What It Will Actually Cost to Break RSA-2048: Energy, Hardware, People, and the Bill Nobody’s Talking About

(A companion piece to The Enormous Energy Cost of Breaking RSA-2048 with Quantum Computers, updated for the Gidney 2025 resource estimates.)

Somewhere in a facility that doesn’t exist yet, a dilution refrigerator the size of a small room hums at 15 millikelvin — colder than the void between galaxies. Inside it, roughly a million superconducting qubits are ticking through the 9.2 quantum “shots” needed to factor a 2048-bit RSA integer. A team of a dozen quantum engineers monitors dashboards, watching for the telltale signs of logical errors that would force them to start a shot over. The electric meter spins. Five days pass. The classical post-processing confirms: the factors have been found.

The question everyone asks about this moment is when. But there’s another question that deserves more attention: how much does it cost?

Not just the electricity (which I estimated previously) but the full bill. The capital amortization on a machine that may have cost hundreds of millions to build. The salaries of the people qualified to run it. The facility that houses it. The helium supply chain. The classical supercomputer running error decoding in real time. When you add it all up, breaking a single RSA-2048 key starts to look less like a computation and more like a small military operation.

This article is an exercise in informed estimation — an attempt to put a rough dollar figure on what it will actually cost to operate a cryptographically relevant quantum computer (CRQC) for a week-long RSA-2048 factoring run, across the leading hardware modalities. The numbers are necessarily approximate. But the order of magnitude matters, because it shapes who can afford to run a CRQC, how many keys they can break per year, and how quickly the threat commoditizes.

And to be clear upfront: these cost estimates are presented as a curiosity, not as reassurance. As I’ve argued in Q-Day: What Will Actually Happen and Q-Day Confidence Crisis, the fact that your key probably won’t be the first one cracked is not a reason to delay PQC migration. It’s a reason to migrate before the economics improve.

The Baseline: Gidney 2025

Our cost model starts with the best available resource estimate: Craig Gidney’s May 2025 paper, “How to factor 2048 bit RSA integers with less than a million noisy qubits.” As I covered in my analysis of that paper, Gidney’s headline result is striking: under a million physical qubits and under a week to factor RSA-2048.

The specifics matter for costing. Gidney’s estimate assumes a superconducting architecture with a square grid of qubits, nearest-neighbor connectivity, a uniform gate error rate of 0.1%, a surface code cycle time of 1 microsecond, and a classical control system reaction time of 10 microseconds. Under these assumptions, the algorithm requires approximately 897,864 physical qubits (rounded to “less than a million” for slack), organized into three regions: a compute zone with six magic state factories, hot storage for active logical qubits, and cold storage using yoked surface codes for the 1,280 idle input qubits.

Each shot takes roughly 12 hours. The algorithm expects 9.2 shots total (with an Ekerå-Håstad parameter of s = 8), meaning the raw compute time is approximately 4.6 days. After accounting for the 93.3% probability of each shot surviving without a logical error, the expected wall-clock time rises to about 5 days — rounded up to a week for engineering slack.

These are the numbers we’ll use to build the cost model.

The Energy Bill: Updated

In my earlier analysis, I worked primarily from the 2023 RAND Corporation estimate, which used the older Gidney & Ekerå 2019 resource estimate of 20 million qubits running for 8 hours. RAND estimated approximately 6 watts per physical qubit as a plausible extrapolation for a superconducting CRQC, producing a total system power draw of roughly 125 megawatts and an electricity cost of approximately $64,000 per key broken.

Gidney’s 2025 paper changes the math dramatically — but not in the direction you might expect.

The qubit count has dropped 20× (from ~20 million to ~1 million), but the runtime has increased from 8 hours to approximately 5 days. At the RAND estimate of ~6 watts per qubit, a million-qubit system would draw roughly 6 megawatts. That’s a much more manageable number — comparable to a medium-sized data center or a large industrial facility, rather than a small power station.

Running 6 MW for five days yields approximately 720 megawatt-hours of energy consumption. At a U.S. industrial electricity rate of $0.07–0.10 per kWh, the electricity bill comes to roughly $50,000–72,000 per factoring run.

