Eight researchers from four Chinese institutions described a quantum circuit that would need 835 logical qubits to recover a private key from its public key on secp256k1, in a preprint posted on July 15, 2026. Bitcoin uses secp256k1, an elliptic curve, for its public-key cryptography. A logical qubit is an error-protected unit of quantum information, encoded across many physical qubits in a fault-tolerant computer.
Han Luo of Tsinghua University wrote the preprint with seven co-authors at Peking University, Sun Yat-sen University, and the Chinese Academy of Sciences. They compared their count with earlier estimates of 1,098 logical qubits by Clémence Chevignard, Pierre-Alain Fouque, and André Schrottenloher and 1,175 by Ryan Babbush of Google Quantum AI and colleagues. The new circuit needs about 1.66 billion Toffoli gates, three-qubit operations that flip one qubit only when the other two are both set to 1.
The circuit needs fewer logical qubits than any estimate in the authors’ comparison, but it uses 20 to 23 times as many Toffoli gates as the lowest-qubit circuits from Babbush’s team and from Schrottenloher. The authors estimated neither the physical qubits nor the running time an attack would require.
The estimate
Researchers count Toffoli gates in resource estimates because error-corrected machines need extra resources, called magic states, to run them. For secp256k1, Luo’s team reported 835 logical qubits and about 1.66 billion Toffoli gates, using a signed-window method that handles 16 bits at a time through table lookups to cut the number of point additions. Their preprint has not yet gone through peer review at a journal or conference.
The authors built the circuit to run Shor’s algorithm, published by Peter Shor in 1994. With it, a large enough quantum computer could solve the elliptic curve discrete logarithm problem, the math on which a private key’s secrecy depends when its public key is known.
The authors attributed most of the reduction in logical qubits to a new reversible circuit for modular inversion, a costly step when adding two points on the curve. Quantum computers must do arithmetic with reversible circuits that can be run backward step by step.
According to the authors, the inversion circuit “addresses the dominant space bottleneck in affine-coordinate point addition.” To build it, they refined a technique that John Proos and Christof Zalka proposed in 2003, in which values that shrink and grow during the calculation share the same qubits.
They also used mid-circuit measurement with classical feed-forward, in which some qubits are measured partway through the computation and later operations depend on the outcomes. The authors called their work “an exact and fully explicit circuit-level construction.”
The authors wrote that the paper supersedes their April preprint, in which Luo and four of the same co-authors estimated 1,333 logical qubits for a 256-bit curve. In a 2020 paper, Thomas Häner and colleagues had estimated 2,124 logical qubits.
Earlier estimates
In their comparison table for secp256k1, the authors listed two versions of the circuits from Babbush’s team, at 1,175 logical qubits and about 81 million Toffoli gates, or 1,425 and about 64 million. They listed Schrottenloher’s circuits at 1,192 logical qubits and about 72 million Toffoli gates, or 1,446 and about 58 million.
Babbush and colleagues also estimated physical requirements, writing that their circuits could run in minutes on fewer than half a million physical qubits, assuming superconducting hardware with physical error rates of 1 in 1,000. The team validated its results with a zero-knowledge proof, a way of proving a claim without revealing the underlying details, and withheld the circuits themselves.
Luo’s team listed the construction by Chevignard, Fouque, and Schrottenloher at 1,098 logical qubits and about 295 billion Toffoli gates per run. In their own paper, last revised on June 4, Chevignard and colleagues gave 1,193 qubits for P-256, another 256-bit curve, using 22 independent runs. On the paper’s archive page, they recorded a correction to a typo in the abstract that had swapped the figures for P-224 and P-256.
What the authors did not estimate
The authors counted logical qubits and Toffoli and two-qubit CNOT gates, checking the counts by compiling their circuits with Qiskit, IBM’s open-source quantum software. They posted their circuit implementation on GitHub.
The authors wrote that the paper “does not provide a detailed analysis of circuit depth,” the number of sequential steps that running time depends on. They gave no estimate of physical qubits or error-correction overhead.
Running the attack would require a fault-tolerant quantum computer with at least 835 logical qubits that could execute about 1.66 billion Toffoli gates in one computation. The authors listed depth analysis, trade-offs between the number of qubits and circuit depth, and further gate-count reductions among their open questions.
Update, November 12, 2026: In revisions posted on August 9 and September 5, the authors raised their Toffoli count to about 1.98 billion, roughly 24 to 27 times the lowest-qubit circuits from Babbush’s team and Schrottenloher. The count of 835 logical qubits is unchanged. Quantum Observer has since covered related estimates from IonQ and from the ECDSA.Fail project.
