On paper, the qubits to break RSA-2048 fell from a million to tens of thousands in a year, but the smaller machines trade the saving for weeks of runtime. Oratomic raised $300M to build one.
Oratomic raised a $300 million Series A this month, after launching publicly in March, on an unusually blunt plan: skip the intermediate, noisy-qubit products and go straight for fault-tolerant quantum computing on neutral atoms. By its investors' account, there are no interim commercial products along the way. The round was co-led by ARCH Venture Partners, Spark Capital and Khosla Ventures, with Bezos Expeditions, Index, General Catalyst and others alongside, and reported across the quantum trade press. The company aims to build utility-scale, fault-tolerant systems; CEO Dolev Bluvstein, lead author on the Harvard-QuEra work that first put fault-tolerant logic on neutral atoms, has called an end-of-decade machine plausible, although not guaranteed. Caltech's Manuel Endres and John Preskill advise.
The funding is real and the roster is serious. But the number driving the coverage, and the unease under it, is not the $300 million. It is 10,000: the floor a recent paper puts on the physical qubits needed to run Shor's algorithm against public-key encryption, down from the millions quoted a year ago. That figure is a theoretical resource estimate, not a demonstrated machine or a product roadmap, and the distance between those things is the story. It needs taking apart slowly, because almost every retelling welds together three claims that should stay separate, then reads the smallest and fastest-sounding numbers as if they described one machine.
Two definitions make the rest legible. A physical qubit is a single atom or circuit, individually noisy. A logical qubit is an error-corrected unit built from many physical ones, and fault-tolerance is the ability to keep a computation correct as those physical qubits fail. The whole game is how many physical qubits it takes to build one reliable logical qubit; the newer quantum low-density parity-check codes, qLDPC for short, do it with far fewer than the surface codes that came before. So when a paper says 10,000 qubits, it matters that it means 10,000 physical atomic qubits, not 10,000 logical ones.
Start with the distinction that governs everything else. Fault-tolerance is a general capability, not a single number. There is no fixed qubit count for "a fault-tolerant computer," because the count depends entirely on the problem. The first fault-tolerant machines are a near-term milestone measured in tens to low hundreds of logical qubits, the scale behind the DOE's 2028 target and the roadmaps built around it.
Breaking encryption is not that milestone. It is one specific, enormous application built on top of fault-tolerance, Shor's algorithm at cryptographic scale, and it needs orders of magnitude more machine than the first fault-tolerant demonstrations will have. Every collapsing number in this story is a crypto-breaking resource estimate, computed under stated assumptions. None is a fault-tolerance number. Fault-tolerance did not shrink to 10,000 qubits; the estimated cost of one very large application of it did, on paper.
Then there is what Oratomic sells, which is neither of the first two. Its site names no specific product application, gesturing at "scientific discoveries" and "new paradigms in artificial intelligence" and stopping there. Yet the company's own launch research foregrounds the crypto result: the Shor's-algorithm estimate is the paper that put it on the map. So the fusion is partly Oratomic's own doing. It markets no codebreaker and names no product, while the loudest thing it has published is a cryptographic benchmark. The problems a fault-tolerant machine is generally expected to take on well before anything crypto-scale look more like the quantum-centric chemistry simulations IBM, ORNL, and Cleveland Clinic reported for FLiBe molten salts than like a run at anyone's keys.
Here is what the headline numbers leave out: under their own assumptions, qLDPC codes do not make Shor's algorithm cheaper so much as move the cost from qubits to time.
Take RSA-2048, the same cipher across both estimates, so the comparison is honest. In May 2025, Craig Gidney put the job at under a million noisy qubits in under a week using surface codes, a twentyfold cut in qubit count from the roughly 20 million he and Ekerå estimated in 2019, though even that cut stretched the run, from about eight hours to under a week. The Oratomic-affiliated paper by Cain, Xu, King and colleagues then put the same RSA-2048 factoring at as few as 10,000 reconfigurable atomic qubits, rising to about 26,000 for a faster parallel variant. That is roughly fifty to a hundred times fewer qubits, about two orders of magnitude, same cipher, in a year. The qubit collapse, on paper, is real.
The runtime is where the bill comes due. Those far smaller machines are far slower. The Oratomic paper's own figures put elliptic-curve P-256 at about 26,000 qubits and a runtime of a few days, and RSA-2048 factoring at one to two orders of magnitude longer than that: weeks to months, not hours. The estimates assume neutral-atom error-correction cycles running on the order of milliseconds, much slower than a superconducting cycle, which is the modeled reason the clock stretches. In other words, qLDPC buys the qubit savings by spending time. A theoretical machine that needs months per RSA factorization is a different prospect from one that needs a week.
There is a second thing the coverage blurs. The fastest-sounding figure, the "few days," belongs to the easier problem. Elliptic-curve P-256 is a smaller lift than RSA-2048, so the days-long run is the P-256 number, and RSA at the same qubit scale takes the one-to-two-orders-longer penalty. Read the small qubit count and the short runtime together, as most retellings do, and you get a machine that does not exist: nothing breaks RSA in days at ten thousand qubits, even on paper. Iceberg Quantum's "Pinnacle" architecture makes the same qLDPC bet from another direction, putting RSA-2048 under 100,000 physical qubits at the cost of a longer run. Different point on the same curve. The qubits come down; the clock goes up.
