Researchers halve quantum resource benchmark for key operation in Bitcoin, Ethereum attack

A group of researchers has cut the estimated resources needed for a key operation involved in a potential quantum attack on Bitcoin and Ethereum. Their circuit requires 1,151 logical qubits and 1.30 million Toffoli gates, according to a technical paper authored by Theta Labs CTO Jieyi Long alongside researchers from several crypto projects and academic institutions.

The researchers measure the circuit's resource cost by combining the number of logical qubits it needs, which act as its working memory, with the number of Toffoli gates, the operations that account for much of its runtime. The two are multiplied into a single score, with a lower number indicating a more efficient circuit. Over roughly two months, submissions to a public challenge brought that score down 86%, from 10.75 billion to 1.496 billion. The final figure was also less than half Google's previously reported benchmark.

Google Quantum AI published its own estimates in March, setting a 2029 target for migration to post-quantum cryptography, but didn't release the circuit behind them. Alongside a zero-knowledge proof that a qualifying circuit existed, it did make a verifier public that could check other circuits and calculate their cost. Eigen Labs used that software to launch ECDSA.Fail on May 30, allowing researchers to submit improvements.

More than 100 people contributed to the challenge, including researchers and developers affiliated with the Ethereum Foundation, Eigen Labs, StarkWare, Starknet Foundation, Theta Labs, Brevis, Sei Labs, and Trail of Bits.

The authors stressed that this process is not an attack. They said the circuits don't account for physical error correction and aren't a full implementation of Shor's algorithm. The paper noted that Google used different interfaces and accounting conventions, presenting the comparison as numerical context rather than claiming the new circuit formally outperformed Google's.

Researchers continued submitting improvements after the paper's cutoff for challenge submissions, with one design reaching 952,707 Toffoli gates and another reaching 813 logical qubits, they said.

Crypto networks prepare for quantum threat

The research comes as both Bitcoin and Ethereum developers work on preparations for a potential future quantum threat. Coinbase's Independent Advisory Board on Quantum Computing and Blockchain estimated in June that roughly 7 million BTC sit in addresses exposed to a future quantum attack because their public keys are visible onchain, including coins held in legacy addresses and those exposed through address reuse, while stressing that no quantum computer can break blockchain cryptography today. Ethereum, meanwhile, is targeting full post-quantum security across its execution, consensus, and data layers by December 2029.

"None of this is urgent because an attack is imminent," Theta Labs' Long said. "It is urgent because the remedy takes years and cannot be applied retroactively."

StarkWare co-founder and CEO Eli Ben-Sasson, whose team was also among those involved, told The Block he had "butterflies" when researchers on his team brought him the findings. "Cutting the cost of breaking Bitcoin's cryptography in half, in two months means that everyone should sit up and take notice," Ben-Sasson said. "If the estimate of what it costs to break this cryptography is being cut in half, as it is in this paper, then every timeline anyone has quoted you for Q-Day needs to be cut too. You don't get to keep the old comfortable number just because the computer isn't built yet."