Iceberg Quantum Estimates 72,000 Qubits Could Break RSA-2048 in 3.7 Days but Hasn’t Published the Circuits or the Decoder

Iceberg Quantum has cut its estimate for breaking RSA-2048 to about a tenth of February’s qubit-time, and its figure for superconducting chips is now 99,000 qubits for five days. Iceberg hasn’t published enough for outsiders to reproduce the new numbers, and no Q-Day estimates or regulatory PQC deadline changes because of them.

What Iceberg Quantum Published on October 22

On October 22, Iceberg Quantum, a Sydney-based quantum architecture company, released Pinnacle 1.2, an update to its Pinnacle fault-tolerant architecture. Iceberg said the update lowers the spacetime cost of factoring a 2048-bit RSA integer, a measure that combines physical qubits with runtime, by about an order of magnitude compared with its February preprint. The company published the release as a post on its website, without an accompanying paper.

Under the updated estimates, a machine of 72,000 physical qubits with a 0.1% physical error rate and a 1 µs code cycle could factor RSA-2048 in an expected 3.7 days. At a 0.01% error rate, Iceberg put the requirement at 48,000 physical qubits for 0.98 days. For superconducting chips, whose connectivity is fixed at fabrication, it estimated 99,000 physical qubits for 5.0 days. The February preprint had estimated about 98,000 physical qubits for a runtime of up to a month at 0.1%, and a May revision lowered that figure to about 94,000.

Iceberg said the reductions came from smaller error-correcting codes, which its new simulations support, and from improved factoring circuits, with no change to the underlying architecture.

Crevasse and Direct Simulation of Logical Error Rates

Iceberg said the release presents the first direct circuit-level simulations to show logical error rates low enough for RSA-2048 factoring. It said the simulations were made possible by Crevasse, a new decoder for the quantum low-density parity-check (QLDPC) codes Pinnacle uses. A decoder is the classical system that reads the error-correction measurements and works out which errors have occurred. Iceberg reported a mean decoding time of four microseconds per round of error correction and said it used Crevasse to process trillions of simulated error-correction instances. It has not published a description of Crevasse, its latency distribution, or the hardware on which the four microseconds were measured.

According to Iceberg, Pinnacle’s memory blocks take up most of the logical cycles in RSA-2048 factoring and need an error rate below 10⁻¹² per logical qubit-cycle, or one error per trillion. Iceberg counts error rates per logical cycle, which spans 18 rounds of error correction for a distance-16 code and 12 rounds for a distance-10 code.

From one trillion samples in each case, the company reported three logical errors on its distance-16 code, [[254,14,16]], at a 0.1% physical error rate. That gives a logical error rate of 2 × 10^-13 per logical qubit-cycle, with a reported 95% confidence interval of 8 × 10^-14 to 7 × 10^-13. Iceberg observed no logical errors on its distance-10 code, [[126,12,10]], at a 0.01% error rate, which gives an upper bound of 3 × 10^-13 at 95% confidence.

The February paper’s resource analysis used larger codes, [[254,14,16]] at 0.01% and [[510,16,24]] at 0.1%. Iceberg’s post lists the first of these as [[254,12,10]], a code that does not appear in the February paper. Iceberg said the switch to smaller codes reduces space overhead by about 40% and time overhead by about 30% relative to the February estimates.

The company also reported simulations of its processing blocks and of the state injection that feeds its magic-state distillation, using a forced-gap post-selection method published in May by Adam Wills, Theodore Yoder and Isaac Chuang.

Verified Compilation and the New Resource Estimates

Iceberg said it checked the modular exponentiation circuits from its February paper by testing them on a large sample of random classical inputs, a method it compared to the one Google Quantum AI used for elliptic curve point addition circuits in March. It then compiled the circuits into Pinnacle’s instruction set and streamed the full instruction sequence through models of the architecture to confirm that each instruction met its constraints. Iceberg said the operation counts from that compilation agreed closely with its February estimates. It said it used the same software to develop more efficient factoring circuits.

Iceberg calculates expected runtime by multiplying the time per factoring attempt by the expected number of attempts, adjusted for the probability that an attempt fails at the simulated logical error rates. Its new estimates are:

Frozen Pinnacle is the version Iceberg published in September for superconducting chips. Its estimate fell from about 120,000 qubits for a one-month run to 99,000 qubits for 5.0 days. Iceberg said that lifted surgery, a faster method for logical measurements that it presented in Pinnacle 1.1 in September, is not yet reflected in the estimates and will reduce costs further.

