The cost of quantum attacks plummeted by 86%, and the Bitcoin migration window narrowed

According to Woofun AI, a paper published on September 9 revealed that more than 100 researchers used AI coding agents to drastically reduce the critical resource score for quantum attacks against Bitcoin by 86.1%.

This development does not mean that private keys have been recovered or that Bitcoin has been breached, but rather it confirms that software optimization alone can significantly reduce the quantum resources required for elliptic curve computation. The core contradiction is that every technological breakthrough to reduce the cost of quantum attacks is reducing the time window for Bitcoin and other blockchains to secure transition to post-quantum cryptography, so that although the threat of Q-Day did not come immediately, the security buffer period is being drastically shortened.

The ECDSA.fail challenge, launched by Eigen Labs at the end of May, aims to improve the efficiency of secp256k1 point plus circuits. The scoring criteria are 'maximum number of logical qubits × number of Toffoli gates executed average'. That rating plummeted from the initial 10.75 billion to 1,496 million on July 26. Among them, the most efficient solution used 1,151 logical qubits and about 1.3 million Toffoli gates. Subsequent designs pushed the number of doors below 1 million, requiring only 813 qubits. The researchers emphasized that this was verifying mathematical viability rather than attacking wallets.

According to data compiled by Woofun AI, IonQ (IONQ.US)'s end-to-end estimates indicate that the complete attack required 1,457 logical qubits and 39 million Toffoli gates, corresponding to 19,397 physically trapped ion qubits, which took about 25.7 days, in line with its hardware plan around 2028. In contrast, Google (GOOGL.US) researchers calculated an efficient attack requiring 1,200 logical qubits plus 90 million Toffoli gates, or 1,450 logical qubits plus 70 million gates; with the support of the superconducting model, the circuit can operate within minutes, requiring less than 500,000 physical qubits.

Although ECDSA.fail only optimizes points and subroutines, and fault-tolerant hardware has yet to be introduced, this data comparison clearly outlines the trajectory of technological evolution.

Glassnode data revealed that approximately 6.04 million BTC are at risk of quantum attacks, accounting for 30.2% of the current supply, as their public keys have been made public on the chain. Of these, 1.92 million BTC were exposed in the export category, and 4.12 million BTC were exposed due to behavioral aspects such as address reuse. What's more serious is that the public key that was originally hidden when spent is instantly revealed. Theoretically, a computer that is fast enough can calculate the private key before the transaction is confirmed. The new pay-to-merkle-root output type introduced by BIP 360 eliminates the quantum threat of Taproot key path costs, but it cannot solve the short-term risk after the transaction enters the memory pool, and there is no automatic migration mechanism. The quantum-secure Bitcoin transaction demonstrated by StarkWare on the main network requires several hours of off-chain GPU computation, uses a non-standard miner's direct connection path, and cannot protect coins with exposed public keys. StarkWare CEO Eli Ben-Sasson pointed out that Avihu's breakthrough provided psychological comfort and breathing space rather than an antidote, and he still favors agreement-level solutions.

The governance dilemma has become an even greater challenge. The Coinbase (COIN.US) Independent Advisory Committee on Quantum Computing and Blockchain reports that approximately 1.7 million BTC are scattered across about 20,000 early P2PK public keys and stored in wallets believed to be controlled by Satoshi Nakamoto or those who have lost access. Setting a migration deadline may cause these coins to be frozen or at risk of being stolen by hacking. Ethereum plans to fully achieve quantum resistance at the implementation, consensus, and data levels by December 2029, and prepare for Q-Day as early as 2030; the G7 Network Expert Group called for collaboration in the financial sector to advance post-quantum migration. Bitcoin must deal with market risks before it actually faces quantum threats. In particular, the vagueness of the migration process, escrow method, and dormant coin processing may cause systemic trouble long before secp256k1 is cracked.