Post-quantum security startup Project Eleven has awarded 1 BTC to independent researcher Giancarlo Lelli for demonstrating the recovery of a 15-bit elliptic curve cryptography key on publicly accessible IBM quantum hardware. The company described the result as the largest public demonstration of its kind so far and presented it as another step in showing that quantum attacks on elliptic curve systems are no longer confined to government labs or private research infrastructure.
The submission, announced on April 24, 2026, was positioned as a significant leap from an earlier 6-bit ECC demonstration completed on IBM hardware in September 2025. According to Project Eleven, the new milestone represents a 512-fold increase in search-space complexity. Lelli also published code and execution logs, making the experiment open for scrutiny and replication.
How the experiment was presented
Lelli implemented a two-register variant of Shor’s algorithm on IBM Quantum cloud machines, targeting elliptic curves structurally similar to those used in Bitcoin’s secp256k1 standard. The circuits were run across multiple IBM Heron r2 processors, including ibm_torino and ibm_fez, and relied on techniques designed for noisy intermediate-scale quantum devices. For Project Eleven, the value of the exercise was not that Bitcoin had become vulnerable overnight, but that public hardware could now be used to stage increasingly complex ECC-focused experiments.
The startup’s prize program was designed to encourage reproducible measurements of quantum attacks against very small ECC key sizes, ranging from 1 to 25 bits. At the time of the award, the 1 BTC bounty was worth roughly $78,000. That framing helped the company cast the event as a transparent benchmark rather than a marketing stunt, especially because the materials were openly shared.
Developers push back: where is the quantum advantage?
Despite the headline value of the demonstration, Bitcoin developers and cryptographers quickly challenged the interpretation. Their central criticism was that the quantum hardware did not appear to contribute any meaningful signal beyond what could be generated by randomness and then filtered by classical verification.
Former Bitcoin Core maintainer Jonas Schnelli reviewed Lelli’s materials and argued that the IBM quantum circuit, which reportedly involved around 98,000 gates at roughly 99.5% per-gate fidelity, produced outputs statistically indistinguishable from random coin flips. In his assessment, the quantum component added no detectable computational advantage over classical methods.
Schnelli said he was able to reproduce the key recovery in about 20 lines of Python using nothing but random bits, without touching quantum hardware. Researcher Yuval Adam reached a similar conclusion by replacing the IBM quantum backend with /dev/urandom, Linux’s classical random number generator, and obtaining the same recovery behavior. For critics, that was the most damaging observation: if random classical noise can stand in for the quantum machine, then the machine is not doing the hard part.
Why a 15-bit key changes the interpretation
The scale of the target matters. A 15-bit elliptic curve key has a search space of only 32,767 possible private keys. That is tiny by cryptographic standards. Critics argue that with such a small keyspace, a classical verifier can test candidate keys against a public key and eventually find the match with high probability even if the candidates are generated in an essentially random way.
That is why several Bitcoin-aligned commentators described the demonstration as classical guessing wrapped in quantum branding. Coinkite founder Rodolfo Novak accused Project Eleven of overstating the importance of the result, arguing that the private key was effectively solved classically before the quantum circuit even mattered. Bitcoin educator Jimmy Song likewise said the quantum hardware was functioning no better than a random number source in this setup. A widely shared thread from TFTC made a broader point: many public ECC demonstrations of Shor-style quantum algorithms still depend heavily on classical pre-computation that narrows the problem before the quantum stage begins.
Project Eleven’s response
Project Eleven founder and CEO Alex Pruden responded to the criticism by acknowledging an important limit: this was not Q-Day, the hypothetical point at which quantum computers become capable of breaking widely used public-key cryptography in practice. He also conceded that experiments in the current noisy, early-stage quantum era often require classical assistance.
Still, Pruden defended the work as useful incremental progress. His argument was that public, reproducible experiments on accessible hardware matter because they provide measurable reference points. Even if the result falls well short of practical cryptographic breakage, it can still inform the industry about changing resource requirements, error characteristics, and the long-term urgency of planning for post-quantum migration.
That position reflects a more cautious interpretation of the event: not evidence that Bitcoin is in immediate danger, but a reminder that post-quantum readiness remains a rational long-term security objective.
Commercial incentives add another layer of controversy
The reaction was sharpened by concerns over incentives. Project Eleven is backed by investors including Coinbase Ventures, Castle Island Ventures, Variant, and Balaji Srinivasan. It also sells post-quantum cryptography tools. Critics noted that the company created the prize, oversaw judging through three independent physicists, awarded the bounty, and then publicized warnings that around 6.9 million BTC held in wallets with exposed public keys could face long-term quantum risk.
That does not invalidate the experiment by itself, but it does explain why some observers viewed the messaging skeptically. In emerging technologies, especially where security fears and commercial products intersect, the distinction between a legitimate milestone and an exaggerated threat narrative can become blurry very quickly.
Why Bitcoin is not under immediate threat
The most important takeaway for Bitcoin users is that the gap between a 15-bit demonstration and a real attack on Bitcoin remains enormous. Bitcoin’s secp256k1 system operates at 256-bit security. Moving from 15 bits to 256 bits is not a linear step up; it represents an engineering and computational gulf of roughly 2^241.
Even optimistic academic estimates remain far beyond current hardware capabilities. The article notes that a Google paper published in April 2026 suggested that breaking 256-bit ECC might require fewer than 500,000 physical qubits. That estimate may sound smaller than some earlier projections, but it is still vastly beyond what today’s publicly accessible quantum systems can deliver in a fault-tolerant, attack-capable form.
In other words, the demonstration may be useful as a marker of experimental progress, but it does not alter the immediate security assumptions around Bitcoin. The burden of proof for a credible quantum threat remains much higher than showing that a tiny toy-scale ECC key can be recovered in a setup where classical filtering appears to do the decisive work.
A familiar pattern in quantum headlines
This episode captures a recurring tension in the coverage of quantum computing. Hardware milestones often generate dramatic headlines, especially when they touch iconic systems such as Bitcoin. But the journey from toy-scale demonstrations to production-scale cryptographic compromise is defined by engineering constraints, error correction challenges, algorithmic overhead, and hardware limitations that are easy to overlook in headline summaries.
For that reason, both sides of the debate can be partly right. Project Eleven may be correct that public quantum experiments are becoming more sophisticated and deserve attention. Bitcoin developers may also be correct that this particular result does not show meaningful quantum advantage and therefore should not be mistaken for a practical crack of Bitcoin-grade cryptography.
For now, the evidence points to a narrow conclusion: the 15-bit ECC result is an interesting experimental milestone, but not a sign that Bitcoin’s 256-bit elliptic curve security has been breached or is close to failing. The broader quantum threat remains real in theory, important in long-term planning, and distant in present-day practice.