ECC Attack Circuit Drops to 835 Logical Qubits

July 20, 2026 — A team spanning four Chinese research institutions has published a revised quantum circuit for attacking secp256k1, the ECC curve behind Bitcoin and Ethereum signatures, that brings the logical-qubit count down to 835, the lowest figure yet reported for a 256-bit elliptic curve. The paper, posted to arXiv on July 15, supersedes the same group’s April preprint, which I covered when it cut the count to 1,333. In just over three months, the same authors have taken roughly a third off their own number.

Two clarifications belong up front, because the paper’s own framing invites confusion. Its abstract says the result beats “previous best estimates of 1,098 and 1,175 logical qubits” from Chevignard, Fouque, and Schrottenloher and from Babbush et al. The 1,175 figure (Babbush) is right. The 1,098 is not the P-256 number: it is Chevignard’s P-224 figure, carried over from a since-corrected typo in that paper’s abstract, where the P-224 and P-256 values were swapped. Chevignard’s corrected space-optimized P-256 figure is 1,193, the number I used in April. Measured against the correct competitors, 835 is a 29 to 30% reduction. Against the team’s own April circuit, it is 37%.

Bottom line for security teams tracking these estimates: the logical-qubit cost of a quantum attack on a 256-bit ECC curve now sits below every previously published figure, at roughly a third of the 2017 Roetteler baseline of 2,330. But fewer qubits does not mean a cheaper attack. This circuit uses about 20 times more Toffoli gates than the next-best alternatives from Google and Schrottenloher. A smaller quantum computer that has to run 20 times as many expensive operations is a different shape of machine; the total cost may be comparable or even higher. The width shrank; the computational work grew; and the paper does not include a depth analysis to tell us how those two factors net out in wall-clock time. Anyone reporting “835 qubits” without the gate penalty is giving half the pictur…