However, this likely understates total electrical consumption. The RAND figure of 6 W/qubit was extrapolated from existing small-scale systems and already attempts to include cryogenic overhead. But a million-qubit system will also need a substantial classical computing infrastructure running continuously for real-time error decoding — processing terabytes of syndrome data per second. This classical control plane could easily add another 1–5 MW to the total draw. A more conservative total system power estimate might be 8–15 MW, pushing the electricity bill to $70,000–125,000 per key.

This is broadly consistent with the RAND estimate despite the radically different qubit count and runtime — the spacetime volume (qubits × time) has shifted, but not disappeared.

The Machine Itself: Capital Amortization

Electricity is the cost everyone talks about. The cost nobody talks about is the machine.

No one has built a million-qubit quantum computer. But we can triangulate from what exists. Current state-of-the-art superconducting systems with 100–1,000 qubits cost in the range of $10–50 million for the complete system, including dilution refrigerators, control electronics, cabling, shielding, and associated classical compute. IBM’s Quantum System One, with 127 qubits, is estimated to cost in excess of $10 million. Google’s systems are comparable.

Scaling to a million qubits is not a linear exercise — there will be economies of scale in chip fabrication, but enormous new costs in refrigeration, wiring, and control electronics. Current dilution refrigerators can accommodate roughly 1,000–4,000 qubits each and cost $0.5–3 million per unit. A million-qubit system would require either a revolutionary new “super-fridge” (IBM’s Goldeneye project is exploring this direction, with 1.7 cubic meters of experimental volume) or a networked array of hundreds of modular refrigerators.

Reasonable estimates for the capital cost of a first-generation million-qubit superconducting CRQC range from $500 million to over $1 billion, encompassing:

• Quantum processor fabrication: $50–200 million (multiple large-scale chips or a modular multi-chip design)
• Cryogenic infrastructure: $100–300 million (including dilution refrigerators, helium supply and recycling, and thermal management)
• Control electronics: $50–150 million (thousands of arbitrary waveform generators, readout chains, microwave components, and the associated cabling — a notoriously difficult engineering challenge at this scale)
• Classical computing for real-time error correction: $20–50 million (a petascale classical system tightly integrated with the quantum hardware)
• Facility construction: $50–100 million (vibration isolation, electromagnetic shielding, cleanroom environments, power infrastructure)
• Integration, testing, and software: $50–100 million

If we amortize a $750 million machine over 10 years (a generous but not unreasonable assumption for a national-scale asset), the annual amortization cost is $75 million. Assuming the machine runs approximately 50 factoring jobs per year (one per week, with downtime for calibration and maintenance), the capital cost per RSA-2048 factoring is approximately $1.5 million.

This dwarfs the electricity cost by more than an order of magnitude.

The People: Personnel Costs

A CRQC is not a turnkey appliance. It requires continuous monitoring, calibration, and intervention by a team of highly specialized personnel. Based on the operational requirements of current quantum computing labs and analogous large-scale physics experiments, a plausible operations team for a million-qubit CRQC might include:

• 5–8 quantum physicists / quantum engineers for system calibration and qubit characterization
• 3–5 cryogenic engineers for refrigeration and thermal management
• 3–5 classical/control systems engineers for real-time error correction and the classical compute infrastructure
• 2–3 quantum software / algorithm specialists
• 2–3 facility and infrastructure support staff
• 1–2 security and operations management

That’s roughly 20–30 highly specialized staff. Quantum physicists and engineers with relevant experience command salaries of $150,000–300,000 per year in the U.S. (more in some markets, less in others). Fully loaded with benefits, overhead, and facility costs, a team of 25 professionals likely costs $8–15 million per year in personnel.

At 50 factoring runs per year, that’s $160,000–300,000 per key in labor costs.

