Researchers And AI Agents Cut Estimated Quantum Cost of Attacking Bitcoin Encryption by 86%

Insider BriefAn open research project combining human scientists with AI agents has sharply reduced the estimated quantum computing resources needed for a key step in attacking the encryption used by Bitcoin, Ethereum and other blockchain networks. The study, posted on arXiv, describes how more than 100 contributors improved a quantum circuit for elliptic-curve point addition, one of the main arithmetic operations required to run Shor’s algorithm against elliptic-curve cryptography. The researchers reduced their principal measure of the circuit’s resource cost by 86.1% from the project’s starting point.The team added that this result — with qualifications — is about 50% below a point-addition benchmark reported by a Google team recently.The work does not demonstrate an attack on Bitcoin or show that existing quantum computers can recover cryptocurrency private keys. It instead narrows estimates of what a future fault-tolerant quantum computer would need to perform one important part of such an attack.The results could give governments, blockchain developers and cryptocurrency holders more information for planning a transition to cryptographic systems designed to resist quantum computers. That process could take years and may require moving funds from vulnerable addresses before sufficiently powerful hardware becomes available.“As quantum hardware advances, we need credible, reproducible estimates of the resources required to break deployed cryptography. Those estimates help us understand the remaining gap and plan migration before it closes,” said Jieyi Long, lead author of the paper and co-founder and CTO of Theta Labs, said in a statement. “Across over a hundred contributors the collective effort halved the cost estimate of the central arithmetic step. The consequence falls hardest on blockchains, because a public key written to a ledger is exposed permanently and roughly a third of all bitcoin already sits in addresses where the key is visible. None of this is urgent because an attack is imminent. It is urgent because the remedy takes years and cannot be applied retroactively.”Bitcoin and Ethereum use a form of elliptic-curve cryptography to verify that transactions were authorized by the holders of the correct private keys. The method depends on a mathematical problem that is extremely difficult for conventional computers to reverse.A sufficiently capable quantum computer could use Shor’s algorithm to solve that problem and derive a private key from its corresponding public key. An attacker could then create a valid digital signature and potentially transfer the associated assets.The researchers focused on secp256k1, the particular elliptic curve used by Bitcoin, Ethereum and several related systems. Rather than model the entire attack, they optimized a reversible circuit that performs point addition, an operation repeated many times inside Shor’s algorithm.The project, called ECDSA.Fail, began with a circuit requiring 2,715 logical qubits and an average of 3,960,753 Toffoli gates. Logical qubits are error-corrected units of quantum information assembled from larger numbers of physical qubits. One way to think of a logical qubit is as a group of students checking each others work to make sure they produce an accurate answer. Toffoli gates are costly quantum operations commonly used to estimate the amount of work a fault-tolerant machine would have to perform.The competition scored circuits by multiplying their peak number of logical qubits by their average executed Toffoli count. The resulting figure serves as an approximate measure of the space and computational work required by a circuit.By the study’s July 26 data cutoff, the best entry used 1,151 logical qubits and an average of 1,299,453 Toffoli gates. Those figures reduced the number of logical qubits by 57.6%, the Toffoli count by 67.2% and the combined score by 86.1%. The final score was about one-seventh of the project’s baseline.The circuit’s numerical score was also more than 50% below a point-addition benchmark previously reported by Google researchers. However, the researchers cautioned that the circuits use different interfaces, assumptions and accounting methods, preventing a direct claim that the ECDSA.Fail result is definitively superior.After the formal cutoff, contributors lowered the combined score further, to about 1.259 billion, using 1,321 logical qubits and fewer than 1 million average executed Toffoli gates. A separate effort focused on conserving quantum memory produced a circuit using 813 logical qubits, though it required far more operations.