They Pointed AI Agents at Bitcoin's Encryption. Eight Weeks Later, Cracking It Got 86% Cheaper.

Here’s the sentence that should make you put your coffee down:

The estimated quantum cost of attacking the encryption behind Bitcoin and Ethereum just dropped 86% in two months — and AI coding agents did a big chunk of the grinding.

Not in a lab in 2035. Not in a Google press release about a chip nobody outside Santa Barbara has touched. In an open, public, crowdsourced optimization contest that ran from late May to late July, where anyone could submit a better circuit and a verifier would score it automatically.

The paper went up on arXiv on September 10. Over 100 contributors are on it.

What Actually Got Broken (Spoiler: Nothing)

Let’s kill the panic headline before it spreads, because the researchers themselves went out of their way to kill it.

This is not an attack. Nobody cracked a wallet. No BTC moved. What the team optimized is one arithmetic step — elliptic-curve point addition on the secp256k1 curve — which is the inner loop that Shor’s algorithm would need to run, over and over, on a fault-tolerant quantum computer that does not currently exist.

Think of it as making one piston in an engine 86% more efficient. The engine still hasn’t been built. But the blueprint for the engine just got meaningfully cheaper.

The Numbers

The project is called ECDSA.Fail, launched by Eigen Labs on May 30, 2026. It used Google’s own publicly released verifier software to score submissions, which is what makes the comparison below interesting rather than marketing.

The metric is a combined score of logical qubits × Toffoli gates — roughly, “how much quantum machine do you need, and for how long.”

	Logical qubits	Toffoli gates	Score
Starting baseline (late May)	2,715	3,960,753	10.75B
Final, July 26 cutoff	1,151	1,299,453	1.496B
Post-cutoff improvements	1,321	under 1,000,000	~1.259B

That’s an 86.1% reduction against the project’s own starting point, in about eight weeks.

And the comparison everyone actually cares about: Google Quantum AI published a benchmark of roughly 3 billion in March 2026. The new figure is less than half that.

Translated into physical hardware — the number that matters for “when do we panic” — earlier estimates put a secp256k1 break at around 9 million physical qubits. This work suggests under 500,000. Call it a 20x haircut.

The Honest Caveats, Because We’re Not Doing FUD Here

The paper is unusually disciplined about what it does not show. Respect where it’s due:

• It covers one arithmetic operation, not a full end-to-end Shor’s implementation.
• It excludes physical error correction and hardware compilation — the two things that blow real quantum resource estimates up by orders of magnitude.
• Correctness was validated across 9,024 test cases, not mathematically proven for all inputs.
• A compatible windowed implementation needs 11 more logical qubits and ~30% more Toffoli operations.
• Google’s estimate used different accounting methods, so the authors explicitly framed the comparison as “numerical context” rather than a claim that they formally beat Google.

And the line that should end every quantum-FUD thread on X: no quantum computer in existence comes close to 500,000 physical qubits. Stanford cryptographer Dan Boneh, a co-author on the paper, has consistently argued for a measured migration rather than a fire drill.

So: not an emergency. But the trend line is the story, and the trend line only points one direction.

The Part That’s Genuinely New: AI Did the Boring Work

Every previous “quantum threat to Bitcoin” cycle was driven by a hardware announcement — a new chip, a new qubit count. This one wasn’t. This was a software optimization sprint, and the reason it moved this fast is that the contributors put AI coding agents on the treadmill.

Per the researchers, participants used AI agents to propose modifications, run tests, and document the approaches that failed. The direct finding: AI agents were “particularly useful for implementing and testing repeated incremental changes.”

The other finding is the one worth internalizing. The agents were most effective inside a collaborative human framework — not running solo. Humans set direction and judged the ideas; agents ran thousands of tedious iterations nobody wanted to do by hand.

That’s the actual headline for anyone building in this space: a hard, specialist, PhD-grade optimization problem got compressed from a multi-year research grind into an eight-week open bounty, because the boring 90% got automated.

Now apply that pattern to every other hard problem in crypto.

Why This Matters for Crypto Jobs

This is a hiring signal with a deadline attached, and the deadline is now public.

The migration clock is the job. The Ethereum Foundation is targeting a fully post-quantum L1 by December 2029, with the work starting in the Hegotá upgrade. Ship Glamsterdam in December 2026 and hit 2029, and you’re looking at an average cadence of roughly 7.2 months per hard fork — a schedule the researchers themselves admitted leaves almost no room for error. Schedules that tight get met by headcount or they get missed.

Bitcoin, by contrast, still has no shipped plan. Coinbase has estimated ~7 million BTC sit in addresses with exposed public keys. Jieyi Long, CTO of Theta Labs and lead author on the paper, put the stakes plainly: “the remedy takes years and cannot be applied retroactively.” You cannot patch a key that’s already public after the fact. That’s an engineering backlog measured in years, and nobody’s started.

Where the roles actually are. Look at who signed this paper: the Ethereum Foundation, Eigen Labs, StarkWare, Starknet Foundation, Brevis, Sei Labs, and Trail of Bits. That’s not an academic list — that’s a list of teams shipping production infrastructure, and every one of them now has a cryptography problem with a board-level timeline. Post-quantum signature schemes, lattice cryptography, formal verification, and audit work on migration paths are the roles that follow.

And the meta-skill: this project is a live demo that the engineers who know how to drive AI agents through a hard technical problem now move ~10x faster than the ones who don’t. Not “AI replaced the cryptographers” — the 100 humans were the point. But the cryptographer who can orchestrate agents through 10,000 failed circuit variants overnight is now worth several who can’t. If you’re a security or protocol engineer, that’s the thing to be visibly good at on your next application.

The quantum computer isn’t here. The hiring wave it triggers already is.

---

Looking for post-quantum, cryptography, protocol, or security roles in Web3? The teams racing a 2029 deadline are hiring right now. Find your next role at cryptogrind.com.