Craig Gidney

I plotted the asteroid data from Kirkwood's 1887 paper (gutenberg.org/ebooks/41570) next to the 2007 plot from Wikipedia's page on Kirkwood gaps. I think it's a good example of available data going from convincing only if you know the theory to just blatantly speaking for itself.

@GilKalai @Matthew__Wong_ @ap2pkh4u @Du_Bi_Bo @neha @BranBTC For the record, that's not a quote from me. The writing style is wrong. I don't put sentence-level punctuation inside quotes (or use em-dash). The argument style is wrong. I don't thinkn I'd say "debunked years ago" and just stop. It's too vague. Screams for an example or link.

@Matthew__Wong_ @ap2pkh4u @Du_Bi_Bo @neha @BranBTC @CraigGidney Matt, where id Gidney's quote taken from?

Follow up on Bitcoin and Quantum: A proposed roadmap. nehanarula.org/2026/04/20/bit… tl;dr: we should work towards activating a PQ-safe output type with PQ signatures now. everything else (including escape hatches, zk proofs, commit/reveal, to freeze or not) can, and should, wait.

@adam3us One of the potential sudden-progress scenarios is if everything gets hung up on making an interconnect between modules. Before you have an interconnect, you can have an unworkable qubit count ceiling. After you have an interconnect, you can do brute force scaling.

@adam3us Quantum error correction has quality, quantity, and capability thresholds that can make progress look slow then fast. A partial example that actually happened is the lifetime of classical bits stored on a quantum chip improved by 8000x in one year ( algassert.com/post/2503 ).

Blog post: "The predictable failure of the QDay Prize" algassert.com/post/2601

@adam3us Shor's algorithm has to remove factors of 2 classically, so you can't meaningfully start with 6. The quantum computer never gets used for 6.

@CraigGidney good to see balancing commentary from quantum researchers. kudos. against "call me back after you’ve factored 21" why? start with factor 6, as you said without error correction it's not real. so define benchmark WITH error correction, eventually error corrected HW may get there.

@IanSmith_HSA @apruden08 Ah, okay, yes, I am familiar with those papers. The thing I am asking for basically amounts to combining them (and running at a high code distance).

@CraigGidney @apruden08 From operation paper abstract, "we create over 30,000 initialized qubits per second, which we leverage to assemble and maintain an array of over 3,000 atoms for more than two hours"

Craig Gidney, the Google researcher who recently co-authored the paper about quantum risk to cryptocurrencies provided a sharp critique of the Q-Day Prize. He’s right: small factoring problems are a very imperfect yardstick for Q-Day. Still, there is a real divide between physicists (who see quantum computing accelerating) and many smart people in the cryptography community who want to see evidence before they throw time-tested, classically secure systems into the bin. Skeptics like @reardencode who I debated recently, is an intelligent, longtime Bitcoin developer who understands quantum computing, its potential, and limitations. @jonasschnelli is a Bitcoin core maintainer who has been even more critical of the Q-Day Prize than Craig. Or prominent cryptographer @matthew_d_green who has publicly stated skepticism about CRQC timelines in recent resource estimates. So, since small factoring problems aren't a good yardstick for Q-Day, then what is? I’ll happily take feedback on how we can better incentivize open benchmarking towards Q-Day risk. The Q-Day Prize was an attempt to bridge the existing gap, while also inviting awareness of the problem and education about quantum algorithms. It was certainly imperfect. But if there's a better way to achieve the broader aim, we'd love to hear suggestions.

@IanSmith_HSA @apruden08 Over-unity is a much weaker requirement than "so good it's hard to sample any errors". Can you cite a paper on running for an hour? AFAIK Quera doesn't have reloading-while-running, so if they tried to run continuously for an hour it'd fail due to the atoms gradually escaping.

I thought some of the other platforms outside google achieved a lot of these goals already. QuEra had hours long calculations in their paper last year. They claimed over unity and 30 logical during the first pre-release paper, but admitted they were not at over unity at pre-release.

