An open research competition organized by Eigen Labs reduced the estimated quantum computing resource cost for a key step in attacking Bitcoin and Ethereum encryption by 86.1% in approximately eight weeks. The arXiv preprint, released September 10, 2026, documents a leading quantum circuit design...
"It is urgent because the remedy takes years and cannot be applied retroactively." — Jieyi Long, CTO, Theta Labs
An open research competition organized by Eigen Labs reduced the estimated quantum computing resource cost for a key step in attacking Bitcoin and Ethereum encryption by 86.1% in approximately eight weeks. The arXiv preprint, released September 10, 2026, documents a leading quantum circuit design requiring 1,151 logical qubits and roughly 1.3 million Toffoli gates — more than 50% below a benchmark published by Google Quantum AI in March.
The finding does not mean an attack is imminent. No quantum computer currently exists with the fault-tolerant logical qubit capacity required. However, the rate of optimization — achieved by over 100 researchers and AI agents producing more than 400 verified submissions — compresses previously assumed timelines and reinforces urgency around post-quantum migration. Coinbase's Independent Quantum Advisory Council estimates roughly 7 million BTC, approximately 34% of total supply, sit in addresses with exposed public keys that would be vulnerable to a sufficiently powerful quantum computer.
Industry capital is now flowing toward defense. Nine firms including BlackRock, Coinbase, Strategy, Fidelity Digital Assets, and ARK Invest have pledged $15 million over three years to a Bitcoin Security Consortium. Galaxy Digital separately committed $5 million to a Quantum Readiness Initiative. Bitcoin developers have published two formal proposals — BIP-360 and BIP-361 — outlining a multi-year migration to quantum-resistant cryptography, though the timeline to full adoption may extend seven years or longer.
Eigen Labs launched the ECDSA.fail competition in late May 2026, structured as a public leaderboard where researchers and AI agents submitted quantum circuit designs targeting secp256k1 — the elliptic curve underlying Bitcoin and Ethereum digital signatures. Each submission was ranked by a spacetime-style score: peak logical qubit width multiplied by average executed Toffoli-gate count, measured in a machine-checkable evaluator.
The project operated under what its organizers call "open autoresearch" — a framework where humans and AI agents work against a shared, machine-checkable objective while publishing verified improvements to a common repository. Independent teams could start from the current leader or alternative designs, using their own models, tools, and compute budgets. Source changes and documented failures formed a shared research memory accessible to all participants.
The paper's authors include researchers affiliated with Theta Labs, Eigen Labs, MultiVM Labs, Trail of Bits, StarkWare, the Ethereum Foundation, Starknet Foundation, Brevis, Sei Labs, and academic institutions including the Free Systems Lab at Stanford, Adam Mickiewicz University (Poznań), and Warsaw University of Technology. Lead author Jieyi Long is CTO and co-founder of Theta Labs.
The arXiv preprint was published September 10, 2026, with data based on a July 26 cutoff.
The initial baseline score stood at 10.75 billion. By the July 26 cutoff, the leading design had compressed this to approximately 1.496 billion — an 86.1% reduction.
| Metric | Baseline | Leading Design (Jul 26) | Change | |--------|----------|------------------------|--------| | Q × T Score | 10.75 billion | ~1.496 billion | -86.1% | | Logical Qubits | — | 1,151 | — | | Toffoli Gates | — | ~1.30 million | — |
For comparison, Google Quantum AI published two reference designs in March 2026: a low-width option at ≤1,175 qubits with 2.7 million Toffoli gates, and a low-gate option at ≤1,425 qubits with 2.1 million Toffoli gates. Google released zero-knowledge proof verification of its circuits but did not publish actual circuit details. The ECDSA.fail community matched Google's disclosed result within eight hours of opening the repository in early June. Within 72 hours, it surpassed Google's Q × T score.
Alternative designs emerged at lower qubit widths: 825 qubits with 489 million Toffoli gates, later compressed to 813 qubits. A post-cutoff "ping-pong GCD" submission achieved 1,321 qubits with 952,707 Toffoli gates, yielding a Q × T score of approximately 1.259 billion.
Key optimization techniques included eliminating unnecessary stored values, recomputing data instead of retaining it in quantum memory, base-5 codec compression of transcript symbols, register-shared inversion, specialized Karatsuba squaring exploiting secp256k1's pseudo-Mersenne prime form, and constant propagation removing arithmetic on known zeroes.
The circuit targets the "point-addition" primitive — a core arithmetic operation repeated throughout Shor's algorithm for solving the elliptic-curve discrete logarithm problem. A complete Shor implementation would require approximately 28 kernel calls of this operation. The full attack circuit remains future work.
According to Coinbase's Independent Quantum Advisory Council, published in June 2026, approximately 7 million BTC sit in addresses where public keys are visible on-chain. As of March 1, 2026, over 34% of all bitcoin had revealed a public key, according to BIP-361 documentation. This includes an estimated 1.7 million BTC in legacy Pay-to-Public-Key (P2PK) addresses predating 2013, widely attributed to Bitcoin's pseudonymous creator Satoshi Nakamoto.
