What Happened
A 36-author paper titled 'ECDSA.Fail: Open Autoresearch for Optimizing Elliptic-Curve Point Addition in Shor's Algorithm' appeared on arXiv this week, with Jieyi Long, co-founder and chief technology officer of Theta Labs, as lead author and co-authors affiliated with Eigen Labs, the Ethereum Foundation, StarkWare, and Trail of Bits. It reports the results of ECDSA.Fail, an open challenge Eigen Labs launched on May 30 with a single objective: build the cheapest reversible quantum circuit that performs 1 point addition on secp256k1, the elliptic curve behind the Elliptic Curve Digital Signature Algorithm (ECDSA) that secures Bitcoin and Ethereum keys. An automated evaluator scored each submission, posted it to a public leaderboard, and made any improvement the new starting point for everyone. More than 100 participants took part, many steering commercial AI coding agents that proposed changes, ran tests, and logged failed approaches. In about 8 weeks they produced more than 400 accepted submissions.
The score is peak logical qubits multiplied by average Toffoli gates executed, a spacetime proxy the authors write as Q times T. The challenge began with a textbook circuit at 2,715 qubits and about 3.94 million Toffoli gates, a score of 10.7 billion. At the July 26 data cutoff the best circuit used 1,151 qubits and 1,299,453 Toffoli gates, a score of about 1.5 billion, an 86% reduction. Google Quantum AI's March whitepaper, 'Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities,' published 2 reference points for the same operation, 1,175 qubits with 2.7 million Toffolis and 1,425 qubits with 2.1 million, scores of roughly 3.2 billion and 3.0 billion. The cutoff result is half of Google's best, and coverage on Thursday, September 10, from CoinDesk, The Block, Decrypt, and The Quantum Insider reported the leaderboard has since reached about 1.26 billion. 'None of this is urgent because an attack is imminent,' Long told CoinDesk; the estimates, Long said, 'help us understand the remaining gap and plan migration before it closes.'
The Score Is a Product, and the Inner Loop Just Got Cheaper
Shor's algorithm recovers a private key from a public key by running a long chain of elliptic-curve point additions inside a quantum computer. The cost of 1 addition, multiplied by how many the algorithm needs, is most of the bill. Google's 2 full-attack circuits, at fewer than 1,200 logical qubits with 90 million Toffolis or fewer than 1,450 with 70 million, each amount to a few dozen such additions, so a cheaper addition propagates through them roughly in proportion. The logical-qubit count is the other half of the product, and it barely moved: 1,151 against Google's 1,175. What fell was gate count, from Google's 2.1 to 2.7 million per addition to about 1.3 million. In practical terms that is runtime, not machine size. A quantum computer built to Google's spec would finish the job in roughly half the time; a computer half the size still could not run it.
The authors are explicit about what the number is not. It is a leaderboard measurement of 1 component, not an estimate for a working attack. It leaves out quantum error correction, where logical qubits become physical qubits at a ratio that depends entirely on hardware, along with hardware-specific compilation. For those pieces, read the paper that landed 1 day earlier. On September 8, 14 IonQ researchers led by Thomas Häner, Felix Tripier, and Jacob Young published a 70-page end-to-end estimate for the same problem on a fault-tolerant trapped-ion architecture: 1,457 logical qubits, 39 million logical Toffolis, 19,397 physical qubits, and about 25.7 days per attempt at a 63% success probability, on a machine IonQ says is on its roadmap for 2028. A July paper from 4 Chinese institutions brought the logical-qubit floor to 835 by rebuilding modular inversion. Each paper lowers a different axis of the March estimate: qubits, gates, or the machine-level accounting that turns them into days. March was already a 20-fold cut from the prior consensus.
Agents Did Not Break a Key. They Changed How Fast the Estimates Move
The circuit was verified; no Bitcoin key was cracked, and none can be with current hardware. The largest elliptic-curve key broken on a real quantum computer is 15 bits, the result Project Eleven paid its 1 BTC bounty for in April; secp256k1 keys are 256 bits, and the gap between them is not engineering polish. Resource estimates used to move when a research lab published, roughly once a year. ECDSA.Fail moved the public figure by half in 8 weeks with volunteers and coding agents, and it is still moving. 'When many independent researchers and agents can explore different approaches, verify improvements against the same benchmark, and build on each other's work, progress compounds,' Soubhik Deb, head of research at Eigen Labs, said in remarks carried by Cryptopolitan. The same method can be pointed at every other step in the attack.
