The Quantum Discount: Reading the 50% Cost Reduction in Shor's Algorithm for Bitcoin and Ethereum

I keep a whiteboard in my office with four words on it: logical does not equal physical. It has survived three office moves and two market cycles. I wrote it in 2019, in a conference room in Chicago, for a group of portfolio managers who wanted a date. They wanted a countdown clock. I gave them a ratio instead, and watched the room go quiet in that particular way rooms go quiet when the answer is that the question was malformed. Last week the ratio moved again. A paper co-authored by researchers at Theta Labs, the Ethereum Foundation, and StarkWare reported a substantial reduction in the estimated resource cost of mounting a Shor's algorithm attack against secp256k1 — the curve underneath both Bitcoin and Ethereum. The composite score fell from roughly three billion to roughly 1.5 billion. The circuit needs about 1,151 logical qubits and roughly 1.3 million Toffoli gates. Half the people who saw that headline read it as the attack is closer. They are right, and they are wrong, and the distance between those two readings is where all of the actual security work lives. Here is the machinery. Bitcoin and Ethereum secure ownership with elliptic curve cryptography over secp256k1. Your private key is a scalar. Your public key is a point on the curve. Deriving the point from the scalar is cheap. Reversing it is the elliptic curve discrete logarithm problem, and it is believed to be infeasible for classical machines. Shor's algorithm dissolves that assumption — on a fault-tolerant quantum computer, ECDLP falls in polynomial time. But Shor's algorithm is not a click. It is a circuit with a register budget, an instruction count, and a critical path. The heaviest subroutine inside the ECDLP variant is point addition: the group arithmetic that accumulates partial sums within the quantum Fourier transform structure. Every improvement to point addition is an improvement to the whole attack. That is what this paper optimized — arithmetic, not architecture. The institutions behind it are serious. Ethereum Foundation research, StarkWare, and Theta Labs CTO Jieyi Long is the kind of author list that gets read carefully by people whose job is to read things carefully. Long said, in plain language, that this is not an imminent threat. That sentence is the most important sentence in the release. It is also the sentence every aggregator deleted. So let me situate it in a longer arc. Google Quantum AI's earlier resource estimates put the attack in a comparable order of magnitude. Those estimates have been falling steadily for years, for the boring reason that quantum algorithm researchers keep finding better circuit constructions. This is the normal shape of progress in a maturing field. It is not a warning siren. It is the sound of people doing their jobs. I began my career doing line-by-line audits of crowdsale contracts, and I learned early that the scariest number in a security report is rarely the one that gets quoted. The scariest number is the one nobody quoted because it complicated the story. The first number: 1,151 logical qubits. A logical qubit is an ideal qubit — error-free, stable, the kind that exists in the math and not in the lab. A physical qubit is what you can actually build. Quantum error correction bridges them, and the bridge is expensive. Encoding one logical qubit at a useful error rate can consume hundreds to thousands of physical qubits depending on code distance and achievable gate fidelity. Multiply 1,151 by even a conservative few-hundred-to-one overhead and you are in the hundreds of thousands. Multiply by a pessimistic overhead and you sail past a million. This is the number that matters, and it is missing from the headline. Current hardware sits in the NISQ era — noisy, intermediate-scale, hundreds to low thousands of physical qubits with error rates that make deep circuits a fantasy. The gap between noisy hundreds and corrected low millions running a 1.3 million Toffoli circuit is not a gap you close with a good quarter. It is a gap measured in generations of engineering. The reduction is real. The threshold is untouched. Those two facts coexist, and any analysis that collapses them is doing narrative, not security. The second number: 1.3 million Toffoli gates. Toffoli gates are the workhorse of reversible quantum arithmetic — a controlled-controlled-NOT, effectively the standard unit for measuring circuit complexity in this literature. 1.3 million of them is an enormous number of coherent operations to run without decoherence eating the result. Gate counts like this are why fault tolerance is non-negotiable. You cannot run this circuit on a machine that leaks. This single figure tells you more about the true timeline than the composite score does. The third number: three billion down to 1.5 billion. Composite scores in this literature typically compress qubit count, gate count, and often time into a single spacetime-resource figure, so competing constructions can be compared apples to apples. Halving it means the attack became twice as efficient in resource terms. That is a genuinely strong result for a paper that touched only one subroutine. But hold onto this: an efficiency improvement to an infeasible attack is still an infeasible attack. You can cut the cost of a moon landing in half and you have not built a rocket. Now the part that keeps me up. Security cost and attack cost are not the same shape, and this is the single most under-discussed fact in the entire quantum-and-crypto discourse. An attacker needs to break one key. The defender needs to migrate every key. That is a one-versus-all asymmetry, and it means the migration deadline is not set by the arrival of the hardware. It is set by the departure of the last vulnerable key. Bitcoin and Ethereum are not equally exposed, and the difference is structural rather than quantitative. Ethereum uses an account model. The moment an account signs a transaction, its public key is on chain, permanently, in the history. There is no clean state to retreat to. Every externally owned account that has ever transacted has a public key that is now a matter of public record, and deriving the private key from that public key is precisely the ECDLP problem Shor's algorithm solves. Once the capability exists, exposure is retroactive. Bitcoin has a partial buffer, and it is only partial. In modern address formats, the public key is hashed and hidden until you spend. If you never reuse an address and never spend from an address with a weak script type, you retain a degree of protection. But early P2PK outputs — pay-to-public-key, where the key is embedded directly in the script — have their public keys permanently exposed the moment they landed on chain. That includes the coinbase outputs