A new paper cuts the estimated resource cost of breaking secp256k1 — the elliptic curve guarding nearly every Bitcoin and Ethereum private key — by more than half. The composite resource score falls from roughly 3 billion to roughly 1.5 billion. The optimized circuit needs about 1,151 logical qubits and about 1.3 million Toffoli gates.
Every headline I have read reports the first number and deletes the second. "Attack cost down 50%" is arithmetically correct and analytically hollow. It is the same category of error as quoting a gas fee without the gas price. A cost curve and a feasibility curve are not the same curve, and conflating them is how a research note becomes a panic candle.
Context: who wrote it, and what it actually changes
The provenance matters as much as the result. The author list carries affiliations from Theta Labs, the Ethereum Foundation, and StarkWare — a proof-of-stake data network, the largest smart contract ecosystem, and the leading ZK-Rollup team, in one paper. That is not a fringe group publishing on a preprint server at midnight.
The mechanism: Shor's algorithm, executed on a fault-tolerant quantum computer, solves the discrete logarithm problem in polynomial time. Elliptic curve discrete logarithms are precisely what make a public key safe to broadcast. secp256k1 is the curve BTC and ETH both use.
What the paper does is narrow. It optimizes point addition — the heaviest arithmetic block inside the Shor circuit for ECDLP — at the gate level. It builds no hardware. It does not remove the requirement for a fault-tolerant machine. It makes the offline algorithm cheaper. Algorithm optimization and hardware progress are two independent curves, and they compound. That is the whole finding.
Core: the unit behind the number
The number that matters is not 1,151. It is the ratio hidden behind it.
Logical qubits are the error-free abstract qubits an algorithm is written against. Physical qubits are what exist in hardware. Encoding one logical qubit requires many physical qubits bound together through quantum error correction. At today's error rates, surface-code-style overheads run in the hundreds to thousands per logical qubit. Multiply 1,151 by that overhead and you land back in the hundreds of thousands to low-millions of physical qubits, all of them operating below the error-correction threshold.
Current NISQ hardware sits at hundreds to low thousands of physical qubits, at error rates that are not below threshold. The gap is orders of magnitude, not percentages. Half of a very large number is still a very large number. The 1.5 billion composite score is a spacetime resource metric — qubit count multiplied by gate count and time. Halving it is real efficiency work. It does not shorten the timeline, because the timeline is gated by hardware, not by the algorithm.
I have watched this specific failure mode before. In 2020 I pulled Aave's liquidity pool metrics directly from Ethereum state and found a 12% deviation in interest accrual against the public dashboard. The cause was a rounding error in the oracle feed. The dashboard was smooth; the chain was not. I wrote up twenty pages and submitted it to the governance forum, and the protocol patched it. The lesson holds here: raw state reveals truth before dashboards do. The raw unit is logical qubits. The dashboard says "50% cheaper."
The blockchain-specific exposure diverges from every other cryptography discussion. In TLS, an adversary can harvest now and decrypt later — store ciphertext, wait, cash out years from now. Blockchains need no harvesting. The public keys are already on-chain, permanently, and there is no rotation primitive.
BTC: Pay-to-Public-Key outputs. Early block rewards, including the coins attributed to Satoshi, have never moved. Their public keys sit exposed in the script. No reuse, no rotation, no defense. Legacy P2PKH addresses are structurally safer if never spent from — an unspent address holds only a hash of the public key, and hash preimage is a different, harder problem. Spending once converts that buffer into exposure.
ETH: no such buffer exists. Every account that has ever signed a transaction exposed its public key in that signature. That is effectively every active account on the network. The account model has no equivalent of address hygiene.
This is not a vulnerability disclosure. Nothing is broken today. My point is narrower and harder: the exposed surface is already fixed and already permanent. Migration — not computation — is the binding constraint.
Contrarian: the market is watching the wrong curve
Consensus reaction to this paper will be wrong in one of two directions. The panic camp reads "50%" as "soon." The dismissive camp reads "logical qubits" as "irrelevant." Both skip the variable that actually moves.
That variable is migration latency. The co-author — Jieyi Long, CTO of Theta Labs — stated plainly that this is not an imminent threat. A researcher attached to an entity with a commercial interest in a security narrative declined to inflate it. That restraint is a data point. Trust is a variable, data is a constant, and the constant here is that post-quantum migration takes years and becomes irreversible the moment an attack is viable.
NIST has already standardized Kyber for key encapsulation and Dilithium for signatures. Traditional finance has started deploying them. Public blockchains, largely, have not.
BTC migration difficulty: high. PQC signatures require a consensus-level change, and Bitcoin governance is designed to minimize consensus-level change. A soft fork path exists, but it is contentious. Watch the developer mailing list, not the timeline.
ETH migration difficulty: lower. The EIP process is more flexible, and Ethereum Foundation researchers are on this paper's author list — which tells you the agenda is already live inside the ecosystem.
The transmission terminal is downstream: exchanges, custodians, wallet providers. Their key management is where this becomes a business continuity question rather than an academic one. If a custodian's hot wallet signs with ECDSA over secp256k1, that is a procurement problem waiting for a deadline.
One more piece of provenance. Theta Labs issues THETA. StarkWare issues STRK. That does not invalidate the research — the circuit optimization is checkable and the institutions are serious. It does mean the publication is a data point with an origin, and origin belongs in the analysis.
Takeaway: four signals to monitor, not one headline
Physical qubit counts and error rates from IBM, Google, and Quantinuum. The threshold that matters is the point where error-corrected logical qubits become cheap, not the point where a press release says they exist.
Ethereum Foundation research posts and EIP drafts on PQC signature schemes.
Bitcoin developer mailing list activity around PQC migration proposals.
Wallet and custodian changelogs. The first real-world post-quantum migration will surface there, buried in a release note, long before any announcement.
Yields that defy gravity usually crash to earth. So do attack cost estimates. This number will fall again. The open question is not whether the estimate gets cheaper — it is whether the migration starts before the last digit does.