My Analysis

When I analyzed the February preprint in March, I listed three problems behind its headline number: real-time QLDPC decoding, a month-long run, and non-local connectivity. In Pinnacle 1.2, Iceberg reports progress on decoding and on runtime. On connectivity, the 72,000-qubit headline is for hardware whose connections change during the computation, and Iceberg’s figure for superconducting chips with fixed connections is 99,000. Iceberg has also disclosed less than before. It published the new numbers in a blog post, without the circuits or a description of the decoder.

Iceberg Now Samples the Target Codes Directly

Iceberg said the new results don’t rely on extrapolation or indirect statistical estimation. Its September Frozen Pinnacle paper had extrapolated logical error rates from smaller codes to the distance-24 code it used. For Pinnacle 1.2, Iceberg sampled the original design’s codes directly, a trillion times each. Three errors in a trillion samples is a small count, and Iceberg’s reported confidence interval spans almost a factor of ten. Its upper end, 7 × 10^-13, is still below the 10^-12 that Iceberg says the memory blocks need.

The post reports direct simulations of the original design’s memory and processing blocks. It doesn’t say whether Frozen Pinnacle’s own operations, which differ from the original design’s, were simulated at the new code distance. Iceberg has published direct simulation evidence for the 72,000-qubit figure and has not said what evidence supports the 99,000-qubit superconducting one.

Iceberg moved down one code size at each error rate, from 254 to 126 data qubits at 0.01% and from 510 to 254 at 0.1%. A code with fewer qubits generally means less decoding work per block and fewer connections to build.

Iceberg’s February paper simulated a standard circuit-level depolarizing noise model, in which each operation is followed by a random error with probability p. The post doesn’t say whether the new simulations kept that model or added mechanisms such as leakage, drift or correlated faults beyond it. Real hardware has all three. In September I covered a Sydney team’s experiments on a 120-qubit IBM chip, in which a distance-5 surface code beat the best distance-3 code in only one basis, and only after the team excluded defective components and discarded runs affected by leakage.

How Fast Crevasse Decodes, by Iceberg’s Account

In March I called real-time QLDPC decoding the largest gap in Pinnacle. My CRQC Quantum Capability Framework tracks it as D.2, decoder performance. The February simulations used most-likely-error decoding through a mixed-integer solver, an offline method chosen to bound error rates. A decoder fast enough to process a trillion samples per code is a different class of tool, and I credit Iceberg with building it.

At a 1 µs code cycle, every block produces a new round of syndrome data each microsecond, and the decoding system has to sustain that rate for all blocks at once. If each round takes four microseconds to process and nothing runs in parallel, the decoding for each block falls further behind every microsecond.

Latency and throughput are different measurements, though. In Google’s Willow experiment, the decoder averaged 63 µs of latency at a 1.1 µs cycle and still decoded in real time for up to a million cycles. Iceberg’s post gives no throughput figure, no parallelism and no benchmark hardware, so I can’t tell what classical resources a 72,000-qubit machine would need.

Latency matters at the steps where a logical operation depends on an earlier measurement. Iceberg’s February paper assumed a reaction time of ten code cycles and stated that the architecture is not limited by reaction time as long as each logical cycle lasts at least ten rounds. The new codes’ logical cycles last 18 and 12 rounds. If Pinnacle 1.2 keeps the February assumption, a decoding latency of a few microseconds would fit within the 10 µs reaction time. A long tail of slow decodes could still delay dependent operations, and the post gives no latency distribution.

Iceberg also doesn’t report an end-to-end test in which syndrome data moves from control electronics to decoders and corrections return, for many blocks at once. In September I reviewed the vendors now supplying that classical loop. The full-loop demonstrations among them used emulated measurements at code distances up to 9, and the largest decoder, IonQ’s for 408 logical qubits in 88 code blocks, ran in simulation.

The millisecond-cycle rows of Iceberg’s table use the same codes as the microsecond rows, so each block’s decoding problem is identical, with a thousand times longer between rounds. A 1 ms cycle is 250 times Crevasse’s mean decoding time. On those platforms the per-block margin looks comfortable, subject to the tail. At a 1 µs cycle, Iceberg has narrowed the decoding gap but hasn’t shown that it is closed.

