Three separate research milestones in the past ten days have compressed the estimated quantum-computing resources needed to break Bitcoin and Ethereum cryptography. On September 9, 2026, the Eigen Labs-sponsored ECDSA.Fail project published results showing an 86.1% reduction in the spacetime cost...
"No existing quantum computer can use this research to break either network today, but the findings underscore the need to begin adopting quantum-resistant protections because upgrades could take years." — Sreeram Kannan, Eigen Labs CEO
Three separate research milestones in the past ten days have compressed the estimated quantum-computing resources needed to break Bitcoin and Ethereum cryptography. On September 9, 2026, the Eigen Labs-sponsored ECDSA.Fail project published results showing an 86.1% reduction in the spacetime cost of a key subroutine in Shor's algorithm applied to secp256k1 — the elliptic curve underpinning transaction signatures on both networks. On September 3, IonQ released a 70-page resource estimate concluding that a 19,397-physical-qubit trapped-ion machine could compute a full 256-bit elliptic-curve discrete logarithm in 25.7 days. And on September 8, the Ethereum Foundation confirmed a December 2029 deadline for full post-quantum resistance across execution, consensus, and data layers.
No cryptographically relevant quantum computer (CRQC) exists in 2026. Google's Willow chip carries 105 qubits; the smallest published attack blueprint requires 19,397. The gap remains roughly 185× on raw qubit count alone, before accounting for error-rate requirements. But the trajectory is clear: the estimated cost of a theoretical attack has fallen from 9 million physical qubits in 2019 to fewer than 500,000 in March 2026, to 19,397 in IonQ's latest model. Meanwhile, approximately 6.7 million BTC — 34% of circulating supply — sit in addresses with public keys already exposed on-chain.
Eigen Labs launched the ECDSA.Fail project in late May 2026 as an open competition to optimize the reversible point-addition circuit over secp256k1 — a core subroutine that a quantum computer running Shor's algorithm would need to execute millions of times to derive a private key from its public key.
The format: an open leaderboard with a machine-checkable evaluator. Over roughly two months, more than 100 participants — including researchers affiliated with the Ethereum Foundation, StarkWare, and Theta Labs — submitted more than 400 circuit designs. Teams used a mix of manual optimization and AI coding agents. Some deployed orchestrating agents to divide work among specialized sub-agents; others used research agents to generate ideas and engineering agents to convert results into working code.
At the July 26 cutoff used in the resulting arXiv preprint (published September 9, 2026), the leading circuit used 1,151 logical qubits and approximately 1.30 million Toffoli gates, yielding a combined spacetime score of roughly 1.496 billion. That represents an 86.1% drop from the contest's starting baseline of 10.75 billion.
For context, Google Quantum AI's March 2026 paper established a benchmark score in this category. The ECDSA.Fail result came in at less than half Google's figure, though the researchers caution the two approaches use different accounting methods, making direct comparison imprecise.
The implication: the algorithmic side of the quantum threat is compressing faster than hardware is scaling. Each optimization reduces the number of qubits and gate operations a future quantum machine would need.
On September 3, 2026, IonQ released what it called the first fully compiled, end-to-end blueprint for breaking 256-bit elliptic-curve signatures. The 70-page paper, authored by 14 IonQ researchers led by Thomas Häner, Felix Tripier, and Jacob Young, maps the entire computation through IonQ's Walking Cat trapped-ion architecture down to the physical error-correction layer.
Key parameters from the paper:
| Metric | Value | |--------|-------| | Physical qubits required | 19,397 | | Logical qubits | 1,457 | | Logical Toffoli gates | 39 million | | Time per attempt | ~25.7 days | | Architecture | Walking Cat (trapped-ion) |
The paper was released on the same day IonQ launched its Superion 256 platform and held its 2026 investor day at the New York Stock Exchange. The timing signals that IonQ views cryptographic benchmarking as a commercial differentiator, not merely an academic exercise.
For comparison, Google's March 2026 estimate required fewer than 500,000 physical qubits for the same task. A subsequent Caltech-Oratomic paper proposed a neutral-atom design requiring as few as 10,000 qubits, though that figure relies on architectural assumptions not yet demonstrated in hardware. IonQ's 19,397-qubit estimate falls between these bounds and is notable for being tied to a specific, named hardware roadmap.
Multiple independent analyses converge on a consistent figure: between 6.0 million and 6.9 million BTC have exposed public keys on-chain.
| Source | Exposed BTC Estimate | |--------|---------------------| | Glassnode (May 2026) | 6.04 million | | Google Quantum AI (March 2026) | ~6.9 million | | Coinbase advisory board | ~6.7 million | | CoinDesk analysis | ~7.0 million |
These are addresses where the public key is visible — either legacy Pay-to-Public-Key (P2PK) addresses or addresses that have previously sent a transaction (which reveals the public key). Of the exposed total, approximately 2.3 million BTC are both vulnerable and dormant, having not moved in at least five years.
