Background primer
The signatures that prove who owns which Bitcoin and Ether rest on a math problem that ordinary computers cannot solve. A large enough quantum computer, running an algorithm from 1994, could. Here is how that works, and what my project has to do with it.
The lock
When you own cryptocurrency, what you own is a secret number called a private key. A bit of math turns it into a matching public key, which you can share freely. The public key is an open padlock you hand out. The private key is the only thing that closes it.
To spend coins, you sign the transaction with your private key. Anyone can then use your public key to check that the signature is genuine, without ever seeing the secret itself. That signing-and-checking scheme is ECDSA (the Elliptic Curve Digital Signature Algorithm), and it is what proves ownership across Bitcoin, Ethereum, and most major cryptocurrencies. Break it, and you could forge someone's signature and move their coins as if they were yours.
The one-way street
The whole scheme relies on a math operation that is easy to do forward and, as far as anyone knows, practically impossible to undo. It runs on a curve. Bitcoin and Ethereum both use the same one, an elliptic curve named secp256k1, and the curve comes with a rule for “adding” two of its points to get a third (there is a live picture of that rule you can drag, and a proof that the answer always lands back on the curve).
Everyone using this curve shares one fixed, public point on it, called the generator G: the same published point for every wallet. Your private key is just an enormous secret number, d. Your public key is the point you reach by adding d copies of G together, written Q = dG. Going forward, from d to Q, is fast even when d is astronomically large, because you can double your way there. Going backward, recovering the secret count d from the two public points G and Q, is the discrete logarithm problem.
These are the standard letters from the cryptography literature: G for the shared generator, d for the private key, Q for the public key. One more, k, appears only when you sign a message. It is a nonce, short for “number used once”, a throwaway secret picked fresh at random for every signature. The nonce is not your private key, but the signing math mixes the two, so a k that is ever repeated or guessable lets an attacker work backward to your permanent key d. Real wallets have lost coins that way while the curve itself held; the weakness is in how a signature gets made, not in the one-way curve lock this page is about.
For an ordinary computer, that backward step would take longer than the age of the universe. It is the same idea as mixing two paint colors: combining them takes a second, but separating the mixture back into the exact originals is hopeless. That gap, easy one way and hopeless the other, is the entire reason your coins stay yours.
The threat
In 1994 Peter Shor found a method that undoes exactly this kind of one-way problem on a quantum computer. Shor's algorithm is the textbook example of a task where a quantum machine beats every ordinary computer decisively. It is why people started taking quantum computing seriously.
It works by using quantum interference to find a hidden repeating pattern in the math. An ordinary computer would take astronomically long to find that pattern; once found, the pattern gives up the private key almost immediately. Point it at a public key Q on secp256k1, and out comes the matching private key d, the secret number the discrete logarithm problem was built to hide.
That is the whole prize. The private key d is the one number that controls the coins. Recovering d from the public key is what “breaking ECDSA” means, and that is what this project measures the cost of. My part is not running that attack; it is measuring how large a quantum computer it would take, by building the leanest possible circuit for the point addition Shor's algorithm leans on.
The only reason your coins are safe today is that Shor's algorithm needs a quantum computer far bigger than any that exists. The algorithm itself is finished and waiting; give it a machine with enough qubits and ECDSA falls. So the whole threat comes down to a single number: how many qubits is enough?
The catch
When people count the qubits an attack would need, they mean logical qubits: flawless ones. Real qubits are nothing like that. They are fragile and noisy, losing their state in a fraction of a second and making frequent errors.
The way around this is error correction: you gang together many noisy physical qubits and run constant checks so that together they behave like one reliable logical qubit. For a computation this long, one logical qubit takes on the order of a thousand physical ones in the mainstream designs today's estimates assume; the exact ratio depends on the error-correction scheme. So a design that needs 1,200 logical qubits needs a machine with hundreds of thousands of physical qubits.
The number
Google Quantum AI has published a detailed resource estimate.
