A revised resource estimate for breaking a 256-bit elliptic curve key moved the cost of attack down by roughly 20x. The previous working figure for recovering a secp256k1 private key sat near 20 million physical qubits. The revised figure sits below one million, with wall-clock time measured in days instead of months.
None of this required a new algorithm. Shor's algorithm has not changed since 1994. What changed is the error-correction overhead wrapped around it: the surface-code distance, the lattice surgery schedule, and above all the magic state distillation budget that dominates the total gate count.
That is not a price signal. It is an arithmetic signal. Arithmetic does not negotiate with a roadmap.
secp256k1 is the curve. ECDSA and Schnorr are the signing schemes built on top of it. Both rest on the same hardness assumption — that recovering a private key from a public key requires solving the elliptic curve discrete logarithm problem. Shor's algorithm solves that problem in polynomial time on a fault-tolerant quantum computer.
The 2019 estimate put a 256-bit ECDLP at roughly 2,330 logical qubits and 1.26 x 10^11 Toffoli gates, running in about eight hours of circuit time. Logical qubits are the clean ones. Physical qubits are the noisy ones, bundled by error-correcting codes at a ratio that historically ran into the thousands. The 20x improvement lives almost entirely inside that bundling ratio, not inside the mathematics of the attack itself.
Here is the part most market commentary skips. Exposure is not uniform across Bitcoin's UTXO set. Pay-to-public-key outputs carry the public key in the locking script permanently, which means those coins are exposed today, including the roughly 1.1 million units attributed to the earliest mined blocks. Pay-to-public-key-hash outputs hide the key behind SHA-256 until the moment of spend, so the exposure window opens at broadcast and closes at confirmation. Taproot key-path spends reveal the x-only internal key. Address reuse reopens the window every single time the address is touched.
The chain remembers what the ego forgets. A wallet that reused one address in 2016 still has that address on disk, in every indexer's database, and inside every block explorer's cache.
Where the 20x actually came from matters more than the headline number. The algorithmic layer — the gate count for a single modular exponentiation in the elliptic curve group — has improved modestly. The error-correction layer has improved enormously. Magic state distillation, which produces the low-error T-states that Shor's circuits consume, was long the dominant cost. Better distillation protocols, cheaper factories, and tighter physical layouts cut it. The net effect is a cost curve now improving on a cadence closer to classical semiconductor scaling than to academic curiosity.
Three consequences follow. All of them are engineering problems, not physics problems.
First, the migration is a block-space problem. ECDSA public keys are 33 bytes. Schnorr signatures are 64 bytes. Post-quantum replacements are not in that weight class. ML-DSA, standardized as FIPS 204 and formerly called Dilithium, carries public keys around 1.3 KB and signatures around 2.4 KB. SLH-DSA, standardized as FIPS 205 and formerly SPHINCS+, runs from roughly 7.8 KB to 49 KB depending on parameter set. Put a post-quantum signature into a SegWit witness and a simple spend that cost a few hundred virtual bytes climbs past five thousand.
That is not a footnote. Bitcoin's block weight cap, its 4:1 witness discount, and Taproot's further discount were all calibrated to a world of small signatures. Strip the discount and you break the fee assumptions that light clients, Lightning channels, and exchange withdrawal batching depend on. Keep the discount and you hand an attacker a cheap way to consume block space. Neither option survives contact with a fee market under stress.
Second, verification cost rewrites the gas model. Ethereum exposes secp256k1 recovery as a precompile at address 0x01, priced at 3,000 gas. Post-quantum verification is heavier by roughly one to two orders of magnitude. That means new precompiles, new pricing curves, and a new denial-of-service surface. Every signature scheme admitted into a virtual machine is also a new way to consume block gas at a discount.
I spent two months in 2024 reviewing STARK proof generation circuits for a Series B diligence. The flaw I found was not cryptographic. It was an optimization that held under benchmark load and collapsed under mainnet congestion. Post-quantum verification has exactly that shape: correct on paper, latency-bound in production. Rollups will absorb most of it inside the proof layer, since batch verification already lives off-chain, but their data commitments still land in blobs. Blob supply is on a schedule that is not getting more generous.
Third, the migration is a key-rotation ceremony at global scale. Every exchange hot wallet, every foundation treasury, every multisig holding a decade of accumulated assets has to be re-keyed. Foundation and DAO holdings are traceable today. They will be traceable during the migration, and the rotation will be visible block by block. An organization that has spent years describing itself as decentralized will perform its key ceremony in public, and the transaction graph will show exactly which addresses moved together and in what order.
The privacy loss is real. So is the operational risk. Re-keying a Gnosis Safe means new signers, new hardware, new procedures, and a fresh set of ways to lose the key behind the key.
There is a second-order problem that I only started quantifying last year, during a six-month study of autonomous agent behavior on-chain. I analyzed more than 500 automated trade scripts and documented how model-driven errors produced unintended state changes in lending pools. An agent that signs transactions must parse the signature scheme it is signing with. If post-quantum formats arrive without machine-readable specifications that an autonomous executor can verify against, the first casualty of the migration will not be a human wallet. It will be an agent holding someone else's capital.
I learned this shape of failure auditing the 2x Capital leverage token contracts in 2017. Three slippage errors, none of them visible in the public whitepaper, all of them arithmetic. That is when I stopped reading tokenomics before reading the math. We do not guess the crash; we trace the fault.
The counter-intuitive point is this: the quantum computer is not the nearer danger. The migration is.
Consider what has to happen. A signature scheme must be selected, specified, implemented, reviewed, and activated. Bitcoin's BIP process is deliberately slow, and its last two consensus changes consumed years of argument. Ethereum has a faster governance surface but a far larger state to migrate and an account model full of contracts that hard-code secp256k1 assumptions into their recovery paths.
Now consider the destination. Lattice-based cryptography rests on assumptions far younger than the discrete logarithm problem. NIST ran a multi-year competition precisely because that youth is a liability, and it still had to withdraw candidates mid-process. A rushed migration could lock the industry into a scheme whose cryptanalysis is roughly where ECDLP stood in 1995.
There is also an asymmetry nobody prices. Harvest now, decrypt later is a phrase built for encrypted traffic. For ECDSA it is worse — there is nothing to decrypt, because the public keys are already published. The harvest is complete. Only the forging remains, and that waits on hardware.
Verification precedes trust, every single time. That applies to quantum hardware announcements and to the post-quantum schemes proposed to replace them.
Watch the pubkey exposure ledger, not the qubit headlines. The measurable signal is how much value sits in outputs whose keys are already public, and how quickly that number falls as exchanges consolidate wallets and users rotate addresses. If it stops falling, the migration has stalled. The resource estimate will keep falling whether or not anyone is ready for it. Code is law, but history is the judge.
