Magic State Cultivation: Google Willow Cuts Errors 40-Fold

What Google actually demonstrated

Google Quantum AI announced on October 15 that it had run a technique called magic state cultivation on its Willow processor. The company said it cut errors about 40-fold compared with uncultivated states and produced T-states with a record logical fidelity of 99.99%.1 The paper appeared in Science. Sundar Pichai promoted it as the first time the method had worked on physical hardware and called it "another step" toward useful error-corrected machines rather than a finished product.8

The result needs some explanation, because it is easy to misread. Error correction handles the routine operations in a quantum computer fairly well. A general-purpose program, though, also needs a class of harder operations, and those require "magic states." These are prepared resources that get used up each time an operation runs.9 Producing clean ones is expensive. Google cites estimates that up to 95% of a quantum computer's capacity could go into making them.2 The standard approach, magic state distillation, was proposed by Sergei Bravyi and Alexei Kitaev in 2004. It needs large dedicated qubit "factories."9

In 2024, Craig Gidney, Noah Shutty and Cody Jones proposed a cheaper alternative that works more like a filter.2 A noisy state is placed on a small patch of the chip. A series of coordinated measurements checks it for errors, attempts with detected flaws are thrown out, and the survivors are grown into a larger encoding.18 The team also showed that a state could be moved from a distance-3 color code, which suits cultivation, into a distance-5 surface code, the more established error-correction scheme.18 That handoff matters for scaling, because cultivated states need to feed into the architecture a large machine would actually use.14

The caveats behind the 40x number

The more careful coverage agrees that the headline figure needs context. Only about 8% of attempts passed every check, so the chip discarded more than nine of every ten tries to keep one clean state.9 The 99.99% fidelity applies only to states that survived inspection.4 The experiment used at most 54 of Willow's 105 qubits.17

The 40x figure is also narrower than some framing implied. Pichai described it as a gain "vs. previous methods."8 Google's research team measured it against uncultivated states, and The Quantum Insider pointed out that this is a result for one state-preparation task, not a 40-fold improvement across the whole processor.11 The gap widened on social media, where some posts turned it into a 40x cut in resource costs. That claim was not measured.13 Some reporting also printed the accuracy as 99.9% instead of 99.99%.3

The write-up also included details that got less attention. The team used reinforcement learning as a final calibration step. Google reports that this improved both the logical error rate and the share of retained attempts by about an order of magnitude.11 One storage test, however, produced errors about seven times higher than simulations predicted.11

The distance from cryptographic relevance is still very large. The paper notes that factoring an RSA-2048 key would require magic-state error rates around one in 10 billion, roughly a million times cleaner than what Google achieved.17 Google's own projection shows how this could improve: cultivation errors scale with the cube of the hardware noise, so halving Willow's underlying noise would push magic-state errors to about two in 100,000.9 That relationship is the most important technical point in the paper. Modest hardware improvements could produce outsized gains in magic-state quality.

Why crypto markets read it as a Q-Day story

Crypto outlets framed the result around "Q-Day," the point at which a quantum computer could break the elliptic-curve signatures that secure Bitcoin.7 That framing depends on Google research from March. A whitepaper co-authored with Ethereum Foundation researcher Justin Drake and Stanford cryptographer Dan Boneh estimated that fewer than 500,000 physical qubits could break Bitcoin's elliptic-curve cryptography.9 That is roughly 20 times fewer than some earlier estimates.1 The same work described a hypothetical attack that could recover a private key from an exposed public key in about nine minutes.1 Expressed in error-corrected units, it called for 1,200 to 1,450 logical qubits.3 A September paper from a team including Ethereum Foundation and StarkWare contributors lowered the count again, to a circuit needing 1,151 logical qubits for a key step of Shor's algorithm.

