Jieyi Long, a co-founder and the chief technology officer of Theta Labs, submitted a quantum circuit for one point addition on secp256k1, the elliptic curve behind Bitcoin and Ethereum signatures, to the open ECDSA.Fail benchmark on October 13, 2026. According to its submission record, the circuit used 893 logical qubits and an average of 2,218,127 Toffoli gates and passed all 9,024 test inputs.
Alongside a paper it posted in March, Google Quantum AI attested to a low-qubit point-addition circuit with 1,175 logical qubits and 2.7 million Toffolis. Against those figures, Long’s circuit has 24% fewer logical qubits and an 18% lower Toffoli count. A follow-up Long posted on October 14 uses 874 logical qubits and 2,398,215 Toffolis.
Long fit one repeated step of a quantum attack on Bitcoin and Ethereum keys into fewer than 900 logical qubits within Google’s Toffoli count, but in his submission notes he gave no estimate for a full attack or for the physical machine it would need.
What the benchmark measures
Point addition is the arithmetic step that Shor’s algorithm repeats when it recovers an elliptic-curve private key from the matching public key. A logical qubit is an error-corrected unit of quantum information that a future machine would build from many physical qubits. A Toffoli gate is a three-qubit logic operation and the most expensive step in such circuits.
Eigen Labs has run ECDSA.Fail as an open benchmark since May 30, 2026. Its participants include people working with AI coding agents.
The challenge’s evaluator, adapted from code Google published with its March paper, checks each circuit on 9,024 inputs drawn from a hash of the circuit itself. Eigen Labs ranks entries by multiplying a circuit’s peak number of logical qubits by its average Toffoli count. Both of Long’s circuits passed the evaluator, but neither beat the leaderboard’s best score on that product.
Google’s figures
Google Quantum AI did not publish its circuits. It released a zero-knowledge proof, a cryptographic method of showing that a statement is true without revealing the details behind it, along with code to verify it. Google used the proof to attest that both the low-qubit circuit and a low-gate version with 1,425 logical qubits and 2.1 million Toffolis perform the addition correctly. Google posted the current version of the proof on April 15.
On April 17, the security firm Trail of Bits reported that it had forged a proof by exploiting bugs in Google’s prover code. Trail of Bits said Google had patched the bugs.
In a preprint posted in March, Google Quantum AI researchers and co-authors including Dan Boneh of Stanford University estimated that a full attack on a 256-bit elliptic-curve key would need fewer than 1,200 logical qubits and fewer than 90 million Toffoli gates with the low-qubit design. They wrote that superconducting machines with physical error rates of 1 in 1,000 could run such an attack in minutes with fewer than 500,000 physical qubits.
In a September preprint, the ECDSA.Fail authors wrote that they do not claim to beat Google’s circuits outright, because the two groups use different interfaces and accounting conventions.
How the circuit was built
According to the submission notes, Anthropic’s Claude Opus 5.5, running in Claude Code, produced the circuit’s layered design and implementation plan. OpenAI’s GPT-5, running in Codex, implemented and tested it. The circuit computes modular inverses, the division step in point addition, with a greatest-common-divisor algorithm that the notes call Lilypad-GCD.
Long’s circuits are approximate. According to the notes on the submission, the circuit failed 111 times in a wider test of 360,960 additions, about once in 3,250. The October 14 follow-up failed 122 times in a test of the same size.
Physical-qubit claims
Pierre-Luc Dallaire-Demers, a co-author of the ECDSA.Fail preprint, wrote on X on October 13 that the circuit would reduce by 25% the physical qubits required under recent attack proposals from IonQ, Oratomic, and Google. He is the chief executive of Pauli Group, a company that builds quantum-resistant tools for digital assets.
Disclosure: Quantum Observer’s Editor-in-Chief Marin Ivezic is an advisor to Project Eleven, which works on post-quantum security for digital assets.
In the preprint, the benchmark’s authors, Long and Dallaire-Demers among them, wrote that its score “is not a physical-resource estimate.” They left circuit depth, routing, error-correction overhead, and other architecture-specific costs out of the score.
The authors also wrote that building a complete attack around a benchmark circuit, which in their design would call the point addition 28 times, “remains future work.”