Their result: a quantum computer with fewer than about 1,200 logical qubits could break secp256k1, which in practice means under 500,000 physical qubits and an attack that runs in minutes. That is about twenty times lower than earlier estimates, which were in the millions. The threat did not get closer because hardware improved. It got closer because someone found a leaner way to do the math.
~1,200
logical qubits the attack circuit needs
<500,000
physical qubits that would take, in practice
~1,600
physical qubits in the largest commercial machine today
Where does that number come from, and how close are the machines to reaching it?
Where I come in
That “1,200 logical qubits” is not a guess. Somebody built the quantum circuit for the hardest step of Shor's attack, adding two points on the curve, and counted the qubits it uses and the expensive operations it performs. The circuit is the estimate. A leaner circuit means a smaller machine suffices, and a smaller machine means the threat arrives sooner.
The ECDSA.fail challenge is a public competition to build the leanest such circuit, and its score is exactly those two counts multiplied together. The circuit I reproduced and validated on my own laptop used 1,154 logical qubits, and the construction that replaced it in August measured 1,267 on August 23, both close to the roughly 1,200 in Google's estimate. These are different circuits, so the agreement is not one number counted twice. Separate designs keep landing at a similar width. The challenge measures the size of machine the attack would need. It does not carry the attack out.
The distance
Short answer: not close, and the machines that publish plans to get there disagree on when. Here it is broken down.
The largest commercial quantum computer today, Infleqtion's neutral-atom Sqale, holds about 1,600 physical qubits, and research arrays have reached several thousand atoms, one at 6,100. A machine that could run this attack does not exist yet. The question is how fast one might. Everything the challenge runs today, it runs by having an ordinary computer follow the circuit one test input at a time; why that works is on the how-it-works page.
IonQ, which builds trapped-ion computers, lists about 1,600 logical qubits by 2028. IBM lists two larger machines: Starling in 2029 (200 logical qubits, 100 million operations) and Blue Jay in 2033 (2,000 logical qubits, a billion operations).
A newer entrant is attacking the other side of the equation. Oratomic, a Caltech spin-out launched in March 2026 with 300 million dollars in funding, is working on a leaner error-correction scheme instead of a leaner circuit. Its launch research claims the cost of error correction can drop from roughly a thousand physical atoms per logical qubit to about five. At five, a machine capable of running this attack would need only 10,000 to 20,000 atoms, and the company explicitly names Shor's algorithm as a target capability. Oratomic has no machine yet and no dated roadmap, and it calls the result a theoretical existence proof, so this is an ambition rather than a schedule. It still points the same way as the circuit work: the threat timeline moves when someone makes the math cheaper.
The attack needs two things at once: about 1,200 logical qubits, and the ability to run tens of millions of operations in a row. IonQ's roadmap reports the qubit count but not an operation depth for that machine. IBM's reports both, though its machine with enough qubits, Blue Jay, is dated 2033. So the roadmaps show when each target number is planned to arrive; they do not settle which machine could run the full attack first.
Roadmaps are targets, not results, and quantum timelines have slipped before. The current record is 96 error-corrected logical qubits (QuEra, published in Nature in January 2026). But those are low-code-distance logical qubits, far weaker than the roughly 1,200 high-quality ones the attack circuit needs, so no machine today comes close to running it.
What happens next
Because the fix takes years, and you cannot start on time if you do not know the deadline. The world already has replacement signature schemes, called post-quantum cryptography, that no known quantum algorithm can break. Moving Bitcoin, Ethereum, banks, and the wider internet onto them is slow and has to begin well before a code-breaking machine is built.
An estimate of how big that machine needs to be is what tells people how much time they have to make the move. That is what this work produces: not a break, but a clearer measure of how much warning there is.
Source
The resource figures here are from Google Quantum AI's study, “Safeguarding cryptocurrency by disclosing quantum vulnerabilities responsibly”, which the ECDSA.fail competition builds on. The roadmap figures link to IonQ and IBM above, and today's machine sizes are from qrlhub's qubit tracker, which names its sources. Nothing here is a present-day break: no wallet or coin is at risk from today's machines.
Now you know the stakes
Keep reading