A Key Step of a Quantum Attack on Bitcoin and Ethereum Now Fits in Under 900 Logical Qubits Within Google’s Gate Budget
Table of Contents
October 13, 2026 – Jieyi Long, co-founder and chief technology officer of Theta Labs, posted a circuit to the ECDSA.Fail leaderboard that performs one point addition on secp256k1, the elliptic curve behind Bitcoin and Ethereum signatures. It uses 893 logical qubits and an average of 2,218,127 Toffoli gates and passed all 9,024 test inputs in the challenge’s evaluator. In a wider test reported in the submission notes, 111 of 360,960 additions failed.
A follow-up Long posted on October 14 uses 874 logical qubits and 2,398,215 Toffoli gates, with 122 failures in its own 360,960-trial test. Both circuits fall below the bounds Google Quantum AI published for the low-qubit point-addition circuit behind its March resource estimate: at most 1,175 logical qubits and 2.7 million Toffolis per addition. The 893-qubit circuit uses 24% fewer logical qubits than that bound and 18% fewer Toffolis.
Google did not publish either of its circuits but released a zero-knowledge proof, with code to verify it, that the low-qubit circuit and a second, low-gate circuit with at most 1,425 logical qubits and 2.1 million Toffolis both perform the addition correctly. A full attack repeats a windowed version of the addition 28 times. Google’s estimate for its full low-qubit attack is fewer than 1,200 logical qubits and 90 million Toffolis.
Eigen Labs has run ECDSA.Fail as an open benchmark since May 30. By October 17 it had 1,589 submissions from 147 accounts. Participants, many of them working with AI coding agents, submit reversible point-addition circuits, the operation Shor’s algorithm repeats when it recovers an elliptic-curve private key.
The evaluator, adapted from code Google released with its March paper, checks each circuit on 9,024 inputs. Its score multiplies the circuit’s peak count of logical qubits, the error-corrected qubits a future machine would build from many physical ones, by its average count of Toffoli gates, the circuit’s most expensive operation. The first number sets how large a machine an attack needs and the second largely sets how long it runs.
Long’s circuits did not take the top score, which on October 17 belonged to a circuit with 1,234 logical qubits and 761,096 Toffoli gates. The leaderboard puts its score 68.6% below that of Google’s low-gate bound.
Circuits narrower than Long’s also pass the benchmark, but every one of them exceeds Google’s 2.7-million-Toffoli bound. The leaderboard’s home page now shows a low-qubit record of 676 qubits, set with 398,909,531 Toffolis, and a low-Toffoli record of 753,694 Toffolis, set with 1,556 qubits. Below 700 qubits, every passing circuit uses hundreds of millions of Toffolis.
According to the submission notes, the design of the 893-qubit circuit, built on a modular-inversion method Long calls Lilypad-GCD, came from Anthropic’s Claude Opus 5.5 running in Claude Code, and its implementation and validation from OpenAI’s GPT-5 running in Codex.
Pierre-Luc Dallaire-Demers of Pauli Group, a Calgary organization that builds quantum-resistant tools for digital assets, is a co-author of the ECDSA.Fail paper. On October 13 he called the result a breakthrough on X and wrote that it cuts the physical qubits required by recent attack proposals from IonQ, Oratomic and Google by 25%. No full Shor’s-algorithm estimate built on the new circuit has been published.
My Analysis
In June I estimated that the qubit count for this circuit was falling toward a floor of about 512 logical qubits, the minimum needed to store a point’s two 256-bit coordinates. The best-scoring circuits on the leaderboard then used about 1,155 qubits. The narrowest circuit to pass the benchmark used 947 qubits and 62 million Toffolis. Four months later, nine of Long’s circuits use fewer than 900 qubits and stay within Google’s Toffoli bound.
Fewer Qubits Without More Toffoli Gates
A circuit’s width is the peak number of logical qubits it needs at once. Until October 13, every circuit that passed the benchmark with fewer than 1,037 qubits needed more than Google’s 2.7 million Toffolis. The 825-qubit circuit in the ECDSA.Fail paper published in September needed about 489 million, and the 676-qubit record set on October 17 needs 399 million. Long cut the narrowest width within Google’s 2.7-million-Toffoli bound to 1,037 qubits on October 11, to 893 with Lilypad-GCD on October 13, to 877 later that day and to 874 on October 14.
The comparison with Google is closer to like-for-like than most comparisons of resource estimates. The challenge’s evaluator was built from the verification code Google published with its zero-knowledge proof, and Gautham Anant of Eigen Labs recorded in April that it uses the same 9,024-input test procedure and instruction set. Google’s proof shows only that its low-qubit circuit falls within the 1,175-qubit and 2.7-million-Toffoli bounds, so the circuit itself may be smaller. The ECDSA.Fail authors cite differing interfaces, accounting conventions and validation scope as their reasons for not claiming that their circuits beat Google’s outright.
The narrowest circuit within Google’s gate bound stayed between 1,112 and 1,133 qubits from late June until October 8, then fell to 874 in six days. The 144-qubit step from 1,037 to 893 on October 13 is the largest single cut since the contest’s first week. It came from Lilypad-GCD, a new variant of the binary greatest-common-divisor (GCD) algorithm. Long’s circuit uses it for modular inversion, the step that sets the circuit’s peak width.
Dallaire-Demers called the result a breakthrough. I would hold that word until a windowed version of the circuit and an independent estimate of a full attack exist.
