Author: Jieyi Long, CTO of Theta Labs

Today, we are releasing the ECDSA.fail preprint on arXiv, the first full account of what we believe to be one of the first large-scale open community effort to tackle a frontier problem in quantum computing through collaboration between humans and AI agents:

Read the full paper on arXiv.

The challenge tracks two important logical-circuit resources: how many qubits it needs (think of it as working memory) and how many Toffoli gates it runs (the expensive operations that do the real work). The benchmark multiplies them into a single spacetime score, Q × T, so a lower score means a better overall trade-off between qubits and expensive operations.

In roughly two months, more than 100 participants and their agents collectively produced a point-addition circuit for secp256k1, the elliptic curve used by Bitcoin and Ethereum. The circuit uses 1,151 logical qubits and 1.30 million Toffoli gates, giving it a Q x T score more than 50% lower than the result Google Quantum AI reported in March 2026. Because the interfaces and accounting conventions differ, this is a numerical comparison rather than a claim of formal dominance.

To the best of our knowledge, it is the lowest Q × T reported anywhere as of the paper's July 26 cutoff. A separate design optimized for fewer qubits reached 825, the lowest qubit count publicly reported at the time, though it needed many more Toffoli gates. 

To be clear, no machine today comes close to running such a circuit, but the hardware trajectory is encouraging: IBM targets 200 logical qubits by 2029, while recent advances in neutral-atom platforms, including QuEra and Oratomic, open a path toward thousands of fault-tolerant logical qubits by the end of the decade.

But the numbers are only half the story. Why does this one circuit matter, and how did we get here?

Why One Point-Addition Circuit Matters to Q-Day

A sufficiently large and reliable fault-tolerant quantum computer could run Shor’s algorithm to solve the elliptic-curve discrete logarithm problem underlying ECDSA, the signature scheme used by Bitcoin, Ethereum, and many other blockchains. For these networks, the consequence is concrete: once a public key is exposed, such a machine could in principle recover the corresponding private signing key and forge transactions. We use Q-Day to refer to the arrival of a cryptographically relevant quantum computer capable of breaking public-key cryptography deployed in real-world systems.

Q-Day has not arrived, and its timing remains uncertain. Migration, however, cannot begin only after such a machine is demonstrated. Updating blockchains, wallets, custody systems, smart contracts, and hardware infrastructure will require years of coordinated engineering. More accurate resource estimates, which ECDSA.fail seeks to improve, help the community assess the remaining technical margin and plan that transition before the threat becomes operational.

A major cost driver in Shor’s elliptic-curve computation is point addition, a basic arithmetic operation repeated many times throughout the algorithm. Its logical-qubit width and Toffoli-gate cost materially affect the resources required by the larger Shor computation. ECDSA.fail isolates and optimizes this primitive. It does not break Bitcoin or implement a complete fault-tolerant attack; it measures and optimizes how efficiently one important component of the required quantum machinery can be constructed.

The Circuit Google Proved but Did Not Publish

In March 2026, Google Quantum AI and its collaborators reported a dramatic improvement in the estimated resources required for Shor’s algorithm against elliptic-curve cryptography, presenting a low-width point-addition circuit with at most 1,175 logical qubits and 2.7 million Toffoli gates, and a low-gate alternative with at most 1,425 qubits and 2.1 million Toffoli gates. The team took an unusual route: it disclosed resource thresholds and a zero-knowledge proof that a qualifying circuit existed, but did not publish the circuit itself. The research community could verify the claim without learning the exact construction.

The mystery did not last in the form many expected. The core record-and-replay technique (a.k.a. dialog-GCD) behind the advance was introduced by Tanuj Khattar and Craig Gidney in 2025. In early June 2026, André Schrottenloher published an open construction that adapted it to elliptic-curve point addition, recovering the principal direction behind Google's result. At the same time, the verifier released with Google's zero-knowledge proof created an unexpected opportunity. A verifier that answers two questions, whether a candidate circuit is correct and how many resources it uses, is also an unusually clean objective for autoresearch.

From a Public Verifier to Open Autoresearch

In May 2026, Gautham Anant from Eigen Labs turned that opportunity into a working benchmark. He built a benchmark which accepted a point-addition circuit, tested that it correctly computed point addition, and then reported its resource requirements (peak logical qubits and average executed Toffoli gates). He then connected coding agents to the loop: study the literature, inspect the circuit, propose a change, compile it, run the evaluator, and repeat.

The initial internal agent-assisted effort made substantial progress and then reached a plateau. By the beginning of June 2026, Eigen Labs decided to open the repository, evaluator, and leaderboard so that anyone could bring a different model, prompt, harness, research context, or optimization strategy. IEEE Spectrum later reported that the crowdsourced effort matched Google's displayed result within eight hours and surpassed its reported Q x T score within roughly 72 hours.

This became Open Autoresearch: a paradigm in which humans and AI agents address optimization problems by publishing evaluator-verified improvements to a public leaderboard. Independent human-agent teams could begin from the current leader, another Pareto point, or an off-frontier design. Each person, agent, or team could use their own models, prompts, tools, and budgets, then submit candidates to the same machine-checkable evaluator. Verified improvements became public bases for the next experiment. Source changes, submission notes, and documented failures formed shared research memory that allowed progress to accumulate across agents and participants.

