the evidence does not establish

• Independent verification: Decrypt found no independent expert commentary; the 40-fold figure and the 'record' label are Google's.
• Scale: the experiment used at most 54 of 105 qubits, and cultivation at larger scale is Google's stated next step.
• The projection: the 2 in 100,000 figure after halving hardware noise is a projection from a cube-law assumption, not a measurement.
• Timelines: none of the sources gives a date by which a machine capable of breaking RSA-2048 or Bitcoin's signatures will exist.
• Our inferences: the 4 in 1,000 starting error and the 1.6 in 10,000 underlying error are back-calculations from rounded numbers, not reported values.

The finding to take away is the shape of the gap, not its direction. Google has shown that a cheaper way of making magic states works on real hardware, and the error improvement is large. The distance to a cryptographically relevant machine is still dominated by two things this experiment does not address: reducing physical noise by roughly two orders of magnitude, and scaling the machine by roughly three to four orders of magnitude in qubits. The next data points to watch are a larger-scale cultivation run and independent assessments of the Science paper.