Hook
On September 10, 2024, a preprint appeared carrying a number that reads, to a careless eye, like a countdown. An optimized quantum circuit for attacking Bitcoin and Ethereum's signature scheme cut the estimated resource requirement by more than half. The composite score — a custom metric aggregating qubit count, gate depth, and error-correction overhead — fell from roughly 3 billion to 1.5 billion against Google Quantum AI's earlier estimate.
The headline number is not the interesting one. The interesting one is 1,151.
That is the count of logical qubits the circuit requires. I do not trust; I verify the hash. And here there is no hash to verify. No repository was published with the paper. No reproduction exists. No independent cryptographic review has been completed. The first author is Jieyi Long, CTO of Theta Labs, working alongside researchers affiliated with the Ethereum Foundation and StarkWare. Those are credible institutions. Credibility is not an audit.
Context
To understand what was actually optimized, you have to understand where the bottleneck lives.
Shor's algorithm, published in 1994, solves integer factorization and the discrete logarithm problem in polynomial time on a sufficiently large, fault-tolerant quantum computer. Bitcoin and Ethereum do not use RSA. They use ECDSA over the secp256k1 curve. The hard step for a quantum adversary is not the elliptic curve itself — it is the repeated point addition inside the period-finding routine. Every addition on the curve, performed in superposition, must be implemented as a reversible quantum circuit built from Toffoli gates. Gate count and circuit depth scale brutally with the size of the field.
That is where this paper operates. It is not a new attack. It is a better implementation of an old one.
The paper claims a reduction in the composite score from approximately 3 billion to 1.5 billion, and a logical qubit requirement of roughly 1,151. The composite score is not a standardized unit. It is a convenience metric — a way to collapse three coupled variables into one comparable figure. Reducing it means the circuit is cheaper to express. It does not mean the circuit is cheaper to run, because the circuit does not yet run anywhere.
This distinction is where nearly every headline on the subject fails. A resource estimate for a hypothetical fault-tolerant machine is a mathematical statement. Whether such a machine can be built is an engineering statement. They are not the same claim, and conflating them is the standard error of quantum reporting.
Core
Here is the teardown.
1,151 logical qubits is not 1,151 qubits. This is the single most misread figure in the paper. A logical qubit is an error-corrected qubit — a stable unit assembled from many physical qubits running a surface code or comparable scheme. At realistic current fidelities, the physical-to-logical ratio is measured in thousands to one, not tens to one. IBM's Osprey carries 433 physical qubits. It carries zero useful logical qubits. QuEra's 2023 demonstration of 48 logical qubits remains among the strongest published results, and those logical qubits perform operations for microseconds, not for the million-plus gate sequence a cryptographically relevant attack demands.
Multiply 1,151 by a conservative correction overhead and you are not looking at a bigger machine. You are looking at a different class of machine, one that has never existed, running coherently for durations that current hardware cannot approach.
The optimization is real but bounded. The paper improved the point-addition circuit, which is genuine cryptographic work. It did not discover a new attack surface, and it did not weaken the underlying hardness assumption. Between the lines of bytecode lies the trap — in this case, the trap is assuming a 50% reduction in an astronomically large number produces a small number. It does not. 1.5 billion is not closer to zero than 3 billion in any practical sense. Both are far outside any demonstrated hardware envelope.
The composite score hides variance. Folding qubit count, depth, and correction overhead into a single figure makes comparison easy and analysis worse. A circuit with fewer qubits and deeper gates is not obviously cheaper than one with more qubits and shallower gates; it depends entirely on the error model. No error model was published with the preprint. No threshold analysis was released. Without those, the 1.5 billion figure is a claim, not a result.
Verify the timeline, not the ratio. The paper says nothing about when fault-tolerant quantum hardware arrives. Every estimate on that question — Google's, IBM's roadmaps, academic consensus — places a cryptographically relevant machine at least a decade out, with the honest error bars spanning to 2040 and beyond. Nothing in this preprint compresses that timeline. It compresses a theoretical cost.
Contrarian
The bulls got one thing right, and it is worth stating plainly: this paper is not a threat. Panic is the wrong response, and anyone selling you a hedge because of a preprint is selling narrative, not risk.
But the paper is a signal, and the signal points somewhere uncomfortable.
The real vulnerability it exposes is not in the curve. It is in the migration. There is no owner of the post-quantum transition on Bitcoin. Changing the signature scheme requires a soft fork with near-universal consensus, and the network's last several consensus attempts took years and occasionally failed outright. Ethereum moves faster, but Verkle trees address state commitment, not signatures — the signature layer is a separate problem and no EIP has been merged. Collateral is a lie; math is the only truth, and the math here says the migration window is measured in years while the migration process is measured in decades.
Note also who is writing this. Theta Labs operates a staking and validation network. Post-quantum readiness is existential to its own validator set. That does not disqualify the research. It contextualizes the incentive.
Takeaway
The 50% figure will be stripped from context and recycled for a week. It will move no price and change no architecture. What deserves attention is the question nobody in the paper addresses: who is accountable for the signature migration, and what is the deadline?
Watch three things. NIST's finalized post-quantum standards. Any Bitcoin Core or Ethereum Magicians proposal that actually specifies a replacement signature scheme. And a public repository that reproduces this paper's circuit. Until the third arrives, the proof is incomplete, and the doubt stands.