The skeptical case deserves its space. Estimates have fallen for 2 decades without a machine arriving, and Bitcoin developer Jameson Lopp argued after last year's Quantum Bitcoin Summit that 'the fear and uncertainty about quantum computing may very well be a greater threat than quantum computing itself.' That is a real risk: fear sells migration products, some of them untested, and a rushed soft fork is its own attack surface. But the falling estimates are also the input planning deadlines use. The June executive order moved the federal signature deadline to December 2031. Project Eleven's base case puts a cryptographically relevant machine as early as 2033. Bitcoin has BIP-360, a quantum-resistant output type merged into the proposals repository in February with a testnet implementation, and BIP-361, an April proposal from Lopp and 5 co-authors to sunset legacy signatures on a multi-year clock. It has not chosen a post-quantum signature scheme and has no activation date for either.
What This Means for You
For an individual holder the subject reduces to 1 variable: whether your public key is already on the chain. Shor's algorithm needs the public key as input. Bitcoin's hash-based address formats, pay-to-public-key-hash (P2PKH, addresses starting with 1) and its SegWit successor P2WPKH (bc1q), publish only a hash of the key until you spend, and a spend reveals the key, which matters only if coins remain on or return to that address. 3 categories are exposed today: any address you have spent from and reused, the roughly 1.7 million BTC in early pay-to-public-key outputs, and every Taproot output (bc1p), which places a public key directly in the script. Coinbase's quantum advisory board put the exposed total near 6.9 million BTC in April, about a third of supply. Those coins are the first target of any long-range attack, and a 26-day runtime per key, IonQ's figure, means an attacker would work a list, highest balance first.
The actions follow from the mechanism. Stop reusing addresses; a hardware wallet or any modern software wallet generates a fresh one per receive, and reuse is the single habit that turns a hidden key into a visible one. Move long-term savings that sit on a reused or Taproot address to a fresh P2WPKH or P2PKH address you never spend from until you mean to empty it. A multi-sig script under P2WSH is hidden the same way, since the script and its keys appear only at spend. Do not move coins into any 'quantum-safe' product that asks you to trust a new key scheme or a custodian; the tools that exist are early, and the Coldcard sweep showed this summer what a bad key-generation path costs. None of this waits on a soft fork, and none of it costs more than a transaction fee.
Then name the limit. Self-custodyself-custodyHolding your own bitcoin keys rather than trusting an exchange or custodian. The maxim: not your keys, not your coins. protects your private keys from every party except mathematics. If the curve breaks, your keys are still yours, and so is everyone else's until the moment they spend, because the signature that authorizes a spend exposes the key during the 10 minutes or more it waits in the mempoolmempoolThe waiting room of unconfirmed transactions. When it fills, the fee to get into the next block rises.See it on the site →. Address hygiene buys time; it does not buy safety, and the safety has to come from a network-level change no individual can make alone. Bitcoin's migration will be decided by the same open process that has debated it since 2021, on a timeline the attacker's side just showed it can shorten. The rational posture is not alarm. It is to hold coins in the address types that give the network the most time, and to treat the migration debate as a governance decision you have a stake in, because your keys are the ones it will have to move.
What to Watch
The ECDSA.Fail leaderboard is the first checkpoint: whether the score keeps falling past 1.26 billion, and whether the same open method gets pointed at the modular-inversion and lookup steps that drive the qubit count. IonQ's 2028 hardware milestone is the second; a 20,000-physical-qubit trapped-ion machine would move this from estimate to demonstration. On the Bitcoin side, whether Bitcoin Core developers converge on a signature scheme for BIP-360's P2MR output, and whether BIP-361's sunset clock gains sponsors or stays a talking point, will determine whether the network has a migration plan before the estimates finish falling. And the next resource paper, whoever writes it, should be read for its qubit-to-gate ratio, not its headline.