Most prominently, over 1.1 million BTC attributed to Satoshi Nakamoto sit in early P2PK addresses with permanently exposed public keys. These coins cannot be migrated to quantum-resistant addresses without Satoshi's private keys.
At current prices (~$76,500 per BTC as of September 11, 2026), the exposed supply represents approximately $460–$530 billion in value.
A companion proposal to BIP-360, designated BIP-361, outlines a plan to migrate — and potentially freeze — the 6.5 to 6.9 million vulnerable BTC. The freezing question is among the most contentious governance issues in Bitcoin's history, as it would require consensus to lock coins belonging to addresses that cannot or will not upgrade.
The Ethereum Foundation's Protocol cluster has set December 2029 as its target for full post-quantum resistance across three layers: execution (transaction signatures), consensus (validator attestations), and data (blob commitments and state proofs).
The migration strategy, proposed by Vitalik Buterin in February 2026, follows a "Ship of Theseus" approach: rather than a single protocol-wide switch, Ethereum will use account abstraction (specifically EIP-8141, under consideration for the Hegotá hard fork in late Q4 2026) to give users signature agility. This allows individual accounts to migrate to post-quantum signature schemes on their own timeline while the protocol progressively hardens.
At approximately 7.2 months per upgrade, the schedule lands at late 2029. A contingency path, labeled MV-PQ, extends to approximately 12 months per fork if the primary timeline slips.
The December 2029 target aligns with post-quantum migration deadlines independently set by Google, Cloudflare, and Microsoft for their own infrastructure.
Bitcoin's post-quantum effort centers on BIP-360, which was merged into the official Bitcoin BIP repository on February 11, 2026. The proposal introduces Pay-to-Merkle-Root (P2MR), a new output type that hides public keys behind a Merkle tree structure until the owner spends the funds.
P2MR operates with similar functionality to P2TR (Pay-to-Taproot) outputs but removes the quantum-vulnerable keypath spend. BTQ Technologies has implemented and tested BIP-360 on the Bitcoin Quantum testnet, giving developers a live environment to evaluate quantum-resistant transactions.
However, BIP-360 remains a draft proposal. A May 2025 analysis from Chaincode Labs noted that Bitcoin post-quantum initiatives remained at an early and exploratory stage. Bitcoin's governance model — requiring broad miner and node operator consensus for protocol changes — means that even a finalized BIP could take years to activate.
The practical challenge: users must actively migrate their funds to new P2MR addresses. Coins in legacy addresses that are not moved remain vulnerable. The question of whether to impose a migration deadline or freeze non-migrated funds has no consensus answer.
"Q-Day" — the point at which a quantum computer can break ECDSA-256 — remains a forecast, not a date. Available probability estimates:
| Timeframe | Probability of CRQC | |-----------|---------------------| | By 2035 | ~17% (1 in 6) | | By 2040 | ~30% | | By 2050 | ~60% |
These figures are drawn from expert surveys and probabilistic models, not hardware roadmaps. The gap between the most capable current hardware (Google Willow, 105 qubits) and the lowest published attack requirement (IonQ, 19,397 qubits) is approximately 185×. Error rates present a separate challenge: current machines operate far above the threshold needed for the fault-tolerant computation these attacks require.
In April 2026, researcher Giancarlo Lelli won Project Eleven's Q-Day Prize and 1 BTC for breaking a 15-bit elliptic curve key on a real quantum computer — up from the previous public record of 6 bits, set in September 2025. Bitcoin uses a 256-bit curve. The jump from 15 bits to 256 bits is not linear; it requires exponentially more resources.
Google's strategic pivot in March 2026 to add neutral-atom hardware alongside its superconducting program signals that the industry has not converged on a single scaling path, which adds uncertainty to timeline projections.
The quantum threat to blockchain cryptography is not imminent, but it is accelerating on the theoretical side. Three research milestones in ten days — ECDSA.Fail's 86% cost reduction, IonQ's hardware-specific blueprint, and the Ethereum Foundation's formalized 2029 deadline — mark a shift from abstract risk to concrete engineering timelines. The question is no longer whether quantum machines will eventually threaten elliptic-curve cryptography, but whether Bitcoin and Ethereum can complete their respective migrations before that capability arrives. Ethereum has a structured fork schedule. Bitcoin has a merged BIP with no activation date and a governance model that historically moves slowly on protocol changes. The 6.7 million BTC in exposed addresses — including Satoshi's coins — represent a category of risk that no software upgrade can retroactively eliminate without unprecedented consensus action.