A potential Bitcoin quantum attack just became a little less expensive on paper. Researchers have reduced the estimated resources needed for a key operation involved in breaking the cryptography protecting Bitcoin and Ethereum, cutting the benchmark dramatically over the course of a two-month challenge.
The final published circuit requires 1,151 logical qubits and 1.30 million Toffoli gates, according to a technical paper led by Theta Labs CTO Jieyi Long and researchers connected to several crypto projects and academic institutions.
Those numbers matter because quantum attacks are often discussed in terms of a future machine that does not yet exist. The researchers are instead trying to answer a more precise question: how much computational machinery would actually be required to perform the critical operation?
In their benchmark, logical qubits represent the circuit’s working memory, while Toffoli gates measure operations that account for a significant share of its runtime. Multiply the two and you get a single resource score, with lower numbers indicating a more efficient circuit.
The improvement was striking. Over roughly two months, researchers participating in a public challenge pushed that combined score down 86%, from 10.75 billion to 1.496 billion.
The new figure is also less than half the benchmark previously reported by Google’s Quantum AI team. But there is an important catch: the comparison comes with technical footnotes.
Bitcoin quantum attack estimates are moving faster than the machines
Google Quantum AI published its own estimates in March and proposed 2029 as a target for migrating to post-quantum cryptography. The company did not release the circuit behind those estimates, but it published a verifier that could assess other circuits and calculate their resource costs.
That verifier became the foundation for ECDSA.Fail, a challenge launched by Eigen Labs on May 30. Researchers could submit more efficient designs and compete to lower the estimated cost of the operation.
More than 100 people took part, including researchers and developers affiliated with the Ethereum Foundation, Eigen Labs, StarkWare, Starknet Foundation, Theta Labs, Brevis, Sei Labs and Trail of Bits.
The goal, however, was not to build a Bitcoin quantum attack.
The authors explicitly noted that their circuits do not include the physical error-correction requirements of a real quantum computer. They also do not represent a complete implementation of Shor’s algorithm, the quantum algorithm associated with breaking the mathematical structures used in public-key cryptography.
There are differences in interfaces and accounting methods between the new work and Google’s benchmark, too. The paper therefore treats the comparison as numerical context rather than a formal declaration that one circuit has definitively beaten another.
Even so, the direction of travel is difficult to ignore.
Researchers continued improving their designs after the challenge’s submission cutoff. One later circuit brought the Toffoli count down to 952,707, while another reduced the logical-qubit requirement to 813.
For blockchain networks, that is the unsettling part. The Bitcoin quantum attack debate is not being driven only by the arrival of a giant quantum computer. It is also being shaped by researchers steadily making the underlying computation more efficient.
That distinction matters because cryptographic migrations move at a very different speed from benchmark competitions.
Coinbase’s Independent Advisory Board on Quantum Computing and Blockchain estimated in June that roughly 7 million BTC are sitting in addresses whose public keys are exposed onchain, including coins held in legacy addresses and coins exposed through address reuse. The advisory board also stressed that no quantum computer can currently break blockchain cryptography.
Ethereum is taking its own precautions, with developers targeting full post-quantum security across the execution, consensus and data layers by December 2029.
The concern, then, is less about an attack happening tomorrow and more about whether the industry can upgrade its systems before the mathematics becomes practical.
“None of this is urgent because an attack is imminent,” Long said. “It is urgent because the remedy takes years and cannot be applied retroactively.”
StarkWare co-founder and CEO Eli Ben-Sasson, whose team participated in the research, described his reaction to the findings as having “butterflies.” He told The Block that “Cutting the cost of breaking Bitcoin’s cryptography in half, in two months means that everyone should sit up and take notice.”
His broader argument is simple: if the estimated cost of the cryptographic attack keeps falling, timelines built around older estimates may become outdated as well.
That does not mean a Bitcoin quantum attack is suddenly around the corner. It means one of the assumptions underpinning the industry’s long-term security planning is moving.
And unlike a price chart, cryptographic infrastructure cannot simply be rewound when the forecast changes.