The Facility: Ongoing Operations

Beyond electricity and people, there are significant recurring operational costs:

• Helium-3 and helium-4 supply: Dilution refrigerators consume helium isotopes. While modern “dry” systems recirculate their helium in closed loops, losses occur and reserves must be maintained. Helium-3 is exceptionally scarce (much of the global supply comes from tritium decay in nuclear weapons programs), and its price has fluctuated dramatically. For a large-scale system, annual helium costs could run $500,000–2 million.
• Maintenance and calibration downtime: Quantum systems require regular recalibration. Superconducting qubits drift, connections degrade, and control electronics need tuning. Planned maintenance might consume 20–30% of total system uptime, effectively reducing throughput.
• Classical compute for error decoding: The real-time decoder must process syndrome measurements at rates of terabytes per second. The power, cooling, and maintenance of this classical infrastructure is a non-trivial recurring cost, perhaps $2–5 million annually.
• Spare parts and component replacement: Microwave components, cables, amplifiers, and other elements of the control chain have finite lifetimes and must be stockpiled and replaced.
• Insurance and security: A billion-dollar cryptanalytic asset would require substantial physical and cyber security, as well as insurance against equipment failure.

Total ongoing operational costs (excluding electricity and personnel) plausibly run $5–15 million per year, or $100,000–300,000 per factoring run.

The Full Bill: Superconducting CRQC

Adding up all cost categories for a superconducting CRQC performing one RSA-2048 factoring:

Rounding for uncertainty, the first RSA-2048 factoring on a superconducting CRQC will likely cost somewhere in the range of $2–5 million per key, with capital amortization being the dominant cost driver.

This is broadly consistent with the observation that CRQCs will initially be “the domain of nation-states and large organizations,” as the RAND report put it. It’s roughly the cost of a single cruise missile, or a few days of operating a nuclear submarine — the kind of expenditure that intelligence agencies and military organizations consider routine.

How the Bill Changes by Modality

The estimate above is specific to superconducting qubits — the modality for which Gidney’s resource estimate was designed. But what happens if the CRQC uses a different qubit technology? The answer depends on how each modality’s strengths and weaknesses interact with the resource requirements.

Trapped Ion

Trapped-ion systems (pursued by Quantinuum, IonQ, and others) operate with ions confined in electromagnetic traps and manipulated by precision lasers. They don’t need millikelvin temperatures — the trapping occurs in ultra-high vacuum at room temperature or modest cooling. Their gate fidelities are typically the best available (two-qubit gate fidelities exceeding 99.9%), but their gate speeds are two to three orders of magnitude slower than superconducting qubits (milliseconds vs. microseconds).

This speed difference is critical. Gidney’s estimate assumes a 1-microsecond surface code cycle time. A trapped-ion system with millisecond-scale cycles would need roughly 1,000× longer to complete the same computation — meaning the one-week factoring would become roughly 20 years. This is obviously impractical.

However, trapped-ion systems have higher native connectivity and potentially require less error correction overhead. Optimistic estimates suggest that the higher gate fidelity could reduce the physical-to-logical qubit ratio, potentially requiring fewer total physical qubits. But even aggressive assumptions are unlikely to overcome the three-order-of-magnitude speed penalty for a Shor’s algorithm workload.

Bottom line: Trapped-ion CRQCs are unlikely to be competitive for RSA factoring in the near term, unless gate speeds improve by orders of magnitude or fundamentally different algorithmic approaches are found. If they are used, the multi-year runtime would make the total cost astronomical — dominated by years of personnel and facility costs rather than energy.

Neutral Atom

Neutral atom systems, pursued by QuEra, Pasqal, Atom Computing, and others, trap individual atoms using focused laser beams called optical tweezers and manipulate them with precisely tuned laser pulses.

From a cost perspective, neutral atoms have one obvious advantage: no millikelvin cryogenics. The atoms are laser-cooled to microkelvins, but the surrounding apparatus — vacuum chamber, laser systems, optical components — operates at room temperature. This eliminates the dilution refrigerator entirely, removing what is arguably the most expensive and operationally demanding subsystem of a superconducting CRQC. A large neutral atom system would still require substantial laser infrastructure (high-power, precisely stabilized lasers for trapping, cooling, and gate operations), ultra-high vacuum systems, and significant classical control electronics — but the overall facility requirements are lighter than the cryogenic infrastructure a superconducting system demands.