CoinDesk's analysis makes the clearest link to the new result. That same March estimate assumed a machine producing roughly 500,000 reliable magic states every second during the nine-minute attack.4 Cultivation addresses that supply problem. It does not make an attack 40 times cheaper, because the March numbers already assumed efficient magic-state production.4

This is where expert opinion divides. Castle Island Ventures co-founder Nic Carter said quantum timelines are compressing and that AI-assisted error correction is speeding up progress, though he added that no threat is imminent.2 Project Eleven CEO Alex Pruden argued that the result does not move Q-Day forward, because the technique was already built into earlier resource estimates. In his view it validates those estimates, which makes the existing timeline more credible.2

Pruden's reading is the more accurate one. The experiment does not change the math of an attack. It reduces the chance that one of the key engineering assumptions behind that math turns out to be wrong. That should worry Bitcoin holders more than a dramatic headline would, because it means the published estimates are holding up, not inflating.

Exposure estimates and timelines vary widely

How much bitcoin is at risk depends on whose count you use. Project Eleven puts it at roughly 6.99 million BTC sitting in addresses with exposed public keys. About 72% of that comes from address reuse and about a quarter from legacy pay-to-public-key outputs.21 Other outlets cited about 6.26 million BTC3 and a Glassnode-based figure of about 6.04 million.7 Coinbase's Quantum Advisory Council estimates about 1.7 million BTC in legacy P2PK addresses alone.27 The figures differ, but they all point to a large share of supply that a capable machine could target first.

Timeline estimates vary even more. One summary of 2026 research places a baseline Q-Day around 2033, within a range of 2030 to 2042.7 Some observers have suggested 2028.2 Casa's Jameson Lopp thinks a machine able to break a Bitcoin key is at least a decade away.5 Polymarket traders gave a 1% chance by year-end and 11% by the end of 2027.3

Where the hardware roadmaps stand

The broader industry shows how far away a machine with more than a thousand logical qubits still is. IBM has reported 70 logical qubits, and QuEra has run algorithms on up to 96.3 IBM's roadmap aims for 200 logical qubits by 2029 and 2,000 by 2033. Those are company targets, not current capabilities.3 Coinbase says today's most advanced quantum machines have fewer than 1,000 qubits.27

On that roadmap, the September estimate of roughly 1,151 logical qubits falls somewhere between IBM's 2029 and 2033 targets. Separately, Google itself plans to move its own systems to post-quantum cryptography by 2029.1

Bitcoin's migration problem

The real constraint is governance, not physics. Coinbase published technical priorities on October 13. It argued that Bitcoin's post-quantum transition is a multi-year effort and estimated that a signature migration could take up to seven years.2427 The proposal it highlighted, BIP-360, defines a Pay-to-Merkle-Root output that removes Taproot's quantum-vulnerable key-path spend.24 It needs a soft fork and is still a draft.25

BIP-360's authors acknowledge that it protects against long-exposure attacks but not short-exposure ones. A nine-minute attack during a ten-minute average block interval could enter that race about 41% of the time.28 Coinbase suggested evaluating NIST-standardized signature schemes such as ML-DSA and SLH-DSA to cover that gap.24 A developer roadmap names BIP-360, SHRINCS, Lifeboat and Dropkick, with a goal of quantum resistance by December 2029. Nine blockchain firms also launched a Quantum Alliance on October 15 to work on open standards.23

The hardest question is what to do with coins that will never move. These include lost keys and dormant early wallets, which may include an estimated 1.1 million BTC attributed to Satoshi Nakamoto.23 Coinbase wants that debate handled separately from the technical upgrade.26 Others warn that proposals to freeze vulnerable coins would threaten Bitcoin's property-rights guarantees.23

The bottom line

Google's experiment does not threaten any wallet today. It is a small, heavily filtered proof of concept, and its error rates are still about a million times too high for code-breaking.17 What it does is turn one of the more optimistic engineering assumptions behind the March attack estimates into something shown on real hardware. If Coinbase is right that migration could take up to seven years, and the baseline Q-Day forecasts around 2033 hold, Bitcoin has little time to spare.277 The main risk is no longer whether such a machine can be built. It is whether Bitcoin's slow, consensus-driven upgrade process can finish in time.