Two researchers have cut the quantum resource benchmark for attacking Bitcoin and Ethereum signatures in half. The result lands below half of Google's earlier published figure. No quantum computer was built. No key was recovered. No peer-review status was disclosed in the report itself — and the researchers are not named in the version circulating.
Within hours, that single word — halve — gets screenshotted, stripped of context, and reposted as "quantum attack just got twice as easy."
It didn't. I've watched this cycle before. A theoretical number moves, the headline implies a hardware breakthrough, retail sells into a thin bid, and three days later nobody remembers the citation. I spent my early career tracing deployment logs on Etherscan at 3am for exactly this reason: the number is never the story. The accounting method behind the number is.
So, before anything else: what moved is an estimate of the resources an attack would require. It is not a measurement of the resources an attacker has. Two different clocks. Only one of them is ticking. — Root: The ESTP
Context: the attack path nobody disputes
The attack path isn't mysterious. Bitcoin and Ethereum sign with ECDSA over the secp256k1 curve. The security assumption is that recovering a private key from an exposed public key requires solving the elliptic curve discrete logarithm problem — ECDLP. Shor's algorithm solves that class of problem efficiently, given a sufficiently large fault-tolerant quantum computer. That has been true in theory since 1994.
What shifts year to year is the resource estimate: how many physical qubits, how much runtime, how much error-correction overhead. The standard unit is spacetime volume — qubit count multiplied by execution time. Google's work on RSA factoring set the reference point the industry keeps quoting.
Two details in the new result matter more than the headline figure.
First, the report states that the two estimates use different accounting methods. That is not a footnote. If one paper counts physical qubits and the other counts logical qubits folded through a surface-code cycle budget, the ratio between them is arithmetic theater. Comparing them is comparing a shipping weight to a volumetric weight.
Second, the attack surface is narrower than the panic implies. Shor's algorithm needs a public key. Bitcoin does not expose public keys for standard P2PKH outputs until spend — the chain stores a hash of the key, not the key. The genuinely exposed set is specific: P2PK outputs from the earliest era, reused addresses, and every Ethereum account, which reveals its public key on the first outbound transaction.
That nuance never survives the headline. Cheetah.
Core: what "exposed" actually means
Let me be concrete about the risk map, because it's the whole ballgame. This is a scan I've run in variations for years:
revealed = {} # pubkey_hash -> pubkey first seen on-chain
for txin in confirmed_inputs:
pk = extract_pubkey(txin.witness or txin.script_sig)
if pk is None:
continue
h = hash160(pk)
if h in revealed and revealed[h] != pk:
flag("key reuse: pubkey now permanently recoverable")
revealed[h] = pkThe output of that loop is your real quantum-risk map. Not "Bitcoin." A specific, countable subset of UTXOs whose keys are already public — plus every Ethereum EOA that has ever sent a transaction.
Now the resource side.
A logical qubit is not a physical qubit. Fault-tolerant Shor requires error-corrected logical qubits, each built from hundreds or thousands of physical qubits under a surface code. The conversion ratio is the entire cost of the attack, and it's where estimates diverge most violently.
Steady improvements in these estimates come from three places: windowed arithmetic that reduces the number of modular multiplications, cheaper modular-multiplication circuits, and tighter surface-code cycle counts. All three are compiler and circuit-design work. None of them require a new physics result. That's my read on where the halving came from — mid-confidence, since the underlying paper isn't public yet.
Here's the part the coverage skips: halving a logical resource estimate does not move the fault-tolerance wall. We do not have a fault-tolerant quantum computer at any scale. Every projection still assumes one exists, plus a quantum error-correction regime stable enough to run Shor's circuits for hours without decoherence.
So the honest translation of "half the resources" is: the theoretical cost of an attack built on hardware that does not exist improved by a factor of two, using a methodology that may not be directly comparable to the benchmark it's being compared against.
That is a real result in cryptography. It is not a change in your risk this quarter.
One more thing. The paper optimizes an attack on secp256k1. It says nothing about BIP-340 Schnorr, nothing about threshold signatures, nothing about the PQC signature schemes already in NIST's pipeline. The blast radius of this news is narrower than the blast radius of the threat.
And treat the sourcing with the skepticism it deserves. The researchers are unnamed in the circulating report. There is no stated peer-review status. Google's benchmark is public, citable, and reproducible; the thing being compared to it is not, yet. A number that cannot be reconciled line by line is a claim, not a result.
Contrarian: the hard part was never the qubits
The unreported angle isn't technical. It's governance.
Assume, for argument's sake, the estimate is right and the methodology is sound. Then ask the question nobody asked: could Bitcoin migrate to post-quantum signatures? Not "would it be good" — could it. SegWit took years of acrimony. Taproot took three years from proposal to activation. A PQC migration touches consensus rules, miner incentives, exchange deposit infrastructure, hardware wallets with fixed secure elements, and multisig custody arrangements at every institution that holds client keys.
The coordination problem is the hard part. Every hardware wallet in circulation would need a firmware path or replacement. Lightning channels would need renegotiation. Custodians would need new key ceremonies. That timeline is measured in years, not in qubit counts.
Meanwhile the number that actually matters on the calendar isn't a preprint — it's NIST's post-quantum standardization output and the migration guidance layered on top of it. That's the signal with a delivery date. This paper has no delivery date.
Quantum FUD has been recycled as a shorting excuse since 2017 — I've watched at least four of these cycles. Each one faded inside a week, because the underlying engineering constraint never changed. This one will fade too, unless someone ships a fault-tolerant machine.
And I'll say the uncomfortable part: an anonymous researcher, an undisclosed review status, and a headline number explicitly built on a different accounting method than its comparison point is not a finding you can underwrite. It's a finding you can cite. Different verbs. Cheetah.
Takeaway
Watch three things, in this order. Whether the paper lands on arXiv with named authors and a reproducibility appendix. Whether anyone independent reproduces the accounting reconciliation against Google's benchmark. And whether NIST's PQC timeline accelerates — because if a real quantum deadline existed, the standardization bodies would be the first to move, not the last.
The number halved. The clock didn't. — Root: The ESTP
