On September 3, 2026, Eric Lu of Cognition factored the 862-bit RSA-260 challenge number using GPU-accelerated general number field sieve methods, at a cost of roughly $400,000. The result is a meaningful milestone in computational number theory, and it has prompted a fresh reassessment of how much runway RSA's older key sizes still have.

What Happened and Why It Matters

RSA security rests on a deceptively simple asymmetry: multiplying two large prime numbers together is easy, but reverse-engineering the original primes from their product is extremely hard. The bigger the key, the harder the reversal. Named after its inventors Rivest, Shamir, and Adleman, RSA has secured web traffic, email, and digital signatures for decades, which is why shifts in its cost calculus attract broad attention across the security industry.

Projections now place the computational expense of factoring an RSA-1024 key at around $30 million. That is not a trivial sum, but it sits within reach of nation-states and well-resourced intelligence agencies. RSA-1024 was already deprecated precisely because this kind of threat was anticipated, and the new research confirms the deprecation was not precautionary theater.

RSA-2048, the standard in active, widespread use today, remains secure against both current classical attacks and known quantum approaches. The computational cost of factoring climbs steeply with key size, meaning RSA-2048 sits in a different threat category entirely for now. Factoring RSA-260 therefore does not amount to a break of RSA-2048; its immediate significance is as a measured data point about the resources required for smaller keys.

For organizations managing cryptographic systems, the practical issue is identifying where older RSA keys remain embedded in certificates, appliances, applications, or legacy connections. That inventory also helps separate systems that need near-term RSA replacement from those that require longer-term planning for post-quantum migration.

The Quantum Angle Has Not Gone Away

Shor's algorithm, which runs on quantum hardware and can factor large numbers exponentially faster than any classical approach, remains the longer-term threat to RSA-2048. The migration toward post-quantum cryptographic standards, which the National Institute of Standards and Technology has been formalizing, starts to look less like long-term planning and more like medium-term necessity.

Allurity, a Stockholm-based cybersecurity group with roughly 800 specialists across 18 countries and a portfolio built through acquisitions including SRLabs, operates in the broader landscape where these cryptographic shifts play out. The firm covers identity management, threat intelligence, and related domains. No specific RSA research is directly attributed to Allurity itself.

Implications for Crypto and Digital Security

For crypto infrastructure specifically, the immediate practical impact is close to zero. Bitcoin's elliptic curve cryptography operates on different mathematical foundations than RSA factoring, and the attack vectors are distinct. Most blockchain networks do not rely on RSA in their core signing mechanisms.

Where RSA does appear in crypto-adjacent infrastructure is in transport layer security, certificate authorities, and legacy enterprise systems that interact with exchanges, custodians, and financial rails.

The $400,000 price tag on factoring RSA-260 is a useful reference point for security teams conducting threat modeling. Attacks that cost hundreds of thousands of dollars are within reach of sophisticated criminal organizations, not just government actors. Security teams relying on anything below 2048-bit RSA should treat the current findings as a concrete prompt to migrate.