Jieyi Long, CTO and co-founder of Theta Labs, is the lead author of a paper published on arXiv today.
It reports that the quantum resources needed for a central step in an attack on Bitcoin and Ethereum have been cut by 86 percent in around two months. He led 36 named authors drawn from the Ethereum Foundation, Eigen Labs, StarkWare, the Starknet Foundation, Trail of Bits, Brevis, Sei Labs and several universities, alongside more than a hundred independent contributors.
The result was reported by The Block, CoinDesk and Decrypt in the days that followed. The reduction applies to a single operation inside a quantum attack rather than to the attack as a whole.
What the Research Measured
Bitcoin and Ethereum transactions are signed using the same elliptic curve, secp256k1. A sufficiently powerful fault-tolerant quantum computer could run Shor's algorithm against that curve and recover a private key from a public key that has already been exposed. An attacker could then sign transactions the account holder never authorised. The same mathematics protects banking systems, secure messaging and government infrastructure, so the exposure is not confined to blockchains.
Shor's algorithm is not a single calculation. It repeats one small arithmetic operation, elliptic curve point addition, a very large number of times, which makes the cost of that operation a major driver of the cost of the whole attack. The ECDSA.Fail challenge isolated it and asked participants to build it as efficiently as they could.
Submissions were scored on two resources multiplied together. Logical qubits act as the circuit's working memory, and Toffoli gates are the expensive operations that dominate runtime on a fault-tolerant machine. At the paper's cutoff of 26 July, the leading circuit needed 1,151 logical qubits and roughly 1.30 million Toffoli gates, giving a combined score of about 1.496 billion. The baseline at the start of the challenge was 10.75 billion. The final figure also sits more than 50 percent below the benchmark Google Quantum AI reported in March, though the two efforts use different accounting conventions and the paper treats the comparison as context rather than a formal claim.
How the Challenge Came About
When Google published its estimates in March, it withheld the circuit behind them. It released resource thresholds and a zero-knowledge proof that a qualifying circuit existed, which allowed the claim to be verified without the construction becoming public. Alongside that proof it published a verifier, software that checks whether any candidate circuit is correct and reports what it costs.
The verifier converted a research question into an objective a machine could settle automatically, with no dispute about whether a submission was an improvement. Eigen Labs built a public challenge around it on 30 May, opening the repository, evaluator and leaderboard to anyone. Participants connected AI coding agents into the loop so they could inspect the circuit, propose a change, compile it, run the evaluator and repeat. IEEE Spectrum reported that the crowdsourced effort matched Google's displayed result within eight hours and surpassed it within roughly 72 hours.
The paper gives this way of working a name. Open autoresearch describes a research process in which humans and AI agents attack a shared problem that a machine can score, publishing every verified improvement to a public leaderboard. Because the evaluator decides what counts as progress, no central body needs to review submissions, and each accepted result becomes the starting point available to the next participant. Failed approaches are documented alongside successful ones, so the same dead ends are not explored twice. The authors report that agents were most effective at implementation, testing and incremental refinement, while humans supplied research direction and judgement about which results mattered.
This is the part of the project that connects most directly to Theta's own work. EdgeCloud was built on the view that serious AI research should not depend on the infrastructure of a handful of large institutions. ECDSA.Fail is a practical demonstration of that. A frontier problem in quantum cryptanalysis moved substantially in eight weeks, driven by a distributed group of researchers running their own models and budgets, coordinated by a shared verifier and a public scoreboard.
Why Public Blockchains Are Exposed
The consequences fall unevenly, and public ledgers carry a structural disadvantage. A public key written to a blockchain stays visible permanently. It cannot be quietly rotated once the cryptography protecting it is understood to be weak, and no future protocol change can conceal keys that have already been published. Roughly a third of all bitcoin sits in addresses where the key is already exposed.
Speaking to CoinDesk, Jieyi Long framed the timing plainly. None of this is urgent because an attack is imminent, he said, but because the remedy takes years and cannot be applied retroactively. Regulators are working to a similar timeline. The initial public draft of NIST IR 8547 proposes deprecating classical public-key algorithms at the 112-bit security level after 2030 and disallowing them after 2035.
The circuits omit physical error correction and have not been assembled into a complete implementation of Shor's algorithm. No existing quantum computer comes close to running them. The work sharpens the estimate for one component of the machinery an attack would need, and it does not demonstrate any capability to break secp256k1 today. Craig Gidney and Tanuj Khattar of Google Quantum AI reviewed the manuscript before publication.
What Happens Next
The challenge is still running and new circuits are submitted daily. One post-cutoff design has already reached 952,707 Toffoli gates, the first below one million, and a separate branch optimised for memory rather than speed reached 813 logical qubits. Eigen Labs has extended the same model to other measurable problems through its Yukon initiative.
The lesson of the last few months is not that quantum computers are about to arrive for Bitcoin. It is that the estimated cost of an attack can fall by 86 percent in eight weeks once the problem is opened up. Hardware advances along a fairly predictable curve, but the algorithmic side can move quickly and with little warning. The gap between the two is the migration window.
