A Public Quantum Claim Built on a Private Attack Circuit
A security researcher sometimes finds a result whose value depends on two duties pulling in opposite directions. Other experts should be able to test the claim. The method should not become an instruction manual for an attack. Scientific publication favors openness; vulnerability disclosure allows delay and restraint. Quantum cryptanalysis has now produced a striking attempt to satisfy both duties at once.
On March 30, 2026, Ryan Babbush and eight co-authors posted a paper on the resources a future quantum computer might need to attack the 256-bit elliptic curve discrete logarithm problem, or ECDLP-256. The paper disclosed the resource counts but withheld the compiled attack circuits. It offered a zero-knowledge proof for a bounded point-addition statement that supports the larger estimate without revealing the circuit itself. The institutional experiment is as interesting as the cryptography: reproducibility and restraint were built into the same publication.
March 30: the result arrives with a missing circuit
The preprint gives two space–gate tradeoffs for Shor’s algorithm against ECDLP-256. One compiled circuit uses fewer than 1,200 logical qubits and 90 million Toffoli gates. The other uses fewer than 1,450 logical qubits and 70 million Toffoli gates. Under assumptions that include a physical error rate of 10−3, planar connectivity and a fast-clock superconducting architecture, the authors estimate execution in minutes with fewer than 500,000 physical qubits.
Those numbers are estimates for a future cryptographically relevant quantum computer. They do not describe a machine operating today. They also depend on architecture, error correction, connectivity and clock speed. The paper distinguishes fast-clock systems, including superconducting and photonic approaches, from slower-clock neutral-atom and ion-trap systems because an attack against a public transaction can depend on timing as well as qubit count.
The missing object is crucial. The team says it compiled the circuits, but it did not release them. Ordinarily, withholding the core artifact would make a resource claim harder to examine. Here, the authors supplied a cryptographic substitute. The proof attests that they possess classical reversible circuits within stated resource bounds that compute secp256k1 point addition correctly across 9,024 pseudorandom inputs deterministically derived from each circuit’s hash. The paper then reasons from this bottleneck subroutine, using windowed arithmetic, to the resources for the full Shor computation.
March 31: Google explains the disclosure bargain
A day later, Google Research published its public account. Ryan Babbush and Hartmut Neven wrote that the team had engaged with the U.S. government and used a zero-knowledge proof so the vulnerability description could be verified without giving bad actors a roadmap. That is Google’s account of the engagement and the method; the blog is not independent confirmation of either.
The disclosure sits between two familiar positions. Secrecy can protect vulnerable systems while leaving owners and the public unable to judge urgency. Full publication can accelerate scrutiny and mitigation while also reducing the work required of an attacker. Coordinated disclosure usually manages this tension with private notice, an embargo and time to patch. A quantum attack on widely distributed cryptocurrency infrastructure does not fit neatly inside that sequence. There may be no central vendor, no single patch owner and no date on which every exposed asset can move together.
Practical takeaway. A sensitive technical claim can be made independently checkable without publishing the dangerous implementation, but the proof’s exact statement, assumptions and verifier still determine how much trust it deserves.
Cryptocurrency adds another complication. A weakly supported claim can move markets or frighten holders before a quantum machine exists. Silence can leave developers with too little reason to fund migration. The zero-knowledge route changes that bargain: one resource-bounded subroutine became cryptographically attestable without making the circuit public.
April 15: a flaw forces a new proof
ArXiv records a second version on April 15, and the revision contains the strongest caution in the case. The authors credit Keegan Ryan of Trail of Bits with finding a software bug that admitted an exploit against the soundness of an earlier version of the zero-knowledge proof. Version 2 corrects the proof layer. The paper says the underlying circuits remained identical, while their published hashes changed because the revision hashes the circuit files directly instead of hashing serialized parsed-circuit objects.
The repair does not erase the disclosure model; it reveals one of its operating conditions. A cryptographic proof still runs through software, parsers, hashes, test generation and a precisely drafted statement. A defect in that stack can weaken the assurance even when the hidden circuit is unchanged. The paper’s decision to credit the external finding gives readers a dated account of the failure and correction, but the public paper does not disclose the exploit details.
The revised abstract says the proof validates the resource results without disclosing attack vectors, then keeps the surrounding conclusions conditional. The physical-qubit estimate rests on specific error rates and connectivity. The paper analyzes on-spend attacks for some cryptocurrencies and discusses migration, dormant assets and policy options. None of this supplies a universal date for the arrival of a capable machine.
