A paper released on September 9 reveals that over 100 researchers, using AI coding agents, have dramatically reduced the critical resource score for a quantum attack on Bitcoin by 86.1%. This breakthrough does not mean private keys have been recovered or Bitcoin has been breached; instead, it confirms that software optimization alone can significantly cut the quantum resources needed for elliptic curve operations. The core issue is that each technological advance lowering the cost of a quantum attack compresses the window available for Bitcoin and other blockchains to transition securely to post-quantum cryptography. While the Q-Day threat is not imminent, the safety buffer is shrinking rapidly.
Eigen Labs launched the ECDSA.Fail challenge in late May to boost the efficiency of secp256k1 point addition circuits, with a scoring metric defined as 'maximum logical qubits multiplied by average Toffoli gates executed'. That score has plummeted from an initial 10.75 billion to 1.496 billion as of July 26. The most efficient solution uses 1,151 logical qubits and roughly 1.3 million Toffoli gates, while a later design compresses the gate count below 1 million, requiring only 813 qubits. The researchers emphasize they are verifying mathematical feasibility rather than attacking wallets. Data compiled by Woofun AI shows that IonQ (IONQ.US)'s end-to-end estimate indicates a full attack would require 1,457 logical qubits and 39 million Toffoli gates, corresponding to 19,397 physical trapped-ion qubits, taking about 25.7 days, which aligns with its hardware roadmap around 2028. In comparison, researchers at Google (GOOGL.US) calculate an efficient attack would need 1,200 logical qubits plus 90 million Toffoli gates, or 1,450 logical qubits with 70 million gates; under a superconducting model, the circuit could run in minutes, requiring fewer than 500,000 physical qubits. Although ECDSA.Fail only optimizes the point addition subroutine and fault-tolerant hardware is not yet available, these data comparisons clearly outline the trajectory of technological progress.
Glassnode data reveals that roughly 6.04 million BTC are exposed to quantum attack risk, accounting for 30.2% of the current supply, due to their public keys being publicly available on-chain. Of this total, 1.92 million BTC are at risk through output category exposure, while 4.12 million BTC are exposed through behavioral factors such as address reuse. More concerning is that when a coin is spent, the previously hidden public key becomes instantly public, and in theory, a sufficiently fast computer could calculate the private key before the transaction is confirmed. The Pay-to-Merkle-Root output type introduced by BIP 360 eliminates the quantum threat to Taproot key path spending, yet it cannot address the short-term risk once a transaction enters the mempool, and it lacks an automatic migration mechanism. StarkWare's on-mainnet demonstration of a quantum-safe Bitcoin transaction required hours of off-chain GPU computation, used a non-standard miner-direct connection path, and cannot protect coins with already-exposed public keys. StarkWare CEO Eli Ben-Sasson points out that Avihu's breakthrough offers psychological comfort and breathing room rather than a cure, and he still favors a protocol-level solution. The governance dilemma emerges as an even larger challenge. A report from Coinbase (COIN.US)'s independent advisory committee on quantum computing and blockchain indicates that roughly 1.7 million BTC are scattered across about 20,000 early P2PK public keys, held in wallets believed to be controlled by Satoshi Nakamoto or parties who have lost access. Setting a migration deadline could freeze these coins or leave them vulnerable to being seized through cracking. Ethereum plans to achieve quantum resistance across its execution, consensus, and data layers by December 2029, with preparations for Q-Day starting as early as 2030; the G7 network expert group is also urging coordinated post-quantum migration across the financial sector. Before Bitcoin confronts the true quantum threat, it must first address market risks, especially the ambiguity surrounding migration processes, custody methods, and handling of dormant coins, which could trigger systemic problems long before secp256k1 is actually broken.
Comments