ECC Attack Circuit Drops to 835 Logical Qubits

July 20, 2026 — A team spanning four Chinese research institutions has published a revised quantum circuit for attacking secp256k1, the ECC curve behind Bitcoin and Ethereum signatures, that brings the logical-qubit count down to 835, the lowest figure yet reported for a 256-bit elliptic curve. The paper, posted to arXiv on July 15, supersedes the same group’s April preprint, which I covered when it cut the count to 1,333. In just over three months, the same authors have taken roughly a third off their own number.

Two clarifications belong up front, because the paper’s own framing invites confusion. Its abstract says the result beats “previous best estimates of 1,098 and 1,175 logical qubits” from Chevignard, Fouque, and Schrottenloher and from Babbush et al. The 1,175 figure (Babbush) is right. The 1,098 is not the P-256 number: it is Chevignard’s P-224 figure, carried over from a since-corrected typo in that paper’s abstract, where the P-224 and P-256 values were swapped. Chevignard’s corrected space-optimized P-256 figure is 1,193, the number I used in April. Measured against the correct competitors, 835 is a 29 to 30% reduction. Against the team’s own April circuit, it is 37%.

Bottom line for security teams tracking these estimates: the logical-qubit cost of a quantum attack on a 256-bit ECC curve now sits below every previously published figure, at roughly a third of the 2017 Roetteler baseline of 2,330. But fewer qubits does not mean a cheaper attack. This circuit uses about 20 times more Toffoli gates than the next-best alternatives from Google and Schrottenloher. A smaller quantum computer that has to run 20 times as many expensive operations is a different shape of machine; the total cost may be comparable or even higher. The width shrank; the computational work grew; and the paper does not include a depth analysis to tell us how those two factors net out in wall-clock time. Anyone reporting “835 qubits” without the gate penalty is giving half the picture.

The eight authors are Han Luo, Ziyi Yang, Jingquan Luo, Ziruo Wang, Yuexin Su, Xiaoming Sun, Lvzhou Li, and Tongyang Li, affiliated with research groups at Tsinghua University, Peking University, Sun Yat-Sen University, and the Chinese Academy of Sciences. The paper explicitly supersedes arXiv:2604.02311, and the code is on GitHub.

Mechanically, the improvement comes from the same territory as the April version: a more space-efficient reversible modular inversion circuit built on the Extended Euclidean Algorithm (EEA), using the register-sharing idea Proos and Zalka sketched in 2003. This revision pushes it much further. By the paper’s own accounting, the affine point-addition circuit, which is the inner loop of Shor’s algorithm applied to the elliptic curve discrete logarithm problem (ECDLP), drops from 5n to 3n field-register qubits, plus a 6⌊log₂n⌋ + O(1) overhead, where n is the prime-field bit-length. The modular inversion subroutine underneath it drops from 3n to 2n. Two changes drive that: a tighter inversion circuit, and mid-circuit measurement with classical feed-forward to recycle a register that would otherwise sit idle.

That recycling step is worth isolating. When the circuit performs an in-place division, computing y/x while keeping x, it inverts x with the forward EEA, multiplies to write y/x, and is then left holding the now-redundant old value y in an occupied register. Rather than carry it forward, the circuit measures that register in the Hadamard basis and resets it to zero, freeing it as clean workspace for the inverse EEA. The measurement returns a random bit string, which the circuit uses to apply Pauli-Z corrections that cancel the phase it introduced. The same mechanism handles in-place multiplication. This measurement-and-feed-forward approach is not new (Gidney’s RSA work and the Chevignard ECDLP construction both use it), but Luo et al. keep the standard affine point-addition structure and confine the measurements to the division and multiplication blocks, which makes the accounting easier to follow.

For the complete logical Shor estimate against secp256k1, the paper reports 835 logical qubits and 2^30.63 Toffoli gates, using a signed-window scalar multiplication with window size 16. One accounting caveat sits behind that number. The 835 figure is the width of the controlled point-addition circuit: one control qubit, three 256-bit field registers, and 66 auxiliary qubits. The paper does not spell out whether that total already absorbs the full 16-qubit window register used in the windowed attack, so a strict like-for-like comparison against other papers’ full-circuit widths carries a small ambiguity. It does not move the headline. At 835, or a few qubits above it, the circuit is narrower than every published alternative.

Craig Gidney, the Google researcher whose 2025 RSA-2048 estimate reset that field, flagged the paper on X on July 20. He wrote that he had expected “100x more Toffolis than they achieved,” and added that the authors reached their gate count despite using non-approximate circuits, the exact, deterministic kind that normally cost extra gates relative to the approximate methods much of the field now relies on.