The exposure matters because of what researchers term "harvest now, decrypt later." An adversary can archive every exposed public key today and attempt to derive the corresponding private key once a cryptographically relevant quantum computer (CRQC) exists. Unlike traditional IT systems where keys can be rotated, a blockchain public key committed to an immutable ledger is exposed permanently.
Coinbase's advisory council includes cryptographers from Stanford, UT Austin, and the Ethereum Foundation. The council concluded that no current quantum computer can break the cryptography securing crypto assets today, but warned the risk is "strategically important because decentralized ecosystems can take years to coordinate major upgrades."
Bitcoin developers have produced two formal proposals addressing quantum migration.
BIP-360, published in February 2026 and merged into Bitcoin's official BIP repository, introduces Pay-to-Merkle-Root (P2MR), a SegWit version 2 address format with the prefix bc1z. P2MR commits to a Merkle root of a script tree rather than exposing a public key directly. It preserves existing Taproot functionality — multi-sig, time-locks, and complex conditions — while hiding the public key until script execution.
BTQ Technologies deployed a functional BIP-360 implementation on the Bitcoin Quantum testnet (v0.3.0) in March 2026, enabling all five Dilithium post-quantum opcodes. The testnet reached over 50 miners and 100,000 blocks mined.
BIP-361, merged April 15, 2026, outlines a three-phase migration triggered by block height:
BIP-361 author Jameson Lopp has stated he "dislikes the idea" of Phase C but "considers the alternative — mass quantum theft — far worse." BIP-360 co-author Hunter Beast estimated full Bitcoin migration "would take seven years from the day consensus forms."
A zero-knowledge recovery mechanism is under development. Lightning Labs CTO Olaoluwa Osuntokun released a working zk-STARK prototype allowing users to prove BIP-39 seed ownership without revealing the seed or public key. However, this mechanism cannot rescue the approximately 1.7 million BTC in pre-2013 addresses that predate BIP-32/BIP-39 standards.
Capital commitments to post-quantum Bitcoin security reached $20 million in July 2026.
Bitcoin Security Consortium ($15 million, 3 years): Announced July 23, 2026. Nine members: BlackRock, Coinbase, Strategy, Anchorage Digital, ARK Invest, Block, Blockstream, Fidelity Digital Assets, and Galaxy. Day-to-day coordination by Mike Schmidt, executive director of Brink, a nonprofit funding Bitcoin open-source developers. The consortium stated it will not direct Bitcoin development or take positions on proposed protocol changes.
Galaxy Quantum Readiness Initiative ($5 million): Announced July 21, 2026. Milestone-based grants for open-source developers. Priority areas: quantum-resistant BIP reviews, post-quantum signature scheme integration, custodian migration tooling, and formal security audits. Advisory council includes Barry Sanders (University of Calgary), Damien Bérubé (MIT), and Eran Tromer (Boston University).
Post-quantum signature schemes impose significant size penalties. Current Schnorr signatures occupy 64 bytes. The leading quantum-resistant alternatives are substantially larger:
| Algorithm | Signature Size | Multiple vs. Schnorr | |-----------|---------------|---------------------| | FALCON-512 | ~690 bytes | 10.8× | | CRYSTALS-Dilithium | ~2,420 bytes | 37.8× | | SPHINCS+ | ~7,856 bytes | 122.6× |
Bitcoin's block weight constraint — 4 MB theoretical maximum, approximately 2 MB effective ceiling — limits the number of post-quantum transactions per block. This creates a direct tension between quantum resistance and network throughput.
NIST's initial public draft of IR 8547 proposes deprecating classical public-key algorithms at the 112-bit security level after 2030 and disallowing them after 2035. Google has set an internal migration deadline of 2029.
Historical precedent suggests extended timelines: SegWit took 8.5 years from conception to adoption, and Taproot took 7.5 years.
The quantum threat does not require a full-scale Shor's algorithm implementation today to be relevant. The ECDSA.fail results demonstrate that optimization of the core arithmetic components is accelerating, driven partly by AI agent capabilities.
IBM targets 200 logical qubits by 2029. QuEra and Oratomic platforms may offer thousands of fault-tolerant logical qubits by decade's end. The gap between the 1,151 logical qubits needed for the point-addition kernel and hardware roadmaps is narrowing, though error correction overhead in physical implementations remains a substantial unknown.
The Ethereum Foundation has set an internal target of December 2029 for quantum-resistance readiness. Bitcoin's decentralized governance structure, requiring rough consensus among miners, node operators, and developers, makes coordinated migration structurally slower.
The ECDSA.fail results compress the assumed timeline between theoretical vulnerability and practical quantum threat. The 86% resource reduction, achieved in two months through a novel open autoresearch methodology combining human researchers and AI agents, demonstrates that cryptanalytic optimization in this domain is not proceeding at a linear rate. The economic stakes — $20 million in defensive capital, 7 million BTC in exposed addresses, and a network securing over $1.5 trillion in value — have prompted the first coordinated industry response to quantum risk.
The core tension remains structural. Bitcoin's migration to post-quantum cryptography will take years, possibly exceeding the seven-year estimate if historical upgrade timelines are a guide. NIST's deprecation timeline (2030) and disallowance deadline (2035) provide external forcing functions, but blockchain governance operates on its own schedule. The race is not between quantum computers and cryptographers. It is between the speed of hardware development and the speed of decentralized consensus.