Unlike a centrally managed agent run, Open Autoresearch does not assume that one model or harness can explore the entire search space. The evaluator supplies a stable verification boundary, while openness turns differences in expertise, tooling, and circuit architecture into parallel research paths. When one path stalls, another can advance and publish a new starting point for everyone. This was the founding bet behind ECDSA.fail: make every claim executable, preserve the public record, and let many independent human-agent teams build on one another's verified work.

The Crypto Community Did Not Wait on the Sidelines

The challenge quickly expanded beyond its founding team. Eigen Labs initiated ECDSA.fail and developed the benchmark, agent harness, public repository, and leaderboard that enabled participation at scale. This open structure drew contributors affiliated with the Ethereum Foundation, Starknet Foundation, StarkWare, Theta Labs, Brevis, MultiVM Labs, Octav, Trail of Bits, Pauli Group, ScienceVR, and Sei Labs, as well as researchers from Adam Mickiewicz University in Poznań, Warsaw University of Technology, and Stanford’s Free Systems Lab. Together with many independent participants, this community contributed circuit designs, optimization techniques, validation, technical analysis, manuscript development, and agent workflows.

For the cryptocurrency community, quantum computing poses a direct threat to blockchains secured by elliptic-curve signatures. This shared urgency encouraged Web3 researchers and engineers to move beyond observing quantum advances and help measure the threat directly. ECDSA.fail provided neutral infrastructure where expertise in cryptography, zero-knowledge systems, quantum circuits, software engineering, and agent orchestration could converge around verified improvements.

The project also attracted attention beyond its participants. Ledger CTO Charles Guillemet highlighted an early frontier result, while Circle later included ECDSA.fail in its analysis of the evolving quantum risk to blockchain systems.

What the arXiv Paper Establishes

A New Point Addition Frontier

At the paper's July 26 cutoff, the leading product-score circuit used 1,151 logical qubits and 1,299,453 average executed Toffoli gates. Its Q x T score of approximately 1.496 billion was 86.1 percent below the 10.75-billion baseline. Under their respective reporting conventions, the circuit's displayed product is more than 50% below Google's low-gate point, and its qubit and Toffoli values are below the cited Google and Schrottenloher operating points. Because the interfaces and accounting rules differ, the paper treats this as numerical context rather than formal dominance.

The paper doesn't stop at the benchmark. The original challenge circuit is handed one of its two input points as a plain classical value, but a real windowed Shor attack cannot do that: it must pick that point, in quantum superposition, from a lookup table. In effect, the challenge lets the circuit take a shortcut a real attack could not. So the authors built a shortcut-free variant that works in the real setting, at a modest extra cost: 1,162 qubits, just 11 more than the original, and about 30% more Toffoli gates. On 100,000 independently generated inputs it succeeded 99.809% of the time, essentially matching the original circuit and showing that the approach still holds without the shortcut. A complete Shor implementation, which chains 28 calls to this kernel, remains future work.

Other branches reveal a broader Pareto frontier. The cutoff low-width circuit reached 825 qubits by accepting approximately 489 million Toffoli gates, and a later submission reported 813 qubits. The post-cutoff ping-pong GCD algorithm reached 1,321 qubits and 952,707 Toffoli gates, reducing the Q x T product to approximately 1.259 billion.

How the Circuit was Optimized Over Time

Progress came through two complementary modes. Hundreds of incremental changes followed a simple principle: don’t pay to store or compute information you don’t need. If a value can be recomputed when needed, don’t keep it in quantum memory. If a calculation is known to have no effect, skip it. And when one value shrinks while another grows, reuse the space that has just been freed. The largest advances went further, structurally redesigning how the circuit performed, recorded, and reversed its most expensive arithmetic.

Under the hood, these ideas led to increasingly sophisticated circuit designs. Early work packed temporary data more tightly and recomputed values instead of storing them. Later designs changed the modular-inversion algorithm itself, compressed the information needed to reverse the computation, and aggressively reused qubits across different stages. These structural changes opened new resource regimes that hundreds of smaller refinements could then exploit.

For readers who want the specifics, Jump-2 groups consecutive Euclidean operations into larger steps, reducing comparisons and swaps. A base-5 codec compresses the five reachable transcript symbols, while streamed replay stores the computation’s history only as space becomes available. Register-shared inversion lets shrinking values lend their qubits to growing coefficients. Specialized Karatsuba squaring exploits the pseudo-Mersenne form of the secp256k1 prime, while constant propagation removes arithmetic made unnecessary by known classical zeroes.

After the paper’s cutoff, the ping-pong GCD circuit introduced another structural redesign. It replaced full-width comparisons and conditional swaps with fixed alternating updates selected from low-order bits. The design uses more qubits to record the computation’s path but makes its replay substantially cheaper, producing the challenge’s first circuit below one million average executed Toffoli gates.

A Milestone Not a Finish Line

Join the ECDSA.fail challenge and bring your own model, tools, or agent harness to the frontier. The challenge is still running, new circuits are still being submitted on a daily basis either further bringing down the Q x T score, or adding new points to the (Q, T)-Pareto frontier. The same open-autoresearch model now reaches beyond quantum circuits through Eigen Labs' Yukon initiative, which opens measurable frontier problems in machine learning, cryptography, mathematics, and systems research to networks of humans and AI agents.

Read our arXiv paper, inspect the source repository, and explore the circuit analyses and reconstruction artifacts in the supplemental-materials repository.