This boundary matters because resource estimates often travel farther than their assumptions. “Fewer than half a million physical qubits” can become a headline that sounds like a forecast. It is a modeled threshold for particular circuits and architectures. “Execution in minutes” can sound like an imminent event. It describes runtime after a machine meeting the assumptions exists. A proof answers a narrower question than a forecast. Here it attests to possession, resource bounds and sampled correctness for point-addition circuits; separate technical reasoning carries that result into the full algorithm estimate. Hardware feasibility, deployment timing and institutional response remain open.
The same distinction applies to migration. Post-quantum algorithms can address vulnerable signatures, yet cryptocurrency systems carry consensus rules, exposed public keys, wallet behavior, abandoned coins and coordination problems. Our recent analysis of Galaxy’s Bitcoin Quantum Readiness Initiative examined the funding and protocol side of that transition. The Google paper reaches further upstream, to the way researchers communicate the technical pressure that makes a transition worth funding.
A method with reach beyond cryptocurrency
The most interesting connection is institutional. Courts use protective procedures when parties need to contest confidential material. Regulators receive trade-secret submissions that cannot simply be placed online. Security teams disclose a vulnerability to selected maintainers before the public receives the exploit. Each arrangement separates access to a sensitive method from authority to judge a consequence.
Zero-knowledge proofs offer a mathematical version of that separation. They can let a verifier check a precise proposition while learning little about the hidden witness used to prove it. In this case, the proposition concerns compiled quantum circuits and resource counts. In another domain, the relevant statement might concern whether a model passed a defined test, whether a semiconductor design satisfies an export threshold, or whether a privacy-preserving computation followed an agreed rule.
That possibility deserves both interest and caution. A proof can be flawless while proving the wrong statement. A statement can omit a decisive assumption. A verifier can be inaccessible, dependent on proprietary tooling or chosen by the claimant. Public confidence therefore cannot rest on the words “zero knowledge” alone. The governance work moves into statement design, verifier access and assumption disclosure.
How Quentir Reads It
Quentir reads this case as an early example of governance middleware: technical machinery that changes what institutions can responsibly know and contest. The familiar choice between publishing everything and asking outsiders to trust a private assessment is too crude for dual-use research. A proof-carrying claim creates another option. It exposes a bounded conclusion to checking while the hazardous method remains controlled.
The option does not settle who should hold the hidden circuit, which public authority should receive advance notice or how long secrecy should last. Those questions remain political and legal. It does improve the shape of the disagreement. Critics can ask whether the proof establishes possession and sampled correctness of the point-addition circuits within the advertised bounds, whether the reasoning to the full algorithm is sound, whether the hardware assumptions are defensible and whether the migration recommendation follows. The version 1 flaw shows why those questions need an adversarial audience.
The analysis also complements our earlier post on which parts of a network are actually quantum-resilient. Migration claims need scope. Disclosure claims need scope too. In each case, the honest sentence identifies the component, assumption, version and decision that has actually been tested.
Quentir’s Signature Report, the PQC Migration Roadmap, adds fixed scope, a dated migration spine and an internal-use license. This post stays with the disclosure design and the limits of what one cryptographic proof can establish.
After disclosure, the asymmetry remains
The circuit is still private. The resource claim is public. Cryptocurrency communities now have a sharper technical reason to examine migration, while the wider public still cannot inspect the attack method line by line. That asymmetry may be justified. It should also remain visible.
The lasting contribution may be less about one qubit estimate than about a new publication form. Dangerous capabilities will increasingly emerge in quantum computing, AI-enabled biology, cyber operations and advanced hardware. Institutions will need ways to contest claims without distributing every hazardous detail. Private method and public consequence no longer have to travel together. The next test is whether independent verifiers can make that separation credible beyond the team that designed it.
Sources: Ryan Babbush, Adam Zalcman, Craig Gidney, Michael Broughton, Tanuj Khattar, Hartmut Neven, Thiago Bergamaschi, Justin Drake and Dan Boneh, “Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations”, arXiv:2603.28846v1 (March 30, 2026), revised v2 (April 15, 2026); Ryan Babbush and Hartmut Neven, Google Research, “Safeguarding cryptocurrency by disclosing quantum vulnerabilities responsibly” (March 31, 2026). Public-source snapshot: July 27, 2026.
Published intelligence, built to inform your own decisions. Published: July 27, 2026.