Circle's August 31 Disclosure Reads 813 Logical Qubits Off Eigen Labs' ECDSA.fail Leaderboard: What a Google and Stanford Estimate Says a secp256k1 Attack Actually Costs
Quentir Defense Monitor
Evidence-based insights for quantum defense and security. Published by Quentir Systems LLC · September 7, 2026.
On August 31, 2026, the stablecoin issuer Circle published a security disclosure telling every developer on its platforms that the quantum attack on elliptic curve signatures now requires 813 logical qubits, down 65 percent from the 2,330 that a 2017 analysis assumed. The number is real, it comes from a public engineering competition run by Eigen Labs, and reading it the way Circle's headline invites is exactly the mistake a defense planner cannot afford. The figure describes one coordinate of a circuit design contest. It leaves out the gate count that the same design pays for its narrow width, the error-correction overhead that separates a logical qubit from physical hardware, and the fact that existing multi-logical-qubit demonstrations cannot sustain tens of millions of fault-tolerant Toffoli operations.
The disclosure, written by Circle engineers Mira Belenkiy and Neel Patel under the title The Quantum Gap Is Closing, is worth a defense reader's attention for two reasons that have nothing to do with cryptocurrency prices. First, the curve in question, secp256k1, differs from the NIST P-256 curve that signs software updates, TLS sessions, and identity credentials across government and military systems only in its chosen constants; a circuit that performs modular elliptic curve arithmetic efficiently for one curve carries its techniques to the other. Second, the disclosure is a live specimen of how quantum cryptanalysis progress gets communicated to decision makers: a single dramatic number, detached from the resource model that gives it meaning. Learning to re-attach that model is a skill every program office funding cryptographic migration now needs.
This briefing walks through what the 813 figure actually measures, what the strongest published estimate says a complete attack would cost, and where Circle's own hardware comparison goes wrong.
What the ECDSA.fail challenge scores: Toffoli count times peak qubit width on a secp256k1 point-addition circuit
The 813 figure is the August 2026 low-width entry on the leaderboard at ECDSA.fail, an open competition that Eigen Labs runs with a public challenge specification on GitHub. Contestants do not attack any key. They submit designs for one subroutine: a reversible quantum circuit that adds a known classical point to an elliptic curve point held in superposition across two 256-qubit registers. That point addition is the workhorse inside Shor's algorithm for the elliptic curve discrete logarithm problem, so making it cheaper makes the whole attack cheaper, and the contest exists to discover how cheap it can get.
The scoring is a product, and the product is the part Circle's headline drops. A submission's score is its average Toffoli gate count multiplied by its peak logical qubit width, with lower scores winning. The challenge baseline sits at 3,942,753 Toffoli gates on 2,715 qubits, roughly ten billion on the combined metric, and the specification credits an optimization loop that has already improved on textbook constructions by a factor of about 33. Because the metric is a product, a designer can trade one axis for the other: a circuit can post a striking width figure like 813 by spending more gates, or cut gates by spreading across more qubits. A width number quoted alone is therefore a fragment. The harness behind the leaderboard is serious engineering, verifying each entry on 9,024 random test points, requiring every ancilla qubit returned to zero and forbidding leaked phase, so the entries are honest circuits. The fragment quoted from them is what misleads.
The March 2026 estimate from Google, Stanford, and the Ethereum Foundation: under 1,200 logical qubits and 90 million Toffoli gates, minutes of runtime
The complete pricing exists, and it was published five months before Circle's disclosure. In a March 2026 paper titled Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations, a nine-author team spanning Google Quantum AI, Stanford, Berkeley, and the Ethereum Foundation, including Ryan Babbush, Craig Gidney, Hartmut Neven, and the cryptographer Dan Boneh, worked out what a full 256-bit elliptic curve discrete logarithm attack costs when every part of Shor's algorithm is engineered together. Their answer comes as a pair of trade-off points: fewer than 1,200 logical qubits running fewer than 90 million Toffoli gates, or fewer than 1,450 logical qubits running fewer than 70 million.
