Researchers cut a key quantum-attack benchmark for Bitcoin and Ethereum in half — with caveats attached

Over roughly two months, a crowd of more than 100 researchers and developers — working alongside AI coding agents — drove down the estimated resource cost of one calculation that a future quantum computer would need to attack Bitcoin and Ethereum. The result, published in a technical paper led by Theta Labs CTO Jieyi Long, is a quantum circuit requiring 1,151 logical qubits and about 1.30 million Toffoli gates. Both The Block and CoinDesk, which were briefed on the paper, report the same two figures.

Here is what those numbers describe, and what they don't. Logical qubits are the circuit's working memory; Toffoli gates are the operations that dominate its runtime. The challenge scored a circuit by multiplying the two into a single figure — lower is more efficient. The optimization targeted "point addition," an elliptic-curve operation performed repeatedly inside Shor's algorithm, the quantum procedure that could in principle turn an exposed public key into the private key behind it. Both networks rely on the same curve, secp256k1, which is why a single result bears on both.

Where the numbers come from

Google Quantum AI set the reference point in March, publishing resource estimates alongside a 2029 target for migrating to post-quantum cryptography. Google did not release the circuit itself, but published a verifier — plus a zero-knowledge proof that a qualifying circuit existed — that could check other people's circuits and compute their cost. On May 30, Eigen Labs used that verifier to launch ECDSA.Fail, an open challenge inviting submissions. According to CoinDesk, more than 400 submissions were accepted, each successful improvement becoming the new baseline for the next.

On the challenge's own accounting, the score fell 86% — from 10.75 billion to 1.496 billion — over the run, The Block reports. CoinDesk frames the headline comparison differently: the new circuit scores about 1.5 billion against roughly 3 billion for Google's March figure, "more than 50% below." Both outlets, and the paper itself, stress the comparison is not like-for-like: Google used different interfaces and accounting conventions. The authors present their number as "numerical context," not a claim to have formally beaten Google.

The paper's headline figure reflects a July cutoff, and submissions kept coming. CoinDesk reports a later design reaching about 1.26 billion; The Block cites one circuit hitting 952,707 Toffoli gates and another getting down to 813 logical qubits — the latter, CoinDesk notes, at the cost of far more computation. A version adapted more closely to how Shor's algorithm would actually consume the calculation scored about 1.96 billion, still below Google's reported figure, per CoinDesk.

The division of labor between people and machines was blurry by design. CoinDesk reports AI agents handled much of the implementation, repeated testing, and smaller optimizations, while humans chose research directions and made the larger structural changes. The paper does not try to quantify how much of the gain came from which.

Key facts

• Circuit cost: 1,151 logical qubits and ~1.30 million Toffoli gates (The Block, CoinDesk, citing the paper led by Theta Labs' Jieyi Long).
• Score: ~1.5 billion, a combined qubit-times-gate figure; challenge accounting shows a drop from 10.75 billion to 1.496 billion, an 86% reduction (The Block).
• Vs. Google: More than 50% below Google Quantum AI's March benchmark, reported by CoinDesk as roughly 3 billion; not a strict like-for-like comparison, per the paper.
• The challenge: ECDSA.Fail, launched by Eigen Labs on May 30, 2026; 100+ participants; 400+ accepted submissions over ~8 weeks; July cutoff for the headline number (The Block, CoinDesk).
• Contributors: Researchers and developers affiliated with the Ethereum Foundation, Eigen Labs, StarkWare, Starknet Foundation, Theta Labs, Brevis, Sei Labs, and Trail of Bits (The Block).
• Post-cutoff: Later designs reached ~1.26 billion (CoinDesk), 952,707 Toffoli gates, and 813 logical qubits (The Block/CoinDesk).
• Exposure context: Coinbase's advisory board estimated in June that ~7 million BTC sit in addresses with visible public keys; Ethereum targets full post-quantum security by December 2029 (The Block).
• Hardware money: The U.S. Commerce Department this week finalized CHIPS Act awards of up to $100 million each for Rigetti, D-Wave and Quantinuum, taking minority stakes (CoinDesk).

