Has the combination of Microsoft's 2029 roadmap and recent reductions in the quantum resources required for elliptic-curve discrete logarithms made a cryptographically relevant machine by the end of the decade a credible planning scenario?

The answer is still uncertain, but the possibility can no longer be dismissed as remote.

1. What Microsoft has actually announced

Microsoft has not announced that the current Majorana 2 processor will enter industrial production in 2029, nor has it published the number of logical qubits that its proposed 2029 machine will provide.

Majorana 2 is a multi-tetron experimental device. Microsoft describes a tetron as a topological qubit built from two superconducting nanowires with Majorana Zero Modes at their ends. The four-qubit array shown in the Majorana 2 publication therefore represents four topological physical qubits, not four fault-tolerant logical qubits.

This distinction is essential. A logical qubit is obtained only after quantum error correction and must remain reliable throughout a very long computation. Consequently, it is not valid to divide the logical-qubit requirement of Shor's algorithm by four and interpret the result as a number of Majorana 2 processors.

What Microsoft does state is that Majorana 2 has improved qubit stability by approximately three orders of magnitude over its previous processor, with mean lifetimes around 20 seconds, operations on the microsecond scale, and an architecture intended to scale. On that basis, Microsoft says that it now aims to deliver a scalable and practical quantum computer by 2029.

That is a roadmap target, not a declaration that ECC-256 will be breakable in 2029. However, it provides a concrete engineering horizon against which cryptographic migration lead times can be assessed.

2. Microsoft's own earlier estimate for attacking P-256

Microsoft's Azure Quantum Resource Estimator previously evaluated a Shor attack against the P-256 elliptic curve. Under its predefined Majorana hardware assumptions, the estimate was approximately:

Majorana, reasonable assumptions:
    3.69 million physical qubits
    8 hours

Majorana, optimistic assumptions:
    1.10 million physical qubits
    4 hours

These estimates were based on an older logical circuit and assumed gate and measurement times of 100 nanoseconds. They should not be treated as a prediction for Majorana 2. Microsoft now describes Majorana 2 operations as occurring on the microsecond scale, and the actual physical-to-logical conversion, logical error rate, code distance, magic-state production capacity and system architecture of a 2029 machine have not been disclosed.

Nevertheless, the estimate is important for one reason: Microsoft itself has modelled an ECC-256 attack as a million-scale physical-qubit problem under a topological architecture, rather than as a problem requiring an astronomically larger machine.

3. The logical-qubit requirement is falling

The cryptanalytic side of the equation has changed materially during 2026.

A March 2026 analysis of elliptic-curve cryptocurrencies estimated that the 256-bit elliptic-curve discrete logarithm problem could be solved using either:

• fewer than 1,200 logical qubits and fewer than 90 million Toffoli gates,

or:

• fewer than 1,450 logical qubits and fewer than 70 million Toffoli gates.

The authors estimated minute-scale execution on a fast superconducting architecture with fewer than half a million physical qubits under their stated assumptions. Those physical estimates do not transfer directly to Microsoft's topological architecture, but they demonstrate that improved circuits can substantially reduce the cryptanalytic threshold.

A further paper published in July 2026 reduced the width for a 256-bit prime-field curve to 835 logical qubits. This is a space-optimized construction and therefore involves a significant time/gate trade-off. It should not be interpreted as proving that any machine with 835 logical qubits can immediately break ECC-256. The machine would also need sufficient logical fidelity, circuit depth, non-Clifford operations, classical feed-forward and total execution time.

The important trend is not one isolated number. It is the downward progression:

approximately 2,124 logical qubits in the earlier estimate,
then approximately 1,100-1,450,
and now 835 in a space-optimized construction.

Hardware roadmaps and attack algorithms are improving simultaneously.

4. What can and cannot be inferred for Zano

Zano uses Ed25519-domain elliptic-curve constructions rather than P-256 or secp256k1. The published figures above therefore cannot be copied directly into a Zano threat estimate. A defensible calculation would require a circuit and resource estimate specifically adapted to the curve operations, coordinate system, error-correction model and hardware assumptions relevant to Ed25519.