Yesterdays Project 11 debacle has made it clear to me that the proper approach for having the quantum and Bitcoin discussion looks something like the following: 1) A group of technically literate experts with a strong grasp of the SOTA in both quantum AND cryptography/bitcoin comes together. This ideally has a blend of quantum academics from respected institutions, quantum computer builders from major labs, bitcoin core devs, etc. 2) This group of technical experts meets on a semi annual basis to present, analyze and debate findings. These discussions are held in a public forum or at least recorded for public review. 3) This group produces semiannual reports on the state of quantum both in terms of CRQC timelines (with strong bias against hyping false marketing promises) and state of cryptographic research for alternative signature schemes (i.e. SPHINCS+ by @n1ckler). Reports should include timeline estimates similar to Metaculus prediction windows. 4)This annual production is a strong basis by which the entire ecosystem (hodlers, miners, exchanges, ETFs, custodians) can start to align on the scope and timing of the migration problem. A few key caveats. 1) this should not be organized or published by a private company, especially not one who’s *entire purpose* is to monetize quantum migration. 2) every part of this, from participant selection, to discussion, to report findings, should be open to the public. 3)there should be a heavy dose of hypeman skepticism around quantum improvements and recognition of the iatrogenic effects from hastily adopting a poorly tested cryptographic alternatives. Until something like this exists, the public discourse will continue to be sloppy, clickbait driven and generally annoying for us. I get asked about quantum all the time on Capitol Hill and would like to have definitive resources to point to. Previously, the Bitcoin Mining Council helped organize the mining industry against coordinated attacks against mining in America — should we establish a Bitcoin Quantum Council to give reliable estimates and projections for Bitcoin and quantum? Should we at Bitcoin Policy Institute, as a 501c3 educational non-profit, organize this? These are preliminary ideas. I’ll be in Vegas and am open to suggestions.

@apruden08 @robin_linus Like, yes, it's factually true that it's 10000x fewer Toffolis vs Chevignard. But that is an extremely bad summary of the plot as a whole. A far better summary is to compare to the closest point on the pareto frontier rather than the furthest one.

@apruden08 @robin_linus Chevignard+ were focused on saving space at all costs, not on making a balanced estimate, so that's not the comparison point I'd pick. I think of the circuit as ~10x less volume than Gouzien. Saying it's a 10000x improvement strikes me as misleading.

My little sister’s quantum horoscope has more scientific rigor than Project Eleven.

@ivanmiskovic In my experience, things like this build up and get refined and generalized over time until there's enough to make a noticeable difference.

@ivanmiskovic Not really. There used to be a lot of S gates in magic state factories, but that went way down due to magic state cultivation. There can be S gates in the corrections to the gate teleportations used for toffoli gates, and this might help there, but probably not very much.

This is a nice idea for a 30% reduction in the size of a surface code S gate: arxiv.org/abs/2604.13632 I was always worried moving twists in this way would have some low distance issue, but I never tested it. They do circuit sims showing it works well.

I took solace in the part of the post where he'd bypassed the need to uncompute (a *HUGE* advantage for saving qubits) but was still struggling to match our qubit count 😈. With that an advantage that physically impossible, I bet you can hit ~800 qubits instead of ~1150.

Congrats to Ryan Keegan for being the first to exploit the simulator we used to validate the secret quantum circuits: blog.trailofbits.com/2026/04/17/we-… It kills me that the (now fixed) bugs were simple (we didn't port the op validation code from C++ to Rust!), but that's to be expected.

@dallairedemers I'm not aware of anyone finding as-good-or-better circuits yet. I'd be impressed if it was less than a month (getting all the details nailed down takes time, as does paper writing). I'd be shocked if it takes more than a year. I'd interpret that as people not caring to try.

@CraigGidney Is it the case too for your other recent poll? 😅 x.com/CraigGidney/st…

We published zero-knowledge-proofs that we know better quantum circuits for ELDPC. This is the first time this has been attempted. In cryptography, it's easy to make mistakes. How long until the community finds something about the proof that needs to be fixed?

@seunlanlege The source code for the prover was uploaded alongside the paper. You can get it from zenodo.org/records/195971… .

I'm calling bullshit on Google's post quantum circuit. If the prover's source code isn't open-source then it's all smoke & mirrors. "Oh look here's some groth16 proof of some arbitrary program" It's almost like they think we're goycattle or something.

@dallairedemers Yup. Actually, I knew about it when I made the poll (the fix commit was already in the public github repository). I wanted a sense of outside opinion before it was tainted by hindsight bias. Alas, there weren't that many votes.

@CraigGidney Less than a month it seems x.com/i/status/20450…