André Schrottenloher, a researcher at Inria and the University of Rennes in France, posted a preprint on June 1, 2026, with open quantum circuits for attacking secp256k1, the elliptic curve that Bitcoin and Ethereum use to sign transactions. He reported costs close to those that Google Quantum AI researchers and their co-authors estimated in March, when they withheld their own circuits.
Schrottenloher released his circuits and the code that generates them, so researchers outside Google can check the cost of point addition, the step repeated 28 times in an attack on secp256k1.
Craig Gidney, a Google Quantum AI researcher and co-author of the March paper, wrote on his personal blog the same day that Schrottenloher was “the first to match” his team’s circuits. He added that Schrottenloher had improved the Toffoli count “a little bit.”
A Toffoli gate is a three-qubit operation that consumes a specially prepared resource state in a fault-tolerant machine, one that detects and corrects its own errors as it runs. Researchers therefore treat the Toffoli count as the main measure of an attack’s cost.
The two sets of figures
In a paper posted on March 30, 2026, Ryan Babbush of Google Quantum AI, Gidney, and seven co-authors gave two versions of their attack on secp256k1. One would use at most 1,200 logical qubits and 90 million Toffoli gates. The other would use at most 1,450 logical qubits and 70 million Toffoli gates.
An attacker running either version would solve the elliptic-curve discrete logarithm problem, the task of recovering a private key from its public key. A logical qubit is an error-protected unit of quantum information encoded across many physical qubits.
The authors calculated that their circuits could run in minutes on fewer than half a million physical qubits. They assumed physical error rates of 1 in 1,000, planar connectivity that links each qubit only to its nearest neighbors on a flat chip, a control system that reacts in 10 microseconds, and variants of the surface code for error correction. Under those assumptions, they put the full computation at 18 or 23 minutes.
For one point addition, Schrottenloher counted 1,192 logical qubits and about 2.4 million Toffoli gates in his space-optimized circuit, and 1,446 logical qubits and about 1.9 million in his gate-optimized one. He listed the March paper’s two circuits at 1,175 logical qubits with about 2.7 million Toffoli gates, and 1,425 logical qubits with about 2.1 million.
He wrote that these counts leave out a small lookup window, which costs 16 more logical qubits and about 197,000 more Toffoli gates per addition. In his abstract, he summarized the comparison as about 1.5% more logical qubits and a Toffoli count 6.5% to 10% lower.
How the circuits were checked
Schrottenloher tested the circuits in a simulation on an ordinary computer, in which he replaced exact arithmetic components with the classical functions they compute. On 10,000 randomly chosen inputs, the circuits never failed. He put their failure probability at no more than about 1 in 10,000 and described it as comparable to that of the March paper’s circuits. A run of 10,000 independent tests without a failure supports an upper bound of about 3 in 10,000 at 95% confidence.
He wrote that he optimized logical circuits “without taking into account the error correction layer.” Physical-qubit counts and running times depend on that layer and on the hardware. Schrottenloher built the circuits with Qarton, a Python library, and posted the point-addition code on Inria’s GitLab.
Google’s zero-knowledge proofs
The March paper’s authors used a zero-knowledge proof “to validate these results without disclosing attack vectors,” they wrote. With a zero-knowledge proof, one party can show that a claim is true without revealing the details behind it.
In April, Keegan Ryan of the security firm Trail of Bits reported that he had used bugs in Google’s prover code to forge a proof that a point-addition circuit with 1,164 logical qubits used zero Toffoli gates. Ryan wrote that Google had patched its proof and that its scientific claims were unaffected.
In his June 1 post, Gidney wrote that his team had described a more space-efficient way to multiply in an October 2025 paper on decoded quantum interferometry, a quantum algorithm for optimization problems. Anyone could work out what the proofs concealed by reading the team’s prior papers and putting “two and two together,” he wrote.
“The benefits are negligible, and the costs are many,” Gidney wrote of hiding the circuits. He concluded that such work should simply be published openly. He wrote on the blog that his opinions are his own and independent of his employer.
What an attack would require
Both papers are preprints. By either count, an attack on secp256k1 would require a fault-tolerant quantum computer with roughly 1,200 to 1,450 logical qubits. The March paper’s authors estimated that such a machine would need fewer than half a million physical qubits at error rates of 1 in 1,000.
Update, November 13, 2026: On September 4, IonQ researchers posted a preprint in which they optimized Schrottenloher’s circuits into a full attack using about 1,450 logical qubits and 40 million Toffoli gates. IonQ gave the figures as 1,457 logical qubits and 39 million Toffoli gates on September 8. As of November 13, Google had not released its circuits.
