On Thursday, October 15, Google Quantum AI presented in the journal Science an experiment carried out on its Willow chip: “magic state cultivation”. According to the company, this technique reduces errors by about 40 times on one of the most costly resources in quantum computing. The result is solid, but it remains a laboratory result, which Google itself describes as a step that still needs to be confirmed at a larger scale.

Why a quantum computer needs magic states

A quantum computer corrects its errors by spreading information across a large number of physical qubits. This principle works for most operations, but one indispensable family escapes it: the so-called T gates. Without them, explains the Journal du Coin, the machine cannot go beyond what a classical computer is able to simulate. It is precisely these operations that make it a universal machine.

To execute a T gate, a “magic state” must first be prepared, a particular quantum state that is consumed when used. Producing them is a heavy burden: some estimates set aside up to 95% of a machine’s capacity for this task alone. Since the distillation method proposed by Sergei Bravyi and Alexei Kitaev in 2004, they had been produced in bulky qubit “factories”.

The method: filtering rather than distilling

Cultivation, theorized by Craig Gidney and his colleagues in 2024, works like a filter. A noisy state is injected into a small area of the chip, a series of coordinated measurements follows, and any attempt that fails one of the checks is discarded.

On Willow, the team of Emma Rosenfeld and Craig Gidney obtained T states with a fidelity of 99.99%, which, according to Google, amounts to “a 40-fold reduction in errors compared with uncultivated states”. To achieve this, the researchers moved from a distance-3 color code to a distance-5 surface code. The experiment used at most 54 of the chip’s 105 qubits.

The limits of the result

The yield remains low: only 8% of attempts passed all the checks, which means that the vast majority of runs are rejected. Google warns that cultivation “still needs to be demonstrated at a larger scale” and acknowledges that many technical challenges remain.

The gap with the requirements of a truly useful computation is considerable. According to Google’s blog post and the accompanying paper, factoring an RSA-2048 key would require states about a million times cleaner, with the error brought down to one in ten billion. The paper nonetheless puts forward a favorable scaling law: cultivation errors decrease with the cube of the hardware noise. Halving Willow’s noise would thus bring the error down to about two in 100,000. This is a projection, not a measurement.

Quantum Bitcoin: a confirmed assumption, not an immediate threat

The link with cryptocurrencies runs through resource estimates. In May 2025, Craig Gidney brought the cost of factoring an RSA-2048 key down to fewer than a million noisy qubits, twenty times less than his 2019 estimate. Cultivation was already among the assumptions of that calculation. In March, a Google white paper co-authored with Justin Drake and Dan Boneh put the cost of breaking Bitcoin’s elliptic curve below 500,000 physical qubits. According to the Journal du Coin, the threshold for breaking a secp256k1 key fell to 813 logical qubits at the end of August.

Thursday’s demonstration therefore turns one of the assumptions of these models into an experimental result. It does not, however, bring a concrete attack any closer in the short term: Willow has only 105 physical qubits, and the cultivation yield remains at 8%. The established result concerns a basic building block; the threat to ECDSA signatures remains a prospect, whose timeline depends on hardware progress that has not yet been demonstrated.

The regulatory timeline is moving forward on its side. NIST plans to deprecate vulnerable algorithms after 2030, then to ban them after 2035. Since August, Circle has been publishing a public tracker of the gap between demonstrated qubits and required qubits. On the Bitcoin side, protection proposals, led by BIP-360 and BIP-361, are progressing at the pace of community consensus.

Sources