The problem is speed. Neutral atom gate operations are fundamentally slower than superconducting gates. Where superconducting qubits achieve error correction cycle times around 1 microsecond (the assumption underpinning Gidney’s estimate), neutral atom platforms currently operate with cycle times in the millisecond range — roughly three orders of magnitude slower. This speed penalty is not a minor inconvenience; it is the dominant factor in any neutral atom cost analysis.

Gidney’s resource estimate doesn’t directly translate to neutral atoms, but we can sketch the implications. His superconducting estimate yields a ~5-day runtime at 1 μs cycle times. Scaling that naively to millisecond cycles, a factor of 1,000, produces a runtime measured in years, which is operationally absurd. Any real neutral atom CRQC would need to compensate through some combination of massive parallelism (running many independent computations simultaneously across a much larger qubit array), faster cycle times than today’s experimental systems have demonstrated, or fundamentally different error correction architectures that exploit neutral atoms’ native advantage: reconfigurable, long-range connectivity.

That last point deserves emphasis. Superconducting qubits are fixed on a chip with nearest-neighbor connections — the constraint that drives much of the overhead in Gidney’s surface code layout. Neutral atoms can be physically rearranged during computation, enabling non-local qubit interactions that surface codes cannot efficiently exploit. This opens the door to higher-rate quantum error correction codes (such as qLDPC codes) that pack more logical qubits per physical qubit, potentially reducing total qubit counts by an order of magnitude or more. Several theoretical groups are actively exploring this design space, though no end-to-end resource estimate for RSA-2048 factoring on a neutral atom architecture with optimized codes existed at the time of writing.

Estimated cost differential: The capital savings from eliminating cryogenics could be significant — perhaps 30–50% lower upfront infrastructure costs compared to superconducting. But the runtime penalty at current cycle speeds would make the total cost of a factoring run vastly higher, because personnel, facility, and energy costs scale linearly with time. If cycle speeds improve to ~10 μs (an order-of-magnitude improvement that several groups are targeting but have not yet demonstrated at scale), runtimes would fall to the weeks-to-months range, making neutral atoms potentially competitive on total cost — especially if high-rate error correction codes deliver on their theoretical promise of dramatically reduced qubit counts. For now, neutral atoms represent the modality with the most plausible path to a cheaper CRQC in the long run, but the most uncertain timeline to get there.her due to longer runtimes, depending on the specific architecture and error correction scheme.

Photonic

Photonic quantum computers (pursued by PsiQuantum, Xanadu, and others) encode information in photons. Their primary appeal is room-temperature operation for the optical components, potentially eliminating the need for massive cryogenic systems. However, photonic approaches to fault-tolerant quantum computing typically require single-photon detectors, many of which operate at cryogenic temperatures (superconducting nanowire single-photon detectors, or SNSPDs, operate at 1–3 Kelvin).

Photonic gate speeds can be extremely fast (nanoseconds for individual operations), but the overall architecture involves complex optical switching and photon routing that may limit effective cycle times. Resource estimates for photonic CRQCs are less mature than for superconducting systems, making cost projections highly speculative.

Estimated cost differential: Potentially lower cryogenic costs but higher costs in precision optical manufacturing and photon loss management. Total cost is highly uncertain — could range from comparable to superconducting to significantly higher, depending on architectural choices.

Silicon Spin Qubits

Silicon spin qubits (pursued by Intel, UNSW/Silicon Quantum Computing, and others) operate at cryogenic temperatures (typically 1–4 Kelvin, warmer than superconducting qubits’ 15 millikelvin) and leverage existing semiconductor fabrication infrastructure. Their promise lies in potential manufacturing scalability — if spin qubits can be made reliably in CMOS fabs, the per-qubit fabrication cost could drop dramatically.

However, silicon spin qubits are at an earlier stage of development for fault-tolerant computing, with smaller demonstrated systems and less mature error correction. Gate speeds are intermediate (nanoseconds to microseconds).