Expected Runtime Falls From About a Month to Under Four Days

The February figure of up to a month and the new 3.7 days are both expected totals. Iceberg multiplies the time per factoring attempt by the expected number of attempts, the method its February paper set out. In Gidney’s 2025 estimate, each attempt runs about 12 hours, and the expected total, after an average of 9.2 attempts and an allowance for logical errors, is 4.96 days.

The length of a single attempt sets how long the machine must run without interruption, which my framework tracks as D.3, continuous operation. Iceberg hasn’t published that length for Pinnacle 1.2, or the success probability per attempt. The shorter expected total does cut the time the machine must stay available and calibrated to finish one factoring, from about a month to under four days.

In the table below, I multiply each estimate’s physical qubit count by its expected runtime to get qubit-days, a measure of the modeled footprint that leaves out the cost of fabrication, control electronics, cooling and decoding. All rows assume a 1 µs code cycle.

The February and September estimates are minimum qubit counts for a runtime of at most one month. I count that month as 30 days, so their qubit-days are upper bounds.

At a 0.1% error rate, the qubit count falls by about a quarter, from 98,000 to 72,000. Most of the reduction in qubit-days comes from the runtime, which falls from up to a month to 3.7 days. Counting the February run as a full month, the footprint is about 11 times smaller, which matches Iceberg’s order-of-magnitude claim. In March I calculated that the February headline was only about 1.5 times smaller in qubit-days than Gidney’s 2025 estimate. On Iceberg’s new numbers the difference is about 17 times.

The 72,000-Qubit Estimate Assumes Connections That Change During the Computation

The 72,000-qubit figure uses Pinnacle’s original instantiation, in which the set of qubits each qubit must interact with changes as measurement gadgets move during the computation. In the Frozen Pinnacle paper, Iceberg’s researchers wrote that this doesn’t fit superconducting chips, whose couplers are fixed at fabrication. For superconducting hardware, the relevant Pinnacle 1.2 figure is 99,000 qubits for 5.0 days.

The 99,000-qubit figure is the one to set against Gidney’s 2025 estimate. The September Frozen Pinnacle paper used the same 0.1% error rate, 1 µs code cycle and 10 µs reaction time as Gidney, and the October update doesn’t restate them. Both estimates finish in about five days. Gidney’s surface code needs 897,864 qubits on a grid where each qubit couples to its four nearest neighbors. Frozen Pinnacle needs about nine times fewer qubits, with each qubit connected to as many as eight others, fixed for the whole computation.

For a CISO asking what QLDPC codes save on superconducting hardware, this is the comparison I would use, together with its price in qubit connectivity. Eight fixed connections per qubit are harder to fabricate than the four of a nearest-neighbor grid. In October I compared Frozen Pinnacle with Google’s modular approach to the same wiring constraint.

For the original configuration, Iceberg assumes hardware that can realize Pinnacle’s changing interaction pattern at a 1 µs cycle. In its September release, Iceberg wrote that silicon spin qubits, which can shuttle electrons between quantum dots, offer the reconfigurability Pinnacle needs and could reach speeds competitive with superconducting qubits. Diraq, a Sydney spin-qubit company, worked with Iceberg and NVIDIA to map Pinnacle onto its hardware architecture.

In its white paper, Diraq plans a single chip with 150,000 physical qubits encoding up to 1,000 logical qubits by 2029, and puts the gate fidelities of its foundry-made devices at around 99.5%. The Nature paper behind that figure, on devices fabricated with imec on 300 mm wafers, reports two-qubit gate fidelities of 99.04% to 99.56% across four devices. That is an error of roughly 0.4% to 1% per two-qubit gate, against the 0.1% physical error rate in Iceberg’s 72,000-qubit row.

Neutral atoms can also be rearranged, and resource estimates for them commonly assume code cycles of about a millisecond. At 1 ms, Pinnacle 1.2 puts RSA-2048 at 714,000 qubits for 29 days at a 0.01% error rate and 2.1 million qubits for 32 days at 0.1%. In May the corresponding one-month figures were 2.7 and 9.5 million qubits.