My Analysis

Gidney’s remark is the most useful expert signal attached to this result, and it points at what actually distinguishes the paper. Luo et al.’s construction is exact: it produces the correct output deterministically, with no bounded failure probability. The lowest-gate ECDLP circuits, from Babbush and from Schrottenloher, buy part of their gate efficiency by accepting approximate arithmetic that fails on a small fraction of inputs and is corrected across repeated runs. Luo et al. decline that trade and still reach 2^30.63 Toffoli gates, well below what Gidney anticipated for an exact circuit. His implication, as a Babbush coauthor, is that the approximate lever remains unpulled here, and pulling it would likely take the gate count lower again. Their circuits do use mid-circuit measurement, so “exact” means deterministically correct rather than measurement-free.

The comparison reads most clearly when width and gate count are kept on separate axes, and when both operating points for each competitor are shown:

Read across, the pattern holds. Luo et al. own the narrowest circuit by a clear margin, roughly 29 to 30% below the next-lowest, but they sit at the high-gate end: about 20 times more Toffoli gates than the space-optimized Babbush and Schrottenloher circuits, and more still against the gate-optimized variants. Chevignard occupies the opposite corner, at comparable width to Babbush and Schrottenloher but a gate count roughly three orders of magnitude higher, spread across about 22 independent runs. The paper does not beat the field on every axis. It stakes out the low-width corner of a frontier the others had left open.

That corner has a natural reference point. A point on a 256-bit curve is two field coordinates, so an affine-coordinate circuit that stores the point the obvious way needs about 2n, or roughly 512 qubits, for the data alone. Luo et al.’s 835 sits closer to that 2n baseline than any prior circuit, and the remaining slack is ancilla, the field-arithmetic scratch space that further optimization will keep trimming. But 2n is a representation baseline, not a hard floor. Points can be compressed to an x-coordinate plus a sign bit, and Chevignard’s construction avoids storing the point at all, compressing the output to a single Legendre-symbol bit. As I wrote in June, an x-only construction could in principle push below 2n toward n. The width will keep falling, and no published number marks where it must stop.

The nationality of the authors is less interesting than the inspectability of the work. This is the same Tongyang Li group at Peking University whose April preprint I flagged in my China’s Quantum Ambition series, now working with co-authors from Sun Yat-Sen University and the Chinese Academy of Sciences, and the paper ships full pseudocode, execution traces, explicit circuit diagrams, numerical gate counts generated through Qiskit, and a public repository. Set that against Babbush et al., who withheld their circuit designs behind a zero-knowledge proof. Transparency is not the same as independent verification, and the paper’s tests validate construction, register layout, and resource counting rather than proving the full 256-bit circuit correct. But a reader can check this work in a way the withheld constructions do not allow. The pace is its own signal: 1,333 to 835 from one group in a bit over three months.

What this does not change is the hardware picture. No machine can run any of these circuits. The public verified-logical-qubit record is around 96, set by QuEra in January 2026. The raw width gap to 835 is now under one order of magnitude, which sounds close, but width is the least demanding part of the comparison. Those 96 logical qubits do not have the error rates, the non-Clifford throughput, the decoder latency, or the sustained fault-tolerant depth that running roughly 1.7 billion Toffoli gates would demand. My CRQC Quantum Capability Framework tracks nine capabilities across three layers, and logical-qubit count is one of them. The other eight, including error correction below threshold, real-time decoding, and continuous operation across the full run, remain the binding constraints.

The trade in this paper sharpens that point. A narrower circuit that runs more non-Clifford operations does not obviously reduce the total cost of the attack. The paper reports width and gate counts but no circuit-depth or physical-compilation analysis (the authors list depth as an open question), so its wall-clock time and full spacetime volume are unknown. The direction of the trade is clear enough: fewer qubits, more Toffoli gates, and a computation a machine will have to hold together for longer. That pushes on continuous operation and decoder performance, the capabilities furthest from being demonstrated.

What this does change is the algorithmic track. Through 2026, 256-bit ECDLP estimates have fallen in steps, from Chevignard, Babbush, Schrottenloher, the April preprint, and now this revision, produced by teams across Europe, North America, and China. The width has more than halved from the 2020 Häner baseline of 2,124, and the exact-versus-approximate frontier is still being worked. For anyone modeling ECC quantum risk, the algorithmic requirement is maturing quickly, and the remaining uncertainty in Q-Day for ECC sits overwhelmingly on the hardware and error-correction side. Even the algorithmic side has loose ends, including circuit depth, physical compilation, and, as this paper shows, the occasional stale number in a comparison table.

For organizations still pinning migration timelines to Q-Day predictions: those predictions were never the right clock. The schedule is set by data lifetimes, migration lead time, and the regulatory and contractual deadlines already on the books. This paper is a reason to treat the algorithmic side as advancing. It does not move a date.

For the quantum threat to cryptocurrencies: secp256k1 secures Bitcoin’s signatures and Ethereum’s externally-owned-account signatures, and it is now the most heavily optimized quantum target in public-key cryptography, with several independent teams shrinking its attack circuit this year. The exposure has not moved; the cost of the eventual attack has. And the gap that will decide the outcome is governance rather than gates: circuit designers can iterate several times a year, while changing signature schemes, address formats, and custody across a live chain takes far longer. The bottleneck is governance.