Checking the 25% Physical-Qubit Claim Against Google, Oratomic and IonQ
Two gaps separate the leaderboard number from a physical machine. First, the benchmark gives each circuit the point to add as an ordinary classical number. A real attack selects that point from a table in quantum superposition. When the ECDSA.Fail authors added that lookup to their 1,151-qubit circuit, it cost 11 more qubits and about 30% more Toffolis. Nobody has published that version of the sub-900 circuits yet.
Second, the 25% figure assumes physical qubits shrink one-for-one with logical width. The memory that stores logical qubits does shrink with their number. The magic-state factories, which produce the resource states each Toffoli gate consumes, do not, and neither do the zones for processing and routing. Google, Oratomic and IonQ give these parts very different shares of their machines.
Google. Google’s March paper put its roughly 1,200-logical-qubit variant on fewer than 500,000 superconducting qubits. Scaling that by width alone gives about 380,000. Google would have to redo its compilation with the new circuit to know the real figure. Its factories and routing would not shrink with the logical count, while a circuit with fewer Toffolis may need less error correction per logical qubit. Long’s circuit also needs fewer magic states per addition than Google’s bound allows.
Oratomic. Oratomic is a neutral-atom start-up in Pasadena, California. Its design targets P-256, a different 256-bit curve. Its smallest configuration uses 9,739 atoms. Of those atoms, 2,565 run the magic-state factories and 894 the operation zone. The memory, the extra atoms that check it for errors and a small processor use the remaining 6,280. The memory code stores up to 1,224 logical qubits in 4,350 data atoms, and the paper’s next-smaller code holds 744, too few for 893. With the published codes, the memory wouldn’t shrink at all. A code sized for 893 logical qubits would save roughly 1,200 to 1,600 atoms, 12% to 16% of the machine, depending on how many checking atoms it needs.
IonQ. IonQ’s trapped-ion compilation uses 19,397 ions, 14,283 of them in 69 memory blocks of 207 ions, each storing up to 22 logical qubits. At peak, IonQ’s design keeps 68 of those blocks active, plus one for 16 idle index bits. Packed the same way, 893 logical qubits and the same index bits would need 42 to 44 blocks, depending on how much spare room IonQ leaves in each. That would save about 5,200 to 5,600 ions, 27% to 29% of the machine.
IonQ’s 39 million Toffolis, spread over 28 windowed additions, average about 1.4 million per addition with the lookups included. Long’s circuit uses 2.2 million before any lookup is added, about 1.6 times as much. IonQ’s authors write that Toffoli gates dominate the machine’s runtime of 25.7 days per attempt. On that machine, Long’s circuit would lengthen every attempt.
The leaderboard’s top scorer is the more natural candidate for IonQ to compile into its design. At 1,234 qubits it would free 9 to 11 blocks, about 1,900 to 2,300 ions (10% to 12%), and its 761,096 Toffolis per addition are about 55% of IonQ’s average before a lookup is added.
On these scalings, Google’s machine would shrink by about a quarter only if every component shrank with width. Oratomic’s would shrink by 16% at most, and IonQ’s would need about 28% fewer ions but run longer. None of the three companies has redone its estimate with these circuits.
Google’s paper calls superconducting machines fast-clock and trapped-ion and neutral-atom machines slow-clock. The fast-clock kind, which Google estimates can run the attack in minutes, gains most from the narrowest circuit. The slow-clock kind, at 25.7 days per IonQ attempt, gains most from the fewest Toffolis.
The 893-Qubit Circuit Fails About Once in 3,250 Additions
The submission notes report the wider test in full: 111 failures in 360,960 additions, about one in 3,250. At that rate, a run of the 9,024-input evaluation would hit 2.8 failures on average and come out clean about 6% of the time.
The evaluator draws its test inputs from a hash of the circuit, so adding pairs of gates that cancel each other changes the inputs without changing what the circuit computes. According to the notes, a GPU filter screened candidate variants of this kind, and the first one sent to the challenge’s evaluator passed all 9,024 inputs. The challenge allows this, and other submissions do it too. In the 874-qubit circuit’s own test, 122 additions failed, about one in 2,960.
If the 893-qubit circuit’s failure rate applied independently to each of the 28 additions in a full attack, arithmetic errors would make under 1% of attack runs fail, and an attacker can run again. The benchmark tests one classical input at a time, while a real attack runs the additions on superposed inputs, so that 1% is an extrapolation. Anyone comparing leaderboard entries should read “passed all 9,024 inputs” as an approximate circuit with a chosen test set, and look for the failure rate in the notes.
How Close Point Addition Is to the 512-Qubit Floor
The narrowest circuit that passes the benchmark now uses 676 qubits, 1.32 times the 512-qubit floor, at about 520 times the Toffoli count of the leaderboard’s top scorer. Within Google’s Toffoli bound, the narrowest is Long’s 874. That leaves under 400 qubits between it and the floor I estimated in June. In September, Sunghyeon Jo and Gye Jin Lee posted a preprint claiming a construction whose qubit count grows as $$5n/2 + o(n)$$ for an n-bit curve. It gives no concrete count for secp256k1.
The width records I discussed in June came with higher gate counts, so they demanded machines that run longer. Long’s circuit is narrower than Google’s low-qubit bounds and needs fewer Toffolis per addition, so an attack built on it would need a smaller machine without a longer run. The largest published demonstrations of logical qubits have fewer than 100. This circuit needs about 900 working together through tens of millions of Toffoli gates.
For Bitcoin and Ethereum, which have not yet changed their signature schemes, the point-addition step of the attack now fits in under 900 logical qubits within Google’s Toffoli bound. Nobody has yet built a windowed version of the Lilypad circuit or compiled a whole attack around it, so no full-attack figure exists. That is the next number I will look for.