In March, Madelyn Cain, John Preskill, Dolev Bluvstein and colleagues at Oratomic, Caltech and UC Berkeley estimated about 102,000 physical qubits and 97 days for RSA-2048 on a reconfigurable neutral-atom design, which I covered at the time. They assumed a 1 ms cycle and a 0.1% circuit-level depolarizing noise model, the same nominal values as Pinnacle 1.2’s 2.1-million-qubit row. In qubit-days, the Oratomic estimate comes to about 9.9 million and the Pinnacle 1.2 row to about 67 million. The two designs differ in their codes and in how they move atoms. Iceberg expects lifted surgery, which isn’t in these figures, to cut its overhead on atomic platforms by one to two orders of magnitude.

Iceberg Hasn’t Published Enough to Reproduce the Pinnacle 1.2 Figures

Iceberg’s earlier papers are public. The February, Frozen Pinnacle and lifted surgery papers are on arXiv, which is how Craig Gidney and Scott Aaronson could read the February estimates and publish their assessments within days. I found no paper behind Pinnacle 1.2 as of October 27. Iceberg hasn’t explained how Crevasse works or released the improved circuits. Its account of the circuit testing omits the inputs, the sample size and the code.

Iceberg compares that testing to Google’s, but the two disclosures differ in what outsiders can check. When Google published its estimate for secp256k1, the elliptic curve behind Bitcoin and Ethereum transaction signatures, it withheld its point-addition circuits. In their place it published a zero-knowledge proof that it holds a reversible circuit of the stated size that computes point addition correctly on most inputs, checked on about nine thousand pseudorandom test inputs. Iceberg has published neither its circuits nor an equivalent proof.

A proof of that kind would cover Iceberg’s arithmetic only. It would say nothing about Crevasse’s speed, the noise model or the hardware. Iceberg checked three separate things: the arithmetic, the compiled instructions against a model of the architecture, and the noisy error-correction components in simulation. None of them is a noisy simulation of a full factoring run, which isn’t feasible at this size. The 10^-12 requirement and the expected runtime therefore depend on Iceberg’s error budget. The post doesn’t break the error budget down by module.

My recommendation to Iceberg is a technical preprint covering the Crevasse algorithm, its sustained throughput and latency distribution on named hardware, the noise model, the per-attempt runtime and the error budget, together with the factoring circuits. If Iceberg judges the circuits too sensitive to release, Google’s zero-knowledge route is available for that part. In March I argued that open publication of resource estimates serves defenders, and I still hold that view. Until those details are public, I treat 72,000 qubits as a company figure.

Pinnacle 1.2 Changes No Regulatory PQC Deadline

Five days after Iceberg’s release, NIST published the final version of IR 8547, its plan for the transition to post-quantum standards. The final report deprecates all quantum-vulnerable public-key algorithms after 2030 and disallows them under NIST standards and guidelines after 2035. The 2024 draft had set the 2030 deprecation only for algorithms at the 112-bit security level, such as RSA-2048, and kept stronger keys such as P-256 acceptable, without deprecation, until 2035. In its announcement, NIST said the report also supports Executive Order 14412, which requires federal high-value assets and high-impact systems to complete the move to post-quantum key establishment by the end of 2030 and to post-quantum signatures by the end of 2031.

NIST’s 2030 and 2035 milestones were already in its 2024 draft, and the executive order was issued in June. Pinnacle 1.2 changes none of these dates. I have argued that these deadlines, together with the ones insurers and clients set, are what boards fund, whatever the latest prediction of when a cryptographically relevant quantum computer (CRQC) will exist. A lower estimate can reasonably move an organization’s internal completion target.

Lower estimates matter most for data that must stay secret for longer than it may take to build a CRQC. Harvest-now-decrypt-later collection is happening now. Migrating afterward can’t protect copies already taken. Pinnacle 1.2 covers RSA only. Google’s March estimate for secp256k1 was fewer than 500,000 superconducting qubits for an attack lasting minutes, and elliptic curve cryptography may be the earlier target.

Two Results to Watch in Iceberg’s Next Release

The first is an RSA-2048 estimate with lifted surgery included, especially for millisecond-cycle platforms, where Pinnacle 1.2 still needs 714,000 to 2.1 million qubits.

The second is Crevasse’s sustained throughput and latency distribution on named hardware, decoding a stream of syndrome data for many blocks at once. With those figures, readers can judge whether the 72,000-qubit, 3.7-day configuration can run as Iceberg’s table assumes.

From the author