The message landed at 2:14 a.m. It always does. Bad news keeps the same office hours as panic — late, unannounced, and wearing someone else's headline.
Someone in my Discord had pasted a line about researchers cutting in half the quantum resources required for a key operation in an attack on Bitcoin and Ethereum. Below it, three people had already typed their own versions of the same sentence: so it's getting close, then.
I didn't answer immediately. I opened a spreadsheet instead. In late 2017 I introduced fifteen friends to a project called MyToken, and I watched their savings evaporate in eleven weeks. I keep a list now — fifty dead projects, annotated with the exact rhetorical move each founder made before the exit. The list is not a hobby. It is an immune system.
Before I said anything to that channel, I did what I now do with every alarming number: I asked what the number counts, who counted it, and what they left outside the parenthesis. And here is what I found. The reporting I read did not name the researchers, did not link a paper, and did not say whether the work had passed peer review. That is not a reason to dismiss it. It is a reason to hold it at arm's length while we talk.
I am not owed their names. Anonymity is a shield, not a lifestyle — and in cryptography it has often been the shield that protected serious work from people who would rather harass the author than check the math. But a shield is only useful if you know what it is protecting. Here, we know almost nothing about what is behind it.
Because the headline says half. Everything else in this story is the definition of half.
The Context: What Is Actually Being Attacked
To understand what got halved, you have to be precise about what is under attack. Bitcoin and Ethereum both secure ownership with ECDSA over a specific curve called secp256k1. Your private key is a number; your public key is a point on that curve derived from it; and the security of the entire arrangement rests on the assumption that you cannot walk backwards from the point to the number. That backwards walk is called the elliptic curve discrete logarithm problem, or ECDLP, and for roughly three decades it has held.
Shor's algorithm breaks it. Not someday, not with caveats — mathematically, cleanly, given a large enough fault-tolerant quantum computer. Shor also breaks RSA, which is why quantum risk conversations usually open with RSA, and why the anchor number most people have memorized comes from Google's 2023 estimate: roughly twenty million physical qubits to break RSA-2048 in about eight hours. That figure became the yardstick. Almost every subsequent quantum progress headline is quietly measured against it.
Which is where the trouble starts, because that yardstick measures a different object.
The quantum register needed to attack RSA-2048 is about 2,048 bits wide. The register needed to attack secp256k1 is about 256 bits wide. Shor's circuit complexity scales with the size of the underlying field, which means attacking a 256-bit elliptic curve is structurally cheaper in qubits than attacking a 2,048-bit RSA modulus — not because ECC is weak, but because the problem is smaller. ECC was never chosen for quantum resistance. It was chosen because it delivers equivalent classical security with a fraction of the key size, and that efficiency is exactly what makes it a smaller quantum target.
So when a report tells you a new benchmark is less than half of Google's, you should immediately ask: half of which number, measuring which problem, under which assumptions? Comparing an ECDLP resource estimate to an RSA resource estimate and calling the difference progress is like comparing the fuel needed to drive to San Diego against the fuel needed to fly to Tokyo, and concluding that cars are getting faster.
The Core: What a Resource Benchmark Actually Counts
Here is where my audit experience is useful, even though I am not a quantum physicist. I spent years reading whitepapers for what they do not say, and resource estimation papers have the same tell as tokenomics papers: the definition does the work, and the definition is always in the appendix.
A quantum resource benchmark is not a measurement of any existing machine. It is a cost estimate for running an ideal algorithm on an ideal hardware model, usually expressed as a spacetime volume — physical qubits multiplied by runtime. To get there, you must assume an error rate per gate, a quantum error correction code, the code distance needed to suppress logical errors below a threshold, the speed of the classical control electronics, and the cost of magic state distillation for the non-Clifford gates Shor's algorithm requires. Change any one of those assumptions and the headline number moves by a factor, not a percent.