Both figures describe logical qubits, the error-corrected abstraction, and the paper prices the physical bill too. On a hypothetical superconducting architecture assuming a physical-gate error rate of one in a thousand and nearest-neighbor connectivity, the attack circuits would finish in minutes using fewer than half a million physical qubits. That is the same estimate lineage as Gidney's earlier repricing of RSA-2048, which this Monitor examined in an earlier briefing on the one-million-qubit RSA estimate, and the two results together state the modern consensus plainly: elliptic curve keys fall to a smaller machine than RSA keys, and both machines remain hypothetical. Half a million physical qubits under sustained fault-tolerant operation is a facility, a cryogenics plant, and a control system that nobody has demonstrated at even one percent of that scale.
Quantum pillar: computing (cryptanalysis). Use posture: offensive. Technology readiness: TRL 2 of 9. The attack on secp256k1 exists as circuit designs and resource estimates worked out on paper and checked in classical simulation, while the fault-tolerant machine those designs assume has no public hardware realization at any scale.
Circle counted Willow's 105 physical qubits as logical qubits, and that difference sets the timeline
The disclosure's hardware comparison is where a careful reader should push back hardest. Circle writes that Google achieved 105 logical qubits with its Willow processor and plans to scale beyond 1,000. Google's own announcement describes Willow as a chip with 105 physical qubits, and the error-correction result that made it famous consumed most of them to operate a single encoded logical memory, scaling from a three-by-three grid to five-by-five to seven-by-seven and cutting the logical error rate in half at each step. One logical qubit held below threshold and 105 attack-ready logical qubits are separated by roughly the factor that separates a demonstration from a weapon. Against the Babbush team's requirement of 1,200 logical qubits sustaining tens of millions of sequential Toffoli operations, existing multi-logical-qubit demonstrations cannot sustain the required depth and fidelity, and the assumptions inside such estimates are themselves an active research front, as the recent fault-tolerance preprints examined in a companion briefing on Q-day resource estimates show in detail.
None of this makes the migration advice wrong. Circle's operational guidance, take a cryptographic inventory, identify which vendors hold your signing paths, prepare key rotation, is the same counsel the National Institute of Standards and Technology gives in its draft transition report NIST IR 8547, which proposes that 128-bit ECDSA parameters, including P-256, be disallowed after 2035; the proposed 2030 deprecation applies to 112-bit parameters. The sound argument for starting post-quantum migration now was never an imminent machine. It is that rotating the cryptography of a large installed base takes the better part of a decade, and that signatures protecting long-lived value, whether a treasury of tokens or a fleet's firmware update chain, must be replaced well before the first capable machine, whose arrival will not be announced.
What an offensive cryptanalysis capability would let its holder do, and what still stands between these papers and a machine
Read as capability, the work on both the leaderboard and the arXiv paper serves the offensive side of the ledger: it is the published, unclassified edge of knowing how to break deployed public-key cryptography with quantum hardware. A state that eventually fields a machine meeting the Babbush specification could recover private keys from exposed public keys on secp256k1 or its sibling curves and forge the signatures that authenticate software updates and financial transactions. Harvested traffic could be decrypted retrospectively only where its confidentiality relied on vulnerable elliptic curve key agreement and the required public transcript was captured. Public blockchains are already readable, but still-spendable assets whose public keys have been exposed could become stealable. The gainer is whichever signals-intelligence establishment gets there first, quietly; the loser is every system owner who let deprecation deadlines slide because the qubit numbers in the press seemed comfortably abstract.
What stands between the published designs and that outcome is precisely what the resource estimates document. The circuits are validated today only by classical simulation of their components; the challenge harness checks correctness on random test points, and nobody can execute the assembled algorithm because the fault-tolerant substrate does not exist. Building it requires physical error rates and qubit counts beyond every disclosed device, sustained over minutes of fault-tolerant operation on connectivity that present chips lack, Willow included. A program office should treat the 813 figure the way it would treat a wind-tunnel coefficient quoted without airspeed: one number from a design study, useful for watching the trend line, useless alone for scheduling. The trend line itself, a 33-fold circuit improvement inside one competition and a 65 percent width reduction over a decade, is the genuine signal, and it points in only one direction. Migration timelines should be set against that trend and the NIST calendar, and the place to check each new headline number is the resource estimate it came from.
Sources
Primary source: Mira Belenkiy and Neel Patel (Circle), 'The Quantum Gap Is Closing,' August 31, 2026. Other material: Ryan Babbush, Craig Gidney, Dan Boneh, and colleagues, 'Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities,' arXiv, March 2026; Eigen Labs' ECDSA.fail challenge specification; Google's Willow announcement; NIST IR 8547 initial public draft.