Researchers Just Made a Quantum Attack on Bitcoin Cheaper

The clock on quantum computing just moved — not because the machines got faster, but because researchers found a cheaper way to attack. A paper shared with CoinDesk cuts the estimated work for a key step in a future quantum attack on bitcoin by more than half against a benchmark Google published in March.

The work comes from researchers at the Ethereum Foundation, Theta Labs, StarkWare and several other groups. It describes a quantum circuit using 1,151 logical qubits — a machine’s smallest working units — and about 1.3 million Toffoli gates, a measure of how much work the machine must do. Fewer gates means less work; fewer qubits means a smaller machine.

What was optimized

The new circuit scores about 1.5 billion on the paper’s yardstick, more than 50% below the roughly 3 billion Google Quantum AI reported in March. A version tuned to how Shor’s algorithm would actually run scored about 1.96 billion — still below Google. The authors caution the comparison is not perfectly like-for-like.

Shor’s algorithm is the quantum method that could turn an exposed public key into the private key behind it, letting an attacker sign transactions as the wallet’s owner. Bitcoin and Ethereum both rely on the same elliptic-curve cryptography, secp256k1. The researchers sped up “point addition,” a calculation Shor’s algorithm repeats over and over.

How they did it is its own story: more than 100 people, working alongside AI coding agents, spent roughly eight weeks on an open challenge called ECDSA.Fail, run by Eigen Labs. They logged more than 400 accepted improvements, each becoming the next person’s starting point.

The attack does not need better hardware to get closer. It can simply need less of it.

How worried to be

Not very, yet. The circuit covers one major calculation, not a whole attack; it leaves out error correction, the full Shor computation and the hardware-specific costs of running on a real machine. No computer that exists can use the result to break bitcoin today.

But the number keeps falling. The headline figure reflects a July cutoff; a later design pushed the score to about 1.26 billion, and another cut the machine-size requirement to 813 logical qubits at the cost of far more computation. The estimates that matter are being revised in one direction.

“None of this is urgent because an attack is imminent,” lead author and Theta Labs CTO Jieyi Long told CoinDesk. “It is urgent because the remedy takes years and cannot be applied retroactively.” The fix — moving bitcoin to quantum-resistant signatures — is a protocol change measured in years of debate and coordination, and coins sitting in reused or exposed addresses cannot be retrofitted after the fact.

The context is a hardware race, not just math. The U.S. Commerce Department this week finalized CHIPS Act awards of up to $100 million each for quantum firms Rigetti, D-Wave and Quantinuum, taking minority stakes — public money aimed at the fault-tolerant machines such an attack would eventually run on.

Why it matters: the day a quantum computer can break bitcoin is still distant, but the defense has to be built long before it arrives — and the estimates keep getting shorter.

Circuit figures, methodology and the Jieyi Long quote per the research paper shared with CoinDesk by the Ethereum Foundation, Theta Labs, StarkWare and others (Sept 10, 2026). No existing machine can execute the attack. Informational only — not financial advice.