generally attributed to the earliest mining era. If a cryptographically relevant quantum computer ever exists, some of the oldest and most famous coins on the network are the first candidates, and no amount of good hygiene by anyone alive today can retroactively fix that. That is not a hypothetical about user behavior. It is a property of the ledger. In the classical world, harvest-now-decrypt-later applies to encrypted traffic: an adversary records ciphertext today and decrypts it when quantum hardware matures. Blockchain is worse in a specific and underappreciated way. There is nothing to harvest. The public keys are already sitting on chain, in plaintext, in the historical record, waiting. No storage operation is required. The adversary's job is not capture; it is simply the arrival of capability. That distinction should change how you think about the timeline, because it removes an entire phase of the attack that people instinctively include in their mental models. There is no collection window. There is only the compute window. Post-quantum signature schemes — the lattice-based constructions standardized through NIST's process, like the Dilithium family — are not drop-in replacements. Signatures are substantially larger. Verifiers are more expensive. For a chain with constrained block space and a fee market that prices bytes, larger signatures are not a footnote; they are a redesign. Add the governance layer and the difficulty compounds. Ethereum can move through the EIP process with a comparatively flexible upgrade path. Bitcoin's rough consensus is a feature, and it is also what makes a hard-fork-level cryptographic migration an extraordinarily heavy lift. The two chains have nearly identical cryptographic exposure and radically different ability to respond to it. I spent three months in 2022 reverse-engineering the UST de-peg, building simulation models to show that the failure was structural rather than sentimental. The lesson I carried out of that work is not about stablecoins. It is that systems fail in the places where their response mechanism is slower than their exposure surface. Bitcoin and Ethereum are both sitting inside that shape right now, and only one of them has a realistic near-term path to changing it. Concretely, if I were asked to audit this tomorrow, I would inventory legacy P2PK exposure at the custodian and exchange level; I would ask for signing-infrastructure roadmaps that name a migration path rather than a buzzword; I would check whether threshold and multi-party schemes have quantum-resistant variants in scope. And I would ask the unpopular question: can this organization's key material be regenerated at all, or is some fraction of it structurally fixed? Most audits stop at the boundary of can this be fixed. The quantum question is the rare case where the honest answer is sometimes not for these keys. The quantum threat does not arrive at the consensus layer first. It arrives at the edges — at custodians, exchanges, and wallets, the places that hold keys on behalf of people who will never rotate them. A defunct exchange's cold wallet. A custody provider's signing infrastructure. A hardware wallet whose firmware has no post-quantum signature path. Consensus security is the abstract risk; key management is where it becomes operational. And here is the operational trap. You cannot rotate a key that has already been exposed. Rotation is the standard remedy in every other security domain, and it is precisely the remedy blockchain cannot apply retroactively. That is the crux of the whole problem, and it is why the migration clock and the hardware clock are racing on different tracks. There is also a connection nobody made explicitly. StarkWare's involvement is not incidental. Zero-knowledge systems and post-quantum cryptography share underlying assumptions in several constructions; parts of the ZK research stack rest on hardness assumptions believed to resist quantum attacks. A ZK leader co-authoring a paper on Shor's resource costs is a signal about strategic positioning, not just academic curiosity. The teams building today's privacy infrastructure are quietly building tomorrow's quantum-resistant infrastructure, and they know it. Now let me turn this over and look at the underside. The near-term risk is not the attack. It is the misreading of the attack. Every time a resource estimate falls, the same cycle runs: a headline compresses cost of an infeasible attack declined into attack is coming, social feeds amplify, and a handful of tokens with quantum-resistant in their marketing copy catch a bid. The most dangerous artifact produced by a quantum paper is not a cryptanalytic breakthrough; it is a narrative that outruns the cryptography by an order of magnitude. Watch for that. Specifically, watch for projects claiming quantum resistance without citing which standardized scheme they deployed and how. Quantum-resistant has become an adjective you can buy. Ask for the algorithm name. Ask for the parameter set. If the answer is a white paper and a token, you have your answer. Vulnerability is just a question unasked. There is a second blind spot, more structural. The institutions behind this paper are not neutral observers. Theta Labs has a token. StarkWare has a token. Ethereum Foundation research shapes Ethereum's roadmap. I am not suggesting the arithmetic is wrong — I have no reason to doubt the circuit optimization, and the authors' measured public framing is itself evidence of good faith. But readers should hold two facts at once: the research can be rigorous and the narrative can still be monetized downstream. Both are true. Only one of them gets a press release. And a third: the market prices this at approximately zero, because there is no instrument through which to price it. You cannot hedge a quantum risk. There is no futures contract on secp256k1 breaking by 2038. So the risk accumulates in a place that produces no price signal, which is exactly the condition under which systemic risks grow quietly until they do not. I listen to what the compiler ignores. Watch two curves and one calendar. The first curve is physical qubit count. The second is error rate. When those two cross into the territory where a million-plus physical qubits can run a 1.3-million-gate circuit with correction, the conversation changes from arithmetic to schedule. The calendar is the one nobody controls: post-quantum signature support in the wallets and custodians that actually hold keys. The research is accelerating. The threat remains distant. Both statements will keep being true at the same time, and the discipline is holding them together without letting either one do the thinking for you. Security is the shape of freedom. And right now, the shape of this particular freedom has a deadline that has not been announced.