However, Ed25519 is not outside the scope of Shor's algorithm. It relies on the hardness of an elliptic-curve discrete logarithm over a prime field of comparable security scale. It is therefore reasonable to expect the required resources to be in a broadly comparable class, while leaving the exact count as an open technical question.

For Zano, the consequence is more direct than a conventional on-spend attack against a temporarily exposed public key.

Every private or legacy UTXO publishes a one-time output public key of the form:

P = xG

where x is the one-time private spending key. If an adversary can solve the discrete logarithm on the curve, the attack is:

x = log_G(P)

The permanent wallet address may remain hidden, but the individual output can lose custody security. The attacker does not need to wait for the owner to spend the output or reveal a permanent public key. Historical unspent outputs are already available for precomputation and prioritisation.

This means that faster blocks or shorter confirmation times under Zenith do not remove the underlying exposure. They may improve the response window for some transaction-race scenarios, but they do not protect a public one-time output key whose secret can be recovered directly.

5. The appropriate conclusion

The evidence does not justify the statement:

• Microsoft will break ECC-256 in 2029.

It does justify a more careful statement:

• A fault-tolerant machine of the scale Microsoft is targeting for the end of the decade may fall within the resource class required by increasingly efficient attacks against 256-bit elliptic curves.

This remains conditional on unresolved factors:

• the number of usable logical qubits;
• the physical-to-logical overhead;
• logical error rates and code distance;
• gate and measurement speed;
• magic-state production throughput;
• system interconnection and control;
• the runtime of the selected attack circuit;
• and the exact resource requirements for Ed25519.

The probability is not established. The planning consequence is clearer.

A post-quantum migration for Zano requires architectural design, implementation, independent review, testnet operation, wallet changes, backup changes, service integration and enough time for users to migrate economically significant value. Beginning that work only after a cryptographically relevant quantum computer has been demonstrated would be too late, because existing output public keys are already on-chain.

For planning purposes, 2029 should therefore be treated as a conservative engineering boundary, not as a predicted break date.

6. A concrete question for the Zano roadmap

The most useful immediate step may be to commission or reproduce a Zano-specific quantum resource estimate covering Ed25519 and the principal Zano relations built upon it.

At minimum, it should distinguish:

• logical-qubit width;
• Toffoli or T-gate count;
• circuit depth;
• physical-qubit requirements under several error-correction models;
• expected runtime under fast and slow hardware clocks;
• and the difference between recovering a one-time spending key and attacking the wider Zarcanum/Zenith proof system.

Such an estimate would not solve the transition problem, but it would replace broad analogy with a measurable threat model and help determine how much of the post-quantum groundwork must be incorporated into the HF7/HF8 architectural cycle.

My present assessment is therefore:

• It is not confirmed that Microsoft's proposed 2029 machine will be able to attack Ed25519. However, given the scale Microsoft is targeting and the reduction of published ECC-256 attack estimates to approximately 835-1,450 logical qubits, that possibility is no longer remote enough to justify postponing Zano's post-quantum preparation until after 2029.

References

1. Microsoft Quantum, "Majorana 2 – Microsoft's Scalable Quantum Processor With Reliable, Long-Lasting Qubits"
   https://quantum.microsoft.com/en-us/insights/blogs/majorana-2-scalable-quantum-processor

2. Microsoft Quantum, "Calculating resource estimates for cryptanalysis"
   https://quantum.microsoft.com/en-us/insights/blogs/resource-estimation/calculating-resource-estimates-for-cryptanalysis

3. Babbush et al., "Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations," arXiv:2603.28846
   https://arxiv.org/abs/2603.28846

4. Luo et al., "Quantum Algorithm for Elliptic Curve Discrete Logarithms with Space-Efficient Point Addition," arXiv:2607.13816
   https://arxiv.org/abs/2607.13816