Crowdsourced Quantum Study Cuts Bitcoin and Ethereum Attack Benchmark Another 50%, Building on Google's March Estimate

Since Google Quantum AI, the Ethereum Foundation and Stanford published a paper on March 30, 2026 cutting the estimated physical qubits needed to break Bitcoin and Ethereum's core cryptography by 20-fold, to under 500,000 from a prior benchmark of roughly 9 million, a separate crowdsourced research effort has pushed a related benchmark down by more than 50% further.

The new work, described by CoinDesk and independently reported by The Quantum Insider, comes from a paper shared by researchers at Theta Labs, the Ethereum Foundation, StarkWare and other organizations. It grew out of an open challenge called ECDSA.Fail, created by Eigen Labs, which pulled in more than 100 contributors working alongside AI coding agents over roughly eight weeks.

What Actually Changed

The ECDSA.Fail project targeted one specific piece of math: elliptic curve point addition, an operation repeated constantly inside Shor's algorithm, the quantum method that could theoretically turn a public key into a private key. Point addition isn't the whole attack, but it's a major chunk of the computational cost.

The team's headline circuit uses 1,151 logical qubits and about 1.3 million Toffoli gates, producing a combined resource score of roughly 1.5 billion, according to CoinDesk. Google's March benchmark for the same kind of calculation scored around 3 billion, so this is better than a 50% cut, though CoinDesk noted the two papers use different accounting rules, so it's not a perfectly clean comparison.

A second version, adapted more closely to how Shor's algorithm would actually use the calculation, scored about 1.96 billion, still under Google's figure. A later iteration pushed the score down again to roughly 1.26 billion, according to Newsbytes App, and another variant cut the logical-qubit requirement to 813, though that came at the cost of far more computation. The Quantum Insider put the total improvement from the project's own starting circuit at 86.1%, while noting the result lands about 50% below Google's specific point-addition figure.

More than 400 submissions were accepted during the challenge. Humans reportedly picked research directions and made the larger structural changes to the circuits, while AI agents handled implementation, repeated testing and smaller optimizations. The paper does not attempt to break out how much of the total gain came from humans versus AI, according to CoinDesk. Given how much of the actual grunt work apparently ran through machine assistance, that's a notable gap.

The Man Behind the Numbers

Jieyi Long, CTO of Theta Labs and a lead author on the paper, has been blunt about what this does and doesn't mean. "None of this is urgent because an attack is imminent," Long said, according to Newsbytes App. "It is urgent because the remedy takes years and cannot be applied retroactively."

In a separate statement to The Quantum Insider, Long put a number on the exposure: "roughly a third of all bitcoin already sits in addresses where the key is visible." That tracks with the March paper's own figures, which pegged at-rest exposure at about 6.9 million BTC sitting in wallets with visible public keys, including roughly 1.7 million BTC in legacy Satoshi-era P2PK addresses that broadcast the full key. On Ethereum's side, the March paper estimated about 20.5 million ETH face similar exposure, plus administrative keys tied to stablecoin and tokenized-asset smart contracts.

The March paper also laid out two attack shapes. An "on-spend" attack would try to intercept a public key during Bitcoin's roughly 10-minute block confirmation window and derive the private key before the transaction settles, which the researchers estimated could succeed about 41% of the time under certain conditions. An "at-rest" attack would simply go after wallets whose public keys are already sitting on the chain forever, no confirmation window required.

Still Nowhere Close, On Paper

None of this describes an attack that's happened or a machine that exists. Newsbytes App's own framing put it plainly: today's quantum computers aren't powerful enough to pull this off. That's the strongest pushback to any panic reading of these papers, and it's a fair one. Building a fault-tolerant machine with hundreds of thousands of stable physical qubits, let alone the 1,151 to 1,450 logical qubits these circuits assume, remains a hardware problem nobody has solved.

A separate approach from Caltech and Oratomic researchers, using neutral-atom architectures rather than superconducting qubits, claims physical qubit requirements as low as 10,000 to 26,000 for similar computations, according to Crypto Briefing. The tradeoff is speed: those systems would need days to run the attack instead of minutes.

Several outlets covering the ECDSA.Fail results, including KuCoin, Newsbytes App and a Ground News aggregation, are largely republishing the same CoinDesk report rather than reporting it independently, so the volume of coverage isn't additional confirmation beyond the original paper and CoinDesk's account of it.

The practical question isn't whether a quantum computer will show up tomorrow. It's whether the industry moves wallets and protocols to quantum-resistant signature schemes before one does. Long's own warning is that the migration takes years and can't be bolted on after the fact, which is the same logic driving projects like QuFi Network's quantum-resistant verification layer, demoed on Bitcoin's testnet earlier this month. Whether Bitcoin's and Ethereum's core protocols adopt anything like it before hardware catches up to these shrinking benchmarks remains an open question nobody in this research has answered.