The real-world read

Start with what the paper is not, because its authors are unusually clear on this — and that clarity is worth crediting. The circuit covers one major calculation, not a full attack. It leaves out physical error correction, the complete Shor implementation, and hardware-specific costs. No quantum computer in existence can use any of this to touch Bitcoin or Ethereum today. "None of this is urgent because an attack is imminent," Long said, in identical wording to both outlets. "It is urgent because the remedy takes years and cannot be applied retroactively."

Now the part the framing does some work on. This paper was "shared with CoinDesk" ahead of publication — a coordinated press push — and nearly every named contributor has a commercial stake in the quantum-migration narrative: Theta Labs, StarkWare, Eigen Labs, Sei Labs, Brevis, the Starknet Foundation. That doesn't make the result wrong; the circuit is verifiable against Google's public checker, which is the opposite of taking a marketing claim on faith. But it does mean the loudest interpretation comes from interested parties. StarkWare CEO Eli Ben-Sasson's line — that he had "butterflies," and that "every timeline anyone has quoted you for Q-Day needs to be cut too" — is the sort of sit-up-and-notice framing that a firm selling post-quantum-adjacent cryptography benefits from. Note also that Ben-Sasson describes this as "cutting the cost of breaking Bitcoin's cryptography in half," which overstates what a single-calculation, error-correction-free circuit demonstrates. The paper's own authors decline to claim they beat Google; one of the paper's own contributors, speaking to the press, is less restrained.

Two numbers also deserve a skeptic's eye. The 86% reduction (10.75B → 1.496B) is measured against the challenge's own starting baseline, not against Google — it's a story about how much slack existed in the first accepted submission, not solely about outracing Google. And the "more than 50% below Google" line rests on a comparison the paper itself flags as not apples-to-apples. Both can be true and still be softer than the headlines suggest. The genuinely notable point is quieter: the gains came from better algorithms, not better hardware, which means the bar an attacker's machine must clear can keep dropping while the machines themselves stand still.

Opinion, and whose

• Jieyi Long (Theta Labs, lead author): The urgency is about lead time on defenses, not an imminent attack — remedies take years and can't be applied after the fact.
• Eli Ben-Sasson (StarkWare CEO): Halving the estimated cost in two months means every quoted "Q-Day" timeline should be shortened; "you don't get to keep the old comfortable number just because the computer isn't built yet."
• Coinbase's Independent Advisory Board on Quantum Computing and Blockchain (June): ~7 million BTC sit in quantum-exposed addresses, while no quantum computer can break blockchain cryptography today.
• Google Quantum AI (March): Set 2029 as its target for migrating to post-quantum cryptography.

These are forecasts and framings from parties with skin in the game, not established facts about when — or whether — a working attack arrives.

Sources

• The Block (Tier 2, reputable secondary), Sept. 10, 2026 — reported the circuit figures, the challenge mechanics and 86% score reduction, the contributor list, post-cutoff improvements, the Coinbase and Ethereum context, and the Long and Ben-Sasson quotes. Citing the technical paper (primary) and interviews.
• CoinDesk (Tier 2, reputable secondary), Sept. 10, 2026 — corroborated the circuit figures; reported the ~1.5B-vs-~3B Google comparison, the Shor/secp256k1 mechanics, the human-plus-AI division of labor, the ~1.26B later result, and the CHIPS Act awards. Based on a pre-publication copy of the paper shared with CoinDesk by the researchers.
• Underlying primary source: the technical paper led by Theta Labs' Jieyi Long with co-authors across multiple crypto projects and academic institutions, verifiable against Google Quantum AI's publicly released cost verifier. The paper's authors are commercially interested parties in quantum migration; the press rollout was coordinated with the two outlets above. Treat the interpretive framing accordingly; the numerical claims are independently checkable.

This is news reporting, not financial or security advice; do nothing here as a recommendation to buy, sell, or reconfigure holdings.