This is why I am not impressed by half. A two-fold reduction can be produced entirely at the circuit-design level. Windowed arithmetic reduces the number of modular multiplications by batching them into lookup tables. Better compilation shaves circuit depth. Sharper estimates of the physical-to-logical qubit ratio — the overhead of encoding one reliable logical qubit out of thousands of noisy physical ones — can move the total without a single new qubit being fabricated. Those are real contributions, and the researchers deserve credit for them. But they are contributions to the map, not to the territory.
And the territory has not moved. The best superconducting machines today hold on the order of a thousand physical qubits, with error rates around a part in a thousand. Fault-tolerant Shor at cryptographic scale needs millions of physical qubits running at error rates an order of magnitude or two better than that, plus control infrastructure that does not yet exist at any scale. The gap is not two. The gap is four orders of magnitude, and it is closed by engineering, not by arithmetic on paper.
The Accounting Problem: Why You Cannot Subtract These Numbers
Then there is the detail the original reporting did include, buried: the two sets of numbers were produced using different accounting methods. That single clause is the whole story, and almost nobody will read it.
I have seen this exact failure mode in DeFi. Every chain reports TVL. Every chain defines TVL differently — some count bridged assets double-counted at both ends, some count staked derivatives at face value, some quietly exclude the assets they included two quarters earlier. Lay the numbers side by side and you get a clean-looking chart of a comparison that was never valid. My rule from the audit years: two numbers produced under different definitions do not have a difference; they have an incompatibility.
When one group estimates a quantum attack using a surface code with a particular cycle time and another uses a different code family, different distillation assumptions, and a different treatment of classical control, less than half may still be true — and may still mean nothing about which estimate is closer to the physical world. The honest summary is that these are two different rulers, and one ruler is being photographed next to the other to make a headline. A reader who takes the comparison at face value has been handed a number with the units filed off.
The Permanence Problem: The Ledger Never Forgets
Here is the part that actually matters, and it is the part that almost never makes the headline. An attack on ECDLP does not require breaking into your wallet. It requires knowing your public key. And on a public blockchain, you have been publishing your public keys for years.
On Ethereum, any externally owned account that has ever sent a transaction has broadcast its public key to every node on the network. That exposure is permanent and unretractable. On Bitcoin, the picture is more textured. Legacy P2PKH outputs commit to a hash of the public key, so an unspent output stays relatively quiet — until it is spent, at which point the key is revealed forever. But P2PK outputs, the format used in the earliest blocks, expose the public key outright, at rest, permanently. And Taproot, which we celebrated in 2021 as an elegant upgrade, commits to an x-only public key directly in the output. Taproot moved key exposure earlier in the lifecycle, not later.
That was a trade we made knowingly, for cheaper script paths and better privacy in the happy case. It is also a permanent, ledger-wide archive of attack surface. The blockchain does not forget, which means the quantum clock started for a great many coins long before any quantum computer existed.
I raised this in a town hall during the winter of 2022, when nobody wanted to talk about anything except survival. A developer I was mentoring asked me why the industry was not already migrating. I gave her the honest answer: because migration is not a math problem, it is a bill, and nobody has agreed on who pays it. Community over coin, always — and this is the moment that axiom stops being a slogan and becomes a design constraint.
The Migration Bill Nobody Has Priced
Post-quantum cryptography exists. NIST finalized its first standards in 2024 — ML-KEM for key encapsulation, ML-DSA and SLH-DSA for signatures. The algorithms are not the bottleneck. The format is.
A secp256k1 signature is about 64 bytes. A Dilithium-class signature is roughly 2,420 bytes, with a public key around 1,300 bytes. Falcon is tighter on signatures but notoriously hard to implement safely. SPHINCS+ has tiny public keys and signatures measured in the tens of kilobytes. Now imagine every Bitcoin transaction carrying 2.4 kilobytes of signature instead of 64 bytes, inside a block budget designed in 2010, and imagine what that does to the fee market for anyone who is not a whale.
