Bitcoin's quantum-attack cost just fell 86%. The real story is the clock

An open research project called ECDSA.Fail just released a headline that, read naively, sounds terrifying: over roughly eight weeks, a team of human scientists working alongside AI coding agents cut the estimated quantum resources needed to attack Bitcoin's cryptography by 86.1%. I want to slow that number down, because the important part isn't the 86% — it's what kind of progress it represents, and what it does to a clock Bitcoin's governance was already struggling to beat.

What the 86% actually measures

The project, launched by Eigen Labs in late May 2026, combined more than 100 human scientists with AI agents that produced over 400 promoted submissions. What they optimized was a single arithmetic operation: elliptic-curve point addition, one of several steps inside the version of Shor's algorithm that could be run against the secp256k1 curve behind Bitcoin and Ethereum's signatures.

That distinction matters more than the headline. The contest's score was logical qubits multiplied by the average executed Toffoli gate count — a proxy for the space and work a future fault-tolerant machine would spend on this one step, not a working attack. Over the data cutoff on July 26, the best circuit fell from 2,715 to 1,151 logical qubits and from about 3.96 million to 1.3 million average gates — a 57.6% cut in qubits and a 67.2% cut in gates. And logical qubits are not physical qubits: each logical qubit needs many physical qubits for error correction, so nothing about the 1,151 figure implies hardware that small exists.

None of this is being fuzzy to bury the lede. It's the difference between "an attack is cheaper to design" and "an attack is imminent." The project itself says those are different things, and the difference is the part investors should actually weigh.

A twenty-year compression, now with agents

Set against the field, the number isn't a surprise — it's the latest rung on a very long ladder. When Google Quantum AI, the Ethereum Foundation, and Stanford published a hardware-referenced whitepaper in late March 2026, they described circuits needing under 1,200 logical qubits that could run on fewer than 500,000 physical qubits in minutes — fast enough, on one superconducting model, to sit under Bitcoin's ten-minute block window. That alone was roughly a twenty-fold cut in physical qubits from prior public estimates. Look back two decades and the contrast is starker: the estimated requirement has collapsed by about five orders of magnitude, from roughly a billion physical qubits in 2012 to low tens of thousands in the most efficient designs today.

ECDSA.Fail's results also came in roughly 50% below a comparable point-addition benchmark a Google team had published, though the organizers themselves caution the two aren't strictly comparable. So the notable part is not that this particular design is cheapest in some absolute sense. It's the mechanism and the speed. The researchers describe the AI agents as especially good at incremental optimization, testing, and combining existing ideas, while human scientists set goals, added mathematical knowledge, and reviewed the work. That is a research loop that compounds on itself — cheaply and in parallel — which is exactly why the design side of the problem is no longer the bottleneck.

The clock that matters isn't the hardware

The hardware side is still genuinely far away, just less far than it was. Count everything and the required resources sit roughly 10,000 times beyond today's best noisy machines; under Google's superconducting assumptions the gap is closer to 200 times in physical qubits, and under a neutral-atom alternative it narrows to about 10 times. Optimistic projections put a machine capable of breaking exposed keys somewhere in the early-to-mid 2030s.

That is why the real constraint is not the chip — it's Bitcoin's governance. Roughly seven million bitcoin, about 30% of the circulating supply, sit in legacy address formats that expose the public key on the blockchain, including Satoshi Nakamoto's dormant hoard of around a million coins. An exposed key is a one-way door: it can be recorded now and broken later, and no future action can hide it again. The standard fix, a proposal called BIP-360, hides public keys until a coin is spent, but that requires holders to move funds into new address formats — a migration that cannot be applied retroactively to coins that are already exposed.

Here is the structural mismatch. Bitcoin's governance is deliberately slow and stability-first, engineered to resist change — precisely the wrong shape for a deadline that is partly set by accelerating research. Ethereum, by contrast, has publicly committed to a quantum-resistance target of December 2029, with its own estimates putting about a one-in-five chance of a breaking machine arriving before 2030. Bitcoin has no comparable formal clock for the exposed third of its supply.

As a market matter, nothing about the preprint is an immediate price catalyst — bitcoin has been trading around $76,000, on a neutral fear-and-greed reading, and this week's announcement changes none of that. But for anyone treating bitcoin as a long-horizon store of value, it sharpens a real, asymmetric tail risk: it can only get worse for coins already exposed, its calendar is partly written by exactly this sort of self-accelerating research, and it cannot be fixed retroactively. The question worth holding isn't "is quantum here?" — it isn't. It's this: can Bitcoin move its exposed supply into protected address formats faster than the design curve keeps pulling a real attack closer?