“Google kept its circuits private. ECDSA.fail’s open community and AI agents more than halved Google’s benchmark score in about two months. Starknet’s proofs are hash-based and post-quantum by design. The industry must upgrade before quantum hardware catches up,” Oli Freuler, Head of Product Growth at StarkWare, said in a statement.ECDSA.Fail also served as an experiment in what the researchers call open autoresearch. In this model, scientists and AI agents work against a shared, machine-checkable objective while publishing verified improvements to a common repository and leaderboard.Eigen Labs launched the challenge in late May 2026. Over an estimated eight weeks, participants produced more than 400 promoted submissions. Contributors could directly modify the circuits or use AI coding agents to propose changes, conduct tests and record failed approaches.Some teams used research agents to generate ideas and an engineering agent to turn promising results into polished code. Others used an orchestrating agent or person to divide possible improvements among several focused agents. Human researchers generally selected goals, supplied mathematical knowledge, reviewed results and redirected searches that had stalled.Each submitted circuit was tested for three requirements. It had to produce the correct point-addition result, return temporary qubits to their original state and avoid leaving phase changes that would interfere with the broader quantum calculation.Verified improvements became available for other participants to use as starting points. The public record also preserved some unsuccessful experiments, potentially helping later researchers avoid repeating the same work.“Open autoresearch, pioneered by ecdsa.fail, is reshaping Ethereum L1 R&D. Live challenges zk.golf, snark.fast, better.codes, precompile.fast produce in weeks what would have taken months or years. A collaborative community armed with AI is magic,” said Justin Drake, Researcher at Ethereum Foundation.The study found that AI agents were particularly useful for implementing and testing repeated incremental changes. In some cases, agent-supported workflows also helped combine existing ideas into new circuit structures.“AI harnesses and agentic workflows are becoming new tools for reorganizing exploration in hard problems,” said Dr Bartosz Naskręcki, Professor of Mathematics and Computer Science at Adam Mickiewicz University in Poznań, according to the statement. “The ecdsa.fail project, initiated by EigenLabs, has spawned a community of researchers who are collaboratively reshaping the landscape of algorithmic security. Their methods are resonating with other challenges and showing that a new paradigm of research is being born.”The researchers did not attempt a controlled comparison between human-only and AI-assisted work. Participants chose their own tools, goals, computing budgets and starting circuits, making it impossible to determine how much of the improvement resulted specifically from AI.“What ECDSA.Fail showed us is that AI agents become much more powerful when they are not working in isolation,” Soubhik Deb, Head of Research at Eigen Labs, said in the statement. “When many independent researchers and agents can explore different approaches, verify improvements against the same benchmark, and build on each other’s work, progress compounds. That insight became a core part of how we think about open autoresearch at Eigen Labs, and what we’re now expanding through Yukon.”The researchers stressed that the results are leaderboard measurements rather than complete estimates for a working cryptographic attack.The benchmark covers point addition, not the entirety of Shor’s algorithm. It leaves out physical quantum error correction, hardware-specific compilation, some operational costs and end-to-end testing of the full attack. A logical-qubit estimate therefore cannot be translated directly into the number of physical qubits that a real machine would require.The main benchmark also supplies one point in each addition as classical information. A complete windowed implementation of Shor’s algorithm must select that information coherently inside the quantum calculation.To examine that issue, the researchers built a compatible version requiring 1,162 logical qubits and an average of 1,684,161 Toffoli gates. That represented an increase of 11 logical qubits and about 29.6% more Toffoli operations per addition. The test demonstrated a single compatible point-addition call, however, rather than a complete quantum attack.Correctness was also evaluated over 9,024 generated test cases instead of being mathematically proved for every possible input. Participants could modify a circuit’s identifying data to generate a different test set, creating a possibility that a circuit with rare errors could pass the benchmark.The team addressed this concern in part by testing selected circuits on 50,000 common pseudorandom inputs and adjusting scores for observed failure rates. The success rates remained close to 100%, and the adjusted performance trend closely followed the original results. Even so, the researchers said the tests do not provide a universal correctness guarantee.The scoring system also excludes circuit depth and the degree to which operations can run in parallel. Two circuits with the same number of qubits and Toffoli operations can therefore receive the same score even if one would take much longer to execute on actual hardware.The next planned step is to incorporate the optimized point-addition circuit into a complete windowed implementation of Shor’s algorithm. That work would include the remaining arithmetic, quantum Fourier transform stages and classical processing needed to recover a key. It would also require end-to-end validation using consistent resource accounting.For a deeper, more technical dive, please review the paper on arXiv. It’s important to note that arXiv is a pre-print server, which allows researchers to receive quick feedback on their work. However, it is not — nor is this article, itself — official peer-review publications. Peer-review is an important step in the scientific process to verify results.TopicsShare Get the latest research, company news, and market intelligence every week. MENTIONED IN THE ARTICLEMore in Research