Worse, lattice-based signatures do not aggregate cleanly. One of the quiet miracles of the current system is that Schnorr signatures over secp256k1 can be combined — which is what makes MuSig, Taproot script trees, and much of Lightning's efficiency practical. There is no equivalent at scale for post-quantum signatures. Multisig gets expensive. Channel opens get expensive. Custody architecture gets rewritten. Hardware wallets, whose secure elements are sized around 32-byte keys, get redesigned from the silicon up.
And then there is governance. Bitcoin's last two major changes, SegWit and Taproot, took years of argument, several proposal formats, and a genuine near-schism before activation. A quantum migration would be larger, more urgent, and would carry a question no upgrade has carried before: what happens to the coins whose keys are already exposed and whose owners are gone? Satoshi's early outputs. Lost wallets. The million-plus coins in early P2PK outputs that nobody can move and everybody can see. A defensive fork would have to decide whether those coins are frozen, shielded, or left as a bounty for whoever gets a quantum computer first. That decision is not technical. It is political, and it will be the hardest conversation this industry has ever had.
The Contrarian Read
So here is my contrarian take, and it is not the one the headline wants. The number going down is not the alarming part. The alarming part is that a lower number changes nothing about anyone's incentive to move.
Quantum resource estimates are an argument about when. Migration is an argument about who. Every serious participant in this ecosystem — miners, core developers, exchanges, custodians, hardware vendors — has a reason to prefer that the migration happens after their own roadmap, their own funding cycle, their own competitive window. A benchmark that halves the estimated cost of an attack marginally increases the urgency of a task that has no owner. It is the equivalent of publishing a study showing your house will burn down sooner. It does not install the sprinklers.
I have watched this pattern twice in this industry. In October 2020, when the exploits hit, the reports were public within hours and the panic was public within minutes. What was scarce was a translation of those reports into something a non-technical member could act on. In 2022, when the market broke, the analysis was plentiful and the coordination was not. The scarce resource has never been information. It has been someone willing to own the unglamorous middle.
Quantum FUD is also a business model. It has been recycled on a roughly annual basis since at least 2017, and every cycle it arrives with the same shape: an alarming number, a wave of explainers, a bump in quantum-resistant tokens that turn out to be marketing, and a handful of short positions opened by people who understand the difference between a resource estimate and a working machine. I have no interest in punishing curiosity about quantum computing. I have a great deal of interest in noticing when fear is being packaged for sale, because fear is the one asset that has never needed a whitepaper.
And there is the part I actually lost sleep over in 2017. The human failure mode is not miscalculation, it is deferral. Nobody in my MyToken group was technically wrong about anything. They had simply decided that understanding the project could wait until after the price went up. The quantum risk to Bitcoin and Ethereum is real, distant, and structurally the same shape as every risk that has ever emptied a community wallet: it is a risk everyone can see and no one is paid to solve.
The Takeaway
If you want a single signal to track, do not track headlines about benchmarks. Track the boring instruments. Track NIST's post-quantum standards and their adoption timelines. Track whether Bitcoin or Ethereum core developers publish anything that resembles a migration proposal — not a forum thread, a proposal. Track whether hardware wallet vendors have announced secure elements that can hold a lattice key. Track what custodians say to their auditors about long-horizon key material. Those are the numbers that will tell you when this stops being an essay topic and starts being an engineering project.
My judgment, after twenty-one years of watching this space: a cryptographically relevant quantum attack on secp256k1 is a decade-plus risk, and a halved resource estimate does nothing to move that window. What it does do is remind us that the hard part was never the mathematics. The hard part is that security is not a number. It is a habit, maintained by people who agree to keep maintaining it long after the excitement ends.
Code is law, but people are the context. The mathematics will tell us exactly when the door can be opened. It will say nothing about whether we remembered to change the locks.
So when the next headline tells you the number went down — and there will be a next one — ask the question I taught my Discord to ask at 2:14 a.m.: who is telling me this, what exactly did they count, and what are they selling? Trust is the only protocol that matters. Everything else is a benchmark.
