A public research challenge has cut the estimated logical resources for a cryptographic operation relevant to future attacks on Bitcoin and Ethereum, producing a circuit that uses 1,151 logical qubits and 1.30 million Toffoli gates. The result, published in a technical paper co-authored by Theta Labs Chief Technology Officer Jieyi Long, lowers the modeled cost of one step used in Shor’s algorithm, the quantum method that could eventually break the elliptic-curve signatures securing major blockchains.
The circuit does not create an immediate threat to either network. Its estimates exclude the vast physical hardware, error-correction systems and full algorithmic components that a practical cryptographically relevant quantum computer would require. Yet the work provides a sharper measure of how quickly the algorithmic side of the problem can improve, placing more pressure on protocol teams preparing migration paths to post-quantum cryptography.
The ECDSA.Fail challenge reduced its efficiency score by 86% over roughly two months, from 10.75 billion to 1.496 billion. The score multiplied the number of logical qubits by the number of Toffoli gates, a quantum-computing operation that contributes substantially to circuit runtime. Lower scores represent designs that would demand fewer protected quantum-computing resources.
Community challenge targets a narrow cryptographic operation
Eigen Labs launched ECDSA.Fail on May 30 after Google Quantum AI released a verifier that could assess candidate circuits against a common cost measure. The challenge focused on improving a circuit for a mathematical operation involved in solving the elliptic-curve discrete logarithm problem, the security assumption behind ECDSA signatures used by Bitcoin and Ethereum.
A sufficiently capable fault-tolerant quantum computer could use Shor’s algorithm to derive a private key from a public key. With the private key, an attacker could create valid signatures and spend funds from an exposed address. Existing quantum machines are nowhere near that capability, according to the researchers and blockchain security groups cited in the paper.
Google Quantum AI had published a related resource estimate in March, alongside a target of 2029 for migrating its own systems to post-quantum cryptography. Google did not publish its circuit design. Instead, it released software for verifying submitted circuits and calculating their resource score, plus a zero-knowledge proof showing that a circuit meeting its stated threshold existed.
The final ECDSA.Fail submission recorded a score below half the level associated with Google’s published estimate. The paper cautioned that this was numerical context rather than a direct comparison: the efforts used different interfaces and accounting conventions, so the figures should not be treated as a formal head-to-head benchmark.
More than 100 contributors submitted or developed improvements during the challenge, according to the authors. Participants included researchers and developers affiliated with the Ethereum Foundation, Eigen Labs, StarkWare, Starknet Foundation, Theta Labs, Brevis, Sei Labs and Trail of Bits, alongside academic contributors.
Logical qubits remain far from deployable hardware
The reported 1,151 qubits are logical qubits, not physical qubits. A logical qubit is an error-corrected unit designed to preserve quantum information despite the noise that affects quantum hardware. Building one logical qubit typically requires many physical qubits, with the exact overhead depending on hardware quality and the error-correction method.
The 1.30 million Toffoli-gate estimate also represents only one component of a larger cryptanalytic process. The authors said their circuits do not include physical error correction or a complete implementation of Shor’s algorithm. Runtime would depend on the speed and reliability of a future fault-tolerant machine, as well as the architecture used to run it.
That distinction prevents the result from becoming a countdown to a Bitcoin or Ethereum breach. Algorithmic refinements can reduce a resource estimate sharply without solving the separate engineering challenge of operating thousands or millions of sufficiently reliable physical qubits. The challenge nonetheless shows that published estimates can move quickly when researchers are given a verifiable target and an incentive to optimize it.
The paper also records progress beyond its formal cutoff. Subsequent designs reportedly reduced the Toffoli count to 952,707, while another used 813 logical qubits. Those submissions were not included in the paper’s final analyzed entry, meaning the 1,151-qubit and 1.30-million-gate result is a defined benchmark rather than necessarily the best design currently known.
Exposed public keys remain the migration concern
Quantum risk is uneven across Bitcoin’s existing supply because a quantum attacker would first need a visible public key. Bitcoin addresses that have never spent funds can generally keep the underlying public key hidden behind a hash, although spending from an address reveals the key. Older pay-to-public-key outputs reveal public keys directly, and address reuse can leave previously revealed keys associated with funds that remain spendable.
In June, Coinbase’s Independent Advisory Board on Quantum Computing and Blockchain estimated that about 7 million BTC are held in addresses potentially exposed to a future quantum attack because their public keys are visible onchain. The board included legacy formats and addresses affected by reuse in that estimate, while stressing that no available quantum computer can break blockchain cryptography today.
The figure is an exposure estimate, rather than a measure of funds presently at risk. A quantum attacker would need machinery far beyond current capabilities, then would need to act against exposed keys before legitimate holders moved their funds or network-level protections took effect. Dormant coins and reused addresses nonetheless create a difficult migration problem because their owners may be unavailable, unaware of the risk, or unable to move funds.
Protocol teams face a long upgrade path
Post-quantum migration requires more than offering a new address format. Bitcoin would need community agreement on new signature schemes, wallet support, transaction-policy changes and a strategy for old outputs that cannot be moved voluntarily. Any proposal to restrict or retire vulnerable legacy formats would likely involve difficult debates over property rights, network compatibility and treatment of lost coins.
Ethereum’s challenge is broader because signatures and cryptography appear across its execution, consensus and data layers. A separate update referenced in the ECDSA.Fail paper sets a December 2029 target for full post-quantum security across those layers. Reaching that goal would require changes extending beyond ordinary account transactions, including validator operations and the systems used to verify and store network data.
For individual holders, avoiding address reuse and moving funds from known exposed legacy scripts to fresh addresses can reduce exposure under today’s cryptographic model. It does not eliminate every future quantum risk, since the destination’s public key becomes visible when its funds are eventually spent, and ultimate protection depends on network-wide adoption of quantum-resistant signatures.
The ECDSA.Fail results therefore add a more demanding planning input rather than evidence of a present-day exploit. By showing that the circuit-level cost can fall rapidly through open optimization, the challenge gives Bitcoin, Ethereum and wallet developers another reason to treat post-quantum migration as an engineering program that must be designed well before quantum hardware reaches the required scale.
To deepen your Bitcoin and Ethereum security knowledge, explore this Ethereum-focused guide alongside emerging post-quantum risks.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
