More than 100 researchers with AI agents cut Bitcoin's quantum-attack benchmark sevenfold in two months

A collaborative research effort involving more than 100 participants and AI coding agents sharply lowered a widely cited measure of the quantum resources needed for a core arithmetic step in a theoretical attack on the elliptic-curve signatures used by Bitcoin and Ethereum.

At the July 26 cutoff used in the paper, the leading circuit used 1,151 logical qubits and about 1.30 million Toffoli gates, for a combined score of roughly 1.496 billion, an 86.1 percent drop from the contest's starting baseline of 10.75 billion.

Lead author Jieyi Long of Theta Labs and co-authors from the Ethereum Foundation, StarkWare, the Starknet Foundation, Trail of Bits, Brevis, Sei Labs and other groups stress that the result is not a working attack.

The work focuses on reversible point addition over the secp256k1 curve, an operation repeated many times inside Shor's algorithm when the goal is to recover a private key from a public key.

Warner wrote that the result is not a prediction about Q-Day and that no funds are at risk today.

The 86% reduction in the benchmark happened between late May and July 26, described by Decrypt as two months, and the paper landed later.

The work was released as an arXiv preprint on September 9, 2026.

Later submissions pushed the Toffoli count below one million in one design and the qubit count down to 813 in another, at the expense of other resources.

"Beyond the resulting circuits, ECDSA.Fail provides a case study of Open Autoresearch: a verifier-gated research process in which human participants and AI agents iteratively generate, implement, test, and share candidate improvements against a common measurable objective," the researchers wrote.

"Although its timing remains uncertain, migration away from vulnerable cryptography is already under way," the researchers wrote.

"NIST has standardized post-quantum replacements, and the initial public draft of NIST IR 8547 proposes deprecating classical public-key algorithms at the 112-bit security level after 2030 and disallowing them after 2035," the researchers wrote.

Relative to a Google Quantum AI point-addition benchmark published in March, the new score is more than 50 percent lower, though the authors emphasize that the two efforts use different interfaces and accounting conventions, so the comparison is not exact.

Google's earlier estimates had been accompanied by a zero-knowledge proof instead of public circuit details.

In July, Galaxy Digital committed up to $5 million to quantum defense work, while nine firms including BlackRock, Coinbase and Strategy pledged a combined $15 million over three years for broader Bitcoin security research, including quantum defenses.

The leading circuit's two components multiply to the published score: 1,151 logical qubits times 1.30 million Toffoli gates is about 1.496 billion.

The fall from a 10.75 billion baseline to 1.496 billion is a factor of about 7.2.

A second circuit, adapted to the single-call interface used in windowed versions of Shor's algorithm, scored about 1.96 billion after adjusting for measured success probability on random inputs.

The Ethereum Foundation set a hard December 2029 deadline to make transactions, validators and storage quantum-resistant.

Public-key reuse and older address formats leave large amounts of value exposed once a sufficiently large fault-tolerant machine exists.

Tyler Warner, who writes Decrypt's Morning Minute, wrote: "every timeline in this space was built assuming attack research moves at human speed, and this is the first hard evidence it might not". Decrypt states that the analysis and opinions in the newsletter are his own and do not necessarily reflect those of Decrypt.

The nine-firm pledge of $15 million over three years is $5 million a year across the group, or about $555,000 per firm per year if split evenly.

From the September 9, 2026 preprint to the Ethereum Foundation's December 2029 deadline is about 39 months.

The two post-cutoff records, if they occurred in one circuit, would score about 813 million, roughly 46% below the published 1.496 billion; the paper describes them as separate designs that each gave up other resources.