Estimated cost differential: Potentially the lowest capital cost per qubit at scale (leveraging semiconductor manufacturing), with moderate cryogenic costs (4K cooling is cheaper and more mature than 15 mK). If the technology matures, silicon spin could eventually offer the most cost-effective path to a CRQC — but it is currently the furthest from demonstrating fault tolerance at the required scale.

The Rough Modality Comparison

Very rough estimates. This article is just for fun. Don’t make any decisions based on this.

What Commoditization Looks Like

The $2–5 million per-key estimate is for the first generation CRQC. Like every technology, the cost curve will bend downward — but the trajectory is important.

The history of classical computing offers a rough analogy. The first electronic computers cost millions (in 1950s dollars) and filled entire rooms. Within two decades, costs dropped by orders of magnitude and capabilities increased exponentially. Quantum computing may follow a similar (though not identical) trajectory, but the timeline is likely measured in decades, not years, for cryptanalytic applications.

Several factors will drive costs down over time. Manufacturing improvements in qubit fabrication, especially if silicon spin or similar CMOS-compatible approaches mature, could reduce per-qubit hardware costs dramatically. Algorithmic improvements — the trend Gidney himself represents, having reduced the qubit count from 20 million to under a million in six years — will continue. Better error correction codes, such as the qLDPC codes, could reduce qubit requirements by another order of magnitude. And larger facilities running multiple factoring jobs in parallel could spread fixed costs across more operations.

A plausible (if speculative) trajectory might look like this:

• First CRQC (late 2030s?): $2–5 million per key, single-digit keys per year
• Second generation (5 years later): $200,000–500,000 per key, dozens per year
• Third generation (10 years later): $10,000–50,000 per key, hundreds to thousands per year
• Commoditized (15–20 years after first CRQC): $100–1,000 per key, limited only by throughput

The point at which the per-key cost drops below $100,000 is when RSA-2048 becomes effectively broken as a practical security mechanism — not because any key is being targeted, but because an adversary with modest resources can break keys opportunistically.

Why This Is Not Reassuring

I want to be explicit about what these numbers do and do not mean. They do not mean that organizations have a decade of grace after a CRQC appears. For three reasons:

First, harvest-now-decrypt-later doesn’t care about operational costs. The SNDL/TNFL threat — an adversary recording encrypted traffic today for decryption once a CRQC exists — is already real. The cost of the future decryption is irrelevant to the attacker; what matters is that the data will still be valuable when the capability arrives. Every day of delay in PQC migration is another day of interceptable traffic.

Second, nation-states don’t budget like enterprises. A $5 million per-key cost is trivial for an intelligence agency targeting high-value diplomatic, military, or economic secrets. The NSA’s annual budget exceeds $10 billion. China’s cryptanalytic investment is unknown but almost certainly comparable in scale. For these actors, a CRQC is not a cost problem — it’s an engineering problem, and one they are actively working to solve.

Third, the cost curve will compress faster than migration timescales. PQC migration across a large enterprise takes 5–10 years. If you start migrating when the first CRQC appears, you’ll still be partially exposed when second-generation machines bring costs down by an order of magnitude. The time to start migrating is now.

The Bottom Line

Breaking a single RSA-2048 key on a first-generation CRQC will likely cost in the range of $2–5 million — dominated not by electricity (which accounts for perhaps 5% of the total) but by capital amortization on a machine that will cost hundreds of millions to build. Personnel, facility operations, helium supply, and classical computing infrastructure make up the rest.

This cost will be trivial for nation-state adversaries and prohibitive for everyone else — initially. Over time, the cost will fall, following a trajectory that makes RSA-2048 progressively more vulnerable. The question is not whether the cost will eventually become low enough to threaten your organization. The question is whether your PQC migration will be complete before it does.

The clock, as always, is ticking.

Related Content

The CRQC Quantum Capability Framework

Q-Day Revisited – RSA-2048 Broken by 2030: Detailed Analysis

Q-Day Predictions: Anticipating the Arrival of CRQC

The CRQC Scorecard: How Close Is Each Quantum Modality to Breaking Your Encryption?