Bitcoin, Ethereum and most secure traffic on the internet rest on the assumption that a private key cannot be derived from a public one. A powerful enough quantum computer would break that assumption.
None exists today, but NIST has proposed disallowing the affected algorithms after 2035, and the real question is how much time the migration has, which depends on how much quantum hardware an attack would need.
This week that number more than halved. Google Quantum AI published a reduced estimate in March, along with a verifier for checking rival circuits but not the circuit itself. Eigen Labs built a public challenge around that verifier at ECDSA.Fail, and over two months more than a hundred contributors working alongside AI agents cut the cost of the central operation by 86 percent.
To discuss the research and what it means for the migration ahead, we asked our co-founder and CTO, Jieyi Long, who led the paper, to answer six questions.
1. Why does halving this estimate matter now, when no machine capable of the attack exists yet?
Quantum risk is determined by two moving frontiers: how powerful the hardware becomes and how efficiently we use it. Better circuits reduce the burden placed on future machines, so improving the algorithm can be as consequential as improving the hardware. To the best of our knowledge, no existing quantum computer can perform this attack, but credible estimates help us measure the remaining gap and decide how urgently migration should proceed. Waiting until the machine exists would be too late because replacing cryptography across blockchains and financial infrastructure will take years.
2. Google published a threshold but not the circuit. How did the effort to beat it come together?
Google published resource thresholds and a zero-knowledge proof that a qualifying circuit existed, together with software that could verify candidate circuits without revealing its construction. That verifier created an unusually clear research objective: determine whether a circuit works and measure how much it costs.
Eigen Labs turned that opportunity into a public benchmark, agent harness, repository, and leaderboard. André Schrottenloher’s independent reconstruction provided an important open starting point. From there, more than 100 participants including us at Theta Labs and their AI agents tested ideas, published improvements, documented failures, and built on one another’s work. What began as an attempt to reconstruct a hidden result became a cumulative community research effort.
3. You worked alongside AI agents throughout. What did they do well, and where did they still need you?
The agents were excellent at reading unfamiliar code, implementing ideas quickly, running experiments, diagnosing failures, and exploring far more circuit variants than I could examine manually. They accumulated many incremental improvements and occasionally proposed structural changes that led to major advances. In several cases, I described a high-level algorithmic or architectural idea, and the agents carried it through implementation, testing, and refinement. Some of these collaborations produced entirely new designs on the qubit–Toffoli Pareto frontier.
The agents were not yet consistently autonomous, however, even though things might change as AI quickly advances. At least for now, they could get stuck, lose important context, repeat earlier work, or pursue an approach that was locally promising but ultimately suboptimal. Human input was particularly valuable in those moments when it came to restoring context, challenging assumptions, redirecting the search, connecting experiments to the mathematics, and deciding whether an apparent improvement was meaningful and publishable. Throughout the entire process, it was human/researcher led.
We found the most effective arrangement combined human direction and judgment with the agents’ speed, breadth, and implementation capacity. In my view, it became more of an amplification of our intent rather than a replacement of human-led processes.
4. What exactly is Open Autoresearch?
Yeah, so following on from the previous question. What we’re calling ‘Open Autoresearch’ is a model we’ve been trying to pioneer in which independent humans and AI agents work on a shared research problem with a machine-checkable evaluator and a public frontier. Each team can use its own models, prompts, tools, and research strategy. Successful results are published with source code and measurements, allowing everyone else to inspect and improve them.
The important word is “open.” Progress does not remain inside one laboratory or one agent’s context window. Verified improvements, unsuccessful experiments, and technical insights become shared research memory. It is not fully automated science. It is a way for human insight and agent-scale experimentation to compound across a community.
5. Roughly a third of all bitcoin sits in addresses with visible public keys. What does the quantum threat mean for holders?
The estimate refers more precisely to bitcoin held in outputs whose controlling public keys have already been revealed on-chain. If a sufficiently capable fault-tolerant quantum computer existed, it could potentially derive the corresponding private keys and forge valid signatures. This does not mean those funds can be stolen today, and no such machine currently exists to the best of our knowledge.
The practical message is preparation, not panic. Holders will eventually need supported ways to move funds into quantum-resistant outputs. The hardest questions concern dormant or lost coins whose owners may never migrate, along with the network rules governing them. Once a public key has appeared on-chain, that historical exposure cannot be erased, although actively controlled funds can be moved before the threat becomes operational. The “roughly one-third” estimate should be attributed to Figure 5 in the Google cryptocurrency whitepaper.
6. NIST wants these algorithms gone by 2035. What needs to happen between now and then?
The precise statement is that NIST’s proposed transition schedule would disallow quantum-vulnerable public-key algorithms such as ECDSA in relevant NIST-governed uses after 2035, with some uses deprecated after 2030. It is a migration target, not a prediction that a cryptographically relevant quantum computer will arrive in 2035. NIST already recommends beginning the transition.
Organizations first need to inventory where vulnerable cryptography is used, introduce cryptographic agility, select standardized post-quantum replacements, and test them in real systems. Blockchains face additional coordination problems: protocols must support new signature schemes, wallets and hardware must be upgraded, assets must migrate, and communities must decide how to treat funds that cannot move. The cryptographic standards now exist, but deployment, interoperability, governance, and operational testing are the work of the coming years.
Read the full research write-up from Jieyi Long and Eigen Labs here. You can read the research paper on arXiv here.
