Key Takeaways
- • Researchers at Google Quantum AI, the Ethereum Foundation, and Stanford reduced the estimated physical qubits required to break Bitcoin and Ethereum elliptic curve cryptography by 20-fold, from approximately 9 million to fewer than 500,000 qubits—a material compression of the quantum threat timeline.
- • The optimized circuits require 1,200–1,450 logical qubits and 70–90 million Toffoli gates, with execution times between 9–23 minutes on standard superconducting surface-code architecture, establishing new benchmarks for ECDLP-256 (256-bit elliptic curve discrete logarithm problem) attacks.
- • A separate study by Caltech and Oratomic researchers demonstrated that neutral-atom quantum architectures could execute similar attacks with only 10,000–26,000 physical qubits, though at the cost of days-long runtimes rather than minutes.
- • The whitepaper, dated March 30, 2026, directly targets the secp256k1 curve cryptography underlying both Bitcoin and Ethereum, applying Shor's algorithm to derive private keys from public keys—a critical security vulnerability if quantum hardware materializes at the benchmarked scale.
Summary
A collaborative research effort led by Google Quantum AI, the Ethereum Foundation, and Stanford has published findings that substantially reduce the quantum computing resources required to compromise the cryptographic security of Bitcoin and Ethereum. The March 2026 whitepaper demonstrates that an attack on the elliptic curve cryptography protecting both networks would require fewer than 500,000 physical superconducting qubits—a 20-fold reduction from prior academic estimates of approximately 9 million qubits.
The attack targets the 256-bit elliptic curve discrete logarithm problem (ECDLP-256) using Shor's algorithm against the secp256k1 curve, the specific elliptic curve cryptography standard employed by both Bitcoin and Ethereum. Successfully solving this problem would allow an attacker to derive a wallet's private key from its publicly visible address, effectively compromising fund security. The researchers present two optimized circuit variants: one employing 1,200 logical qubits with 90 million Toffoli gates, and a second using 1,450 logical qubits with 70 million Toffoli gates. Both variants execute within 9–23 minutes on standard superconducting surface-code quantum architecture.
The benchmark advancement represents a significant compression of the quantum threat landscape, though execution remains contingent on building physical quantum hardware at the specified scale. Notably, parallel research from Caltech and Oratomic researchers working with neutral-atom quantum architectures identified alternative pathways requiring as few as 10,000–26,000 physical qubits for equivalent computations. However, this architectural approach carries a substantial tradeoff: execution times extend to multiple days rather than minutes, reflecting fundamental differences in qubit stability and gate fidelity between superconducting and neutral-atom systems.
The whitepaper's reduction of required quantum resources by an order of magnitude below prior consensus benchmarks warrants attention from institutional investors managing cryptocurrency positions, as it advances the timeline for practical quantum threats to blockchain security infrastructure. However, the materialization of such threats depends critically on whether quantum engineering can deliver stable, error-corrected systems at the specified qubit counts—a technical milestone that remains uncertain and likely years in development.
The attack targets the 256-bit elliptic curve discrete logarithm problem (ECDLP-256) using Shor's algorithm against the secp256k1 curve, the specific elliptic curve cryptography standard employed by both Bitcoin and Ethereum. Successfully solving this problem would allow an attacker to derive a wallet's private key from its publicly visible address, effectively compromising fund security. The researchers present two optimized circuit variants: one employing 1,200 logical qubits with 90 million Toffoli gates, and a second using 1,450 logical qubits with 70 million Toffoli gates. Both variants execute within 9–23 minutes on standard superconducting surface-code quantum architecture.
The benchmark advancement represents a significant compression of the quantum threat landscape, though execution remains contingent on building physical quantum hardware at the specified scale. Notably, parallel research from Caltech and Oratomic researchers working with neutral-atom quantum architectures identified alternative pathways requiring as few as 10,000–26,000 physical qubits for equivalent computations. However, this architectural approach carries a substantial tradeoff: execution times extend to multiple days rather than minutes, reflecting fundamental differences in qubit stability and gate fidelity between superconducting and neutral-atom systems.
The whitepaper's reduction of required quantum resources by an order of magnitude below prior consensus benchmarks warrants attention from institutional investors managing cryptocurrency positions, as it advances the timeline for practical quantum threats to blockchain security infrastructure. However, the materialization of such threats depends critically on whether quantum engineering can deliver stable, error-corrected systems at the specified qubit counts—a technical milestone that remains uncertain and likely years in development.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.