Set the estimates against the hardware and the gap comes into focus.
The largest coherent neutral-atom array on record is Caltech's, which the university reported as a record in September 2025: 6,100 atoms held in about 12,000 optical tweezers, with roughly 13-second coherence and single-qubit accuracy around 99.98 percent. It is also not 6,100 logical qubits, not error-corrected, and not running anything like Shor's. It is a coherent atom array, and popular coverage that calls it a "6,100-qubit quantum computer" is measuring the wrong thing. Coherent atoms are the raw material; error-corrected logical qubits are the product, and the array holds none.
The demonstrated fault-tolerant figure is smaller and more meaningful. The Harvard-QuEra-MIT collaboration behind Oratomic's founders reported running algorithms on up to 96 logical qubits across up to 448 atoms, below threshold in Nature in 2025, the largest integrated fault-tolerant run reported on the neutral-atom platform. That is the honest number for the bench: the general capability, at small scale, not a crypto machine.
So the distance from the bench to a crypto-breaking run is not "a few years of engineering," at least not by the estimates' own terms. It is one to two orders of magnitude more physical qubits, held error-corrected and below threshold; a high-rate qLDPC code family that the resource papers concede has not been demonstrated at that size; a non-local connectivity regime at logical error rates the estimates assume but no one has shown at scale; and all of it stable for the weeks a run is projected to take. That is the gap to the application, and it sits well beyond the general fault-tolerance milestone that has not itself been cleared.
Give Oratomic the point that makes its platform choice defensible. qLDPC's qubit savings are not free: the codes demand high, non-local connectivity that superconducting chips, wired into fixed lithographed neighbors, struggle to provide. Neutral atoms held in movable optical tweezers can be physically rearranged mid-computation, which makes the reconfigurable, long-range connectivity these codes assume far more natural than it is on a static lattice. For once, the estimates that assume qLDPC and the hardware best suited to run it point at the same platform.
That is also why the codes are doing the work here, not the atoms. This is a software-stack story as much as a hardware one: error-correcting codes and compilation resetting the resource bill for a specific algorithm faster than any fab could. It is the concrete payoff of the shift SCN tracked as error correction moved beyond surface codes into a wider design space. The point is not that the machine is close. It is that the codes moved first, and the hardware has not caught up.
The sovereignty dimension is real, and it is where the crypto anxiety belongs. Post-quantum-migration timelines are calibrated in part against exactly these resource estimates. Google, in a March 2026 blog, and Cloudflare, in an April 2026 roadmap, target 2029 to move off classical key exchange in their own systems, distinct from the NIST schedule that deprecates classical public-key cryptography in 2030 and disallows it in 2035; Microsoft plans early adoption in 2029 and full transition by 2033. The NSA's CNSA 2.0 guidance sets 2033 for exclusive use in cloud and browser software and 2035 for full national-security-systems transition. When the estimated qubit cost of a Shor's run against RSA-2048 drops two orders of magnitude in a year, even as a theoretical estimate with a runtime penalty attached, the "harvest now, decrypt later" calculus tightens, because data captured today has to stay confidential past whenever the machine arrives. That is an industrial fact worth reporting plainly.
It is also worth separating from the loudest reaction to the raise, which came less from quantum-hardware people than from the post-quantum-crypto and Bitcoin crowd reading the funding as a doomsday clock. The estimate that moved covers P-256, not the secp256k1 curve Bitcoin uses; the machine that would run it does not exist; and the company raising the money markets no codebreaker. The panic is a clean illustration of the fusion this piece is trying to undo: a fault-tolerant-computing bet, a crypto resource estimate and an unnamed commercial ambition collapsed into one alarm.
Strip the number down and the wager is legible. Oratomic is betting that the general fault-tolerance milestone, first useful error-corrected logical qubits, is reachable this decade on neutral atoms, and that utility-scale machines for real work, work it has pointedly not named, follow from there. The crypto-breaking estimate is a headline that rode along, not the product. As analysis rather than the company's claim: the estimate looks like the tractable part. Writing down that RSA-2048 could fall to tens of thousands of qubits took a paper; holding that many error-corrected qubits in non-local connectivity, stable for the weeks the same paper projects, is a machine no one has built. The qubits came down in a theoretical estimate. The machine, and the sustained weeks-long operation it assumes, remain unbuilt.
The SCN Staff is a small AI editorial squad working under human direction. Each agent owns one job.
Scout does the research. It runs down primary sources and checks what's already been published, on SCN and everywhere else, before a story gets written. If a claim can't be traced back to a real document, Scout flags it.
Forge writes. It takes what Scout found and turns it into a draft, argument and sentences and all. Every SCN piece starts here, then gets sharpened.
Cipher handles search: the titles, descriptions, and keyphrase work that decides whether a good article ever gets found. Least glamorous job on the squad. Also one that matters more than it looks.
Pixel makes the visuals. Images, charts, the occasional diagram, all built to SCN's brand instead of pulled from a stock library. When something's easier to see than to read, it goes to Pixel.
Editorial judgment and the final call stay with the humans. So does the fact-checking.
