The estimated path to a quantum attack on Bitcoin and Ethereum has narrowed, at least on paper. A research team that includes the Ethereum Foundation, Theta Labs, and StarkWare said it optimized a key step in Shor’s algorithm and cut the resource estimate from Google Quantum AI’s March benchmark of 3 billion to below 1.5 billion.
The result was disclosed in a paper obtained by CoinDesk. At the center of the work is a quantum circuit design that can carry out the elliptic curve point addition needed for Shor’s algorithm on a smaller machine. The target is secp256k1, the elliptic curve cryptography used by both Bitcoin and Ethereum.
A circuit built around 1,151 logical qubits
The paper describes a circuit that uses 1,151 logical qubits and roughly 1.3 million Toffoli gates. Those two numbers capture different parts of the problem: the qubit count reflects machine size, while the gate count reflects workload.
The researchers combined the two into a single score. Under that framework, the new circuit comes in at about 1.5 billion, below the 3 billion score published by Google Quantum AI in March. The paper also says the accounting methods are not fully identical, so the comparison has limits, but the difference is still substantial.
A second version, described as closer to the practical execution of Shor’s algorithm, scored about 1.96 billion. That figure also remained below Google’s number.
The ECDSA.Fail challenge drew more than 400 valid submissions
The work came out of ECDSA.Fail, an open challenge launched by Eigen Labs to crowdsource improvements to a core step in Shor’s algorithm. More than 100 participants produced over 400 valid submissions in about eight weeks, with each successful improvement serving as the starting point for the next round.
AI coding agents played a major part in implementation, repeated testing, and fine-grained optimization. Human researchers focused on choosing directions and making design-level changes. The paper did not attempt to assign an exact split between human and AI contributions, but it presents a model in which people set strategy and AI handles iteration.
The main results in the paper use July as a cutoff point. The optimization continued after that. One follow-up design lowered the score to about 1.26 billion, while another reduced the machine requirement to 813 logical qubits, though at the cost of a much larger computational load.
Why the threat is not immediate but still urgent
Theta Labs co-founder and CTO Jieyi Long, who is also the paper’s lead author, told CoinDesk: 「None of this is urgent because an attack is imminent. It is urgent because the remedy takes years and cannot be applied retroactively.」
That distinction is central to the current debate. No quantum computer today can mount a real attack on Bitcoin or Ethereum, so the danger is not immediate in an operational sense. But if practical attack capability does arrive, protocol upgrades would not be something networks could deploy overnight. The fixes would take years, and they would not retroactively shield addresses that have already exposed their public keys.
The study also sets clear boundaries on what it achieved. It did not optimize the full attack pipeline. It covers one major computational step only, and it does not include physical-layer error correction, the cost of the full Shor workflow, or the expense of running the attack on real quantum hardware. For now, there is still no machine on the market that can use this result to break Bitcoin or Ethereum.
Software gains are arriving as hardware funding expands
While software optimization is moving ahead, hardware development is also picking up speed. The U.S. Department of Commerce this week completed three CHIPS Act awards for Rigetti, D-Wave, and Quantinuum. Each award can reach as much as $100 million, and the government also took minority equity stakes.
Those funds are aimed at larger-scale fault-tolerant quantum computers, the type of hardware that would be needed to run Shor’s algorithm in practice. In the framing laid out by the paper and the report, the quantum threat is advancing along two tracks at once: larger hardware systems, and better software that lets the same hardware do more.
The researchers’ latest result points to faster progress on the second track than previously expected. In other words, the field may not need to wait for entirely new machines before reaching lower attack thresholds. Existing hardware roadmaps, paired with more efficient circuit designs, could get there earlier than older estimates suggested.
What this means for Bitcoin and Ethereum today
Bitcoin and Ethereum both rely on secp256k1 elliptic curve cryptography, which is the system targeted in this work. If Shor’s algorithm can eventually run at sufficient scale on a quantum computer, an attacker could derive private keys from public keys and forge transactions.
Bitcoin still has a natural buffer in some cases. Addresses that have never been used to send a transaction have not exposed their public keys on-chain. The quantum risk begins once an address has broadcast a transaction and its public key appears on-chain. That buffer does not apply evenly across all wallets, especially exchange hot wallets, long-active addresses, and early whale holdings.
On Ethereum, the planned Hegotá upgrade in 2027 already includes quantum resistance as a topic, though the specific approach is still under discussion. The report says any such upgrade would involve changes to the consensus layer and the account model, with both the timetable and the technical burden remaining high.
Related context cited in the report
The article also referenced earlier developments around post-quantum preparation, including Galaxy Digital’s Bitcoin Quantum Readiness Project with $5 million in funding for post-quantum cryptography, and QuFi’s post-quantum verification platform, which was reported to have completed a successful Bitcoin testnet trial.
Other related links listed in the source include BTQ’s Bitcoin Quantum testnet and separate market-price coverage, though those items are not part of the research findings themselves.