Project
Complete, for nowECDSA is the piece of math that decides who owns every Bitcoin: it stops anyone else from spending your coins, and it guards much of the modern web too. A big enough quantum computer could break it. ECDSA.fail is an open research competition to measure how big that machine has to be; my part was reproducing the best known circuit, profiling where its cost lives, and mapping why it sits at its optimization floor.
The problem
When you buy something online, install an app update, or send cryptocurrency, a piece of math quietly checks that the action really came from its owner and not an impostor. That check is called a digital signature, and the version nearly everything relies on is ECDSA. A large, fault-tolerant quantum computer running Shor's algorithm could one day forge those signatures, spending coins it does not own and impersonating sites it does not run. The real question is how big a machine it would take.
The math behind ECDSA lives on an elliptic curve: a smooth arc drawn by one short equation, with a rule for “adding” two points on it. Most people have to see one to believe it is that simple; there is a live one here you can drag points on. Bitcoin uses a particular curve named secp256k1, and the whole attack comes down to running that point-adding rule as a reversible quantum circuit. The leaner that circuit, the smaller the machine an attack needs, and the sooner the threat becomes real.
ECDSA.fail, an Eigen Labs project, is an open competition around exactly that circuit: anyone in the world can download the current best design, try to make it leaner, and submit; every entry is checked against the same correctness tests, scored by the same formula, and ranked on a public leaderboard. It builds on Google Quantum AI's 2026 result, and the section below explains its scoring in detail.
No break today
The rules
Submissions are scored on a single metric, and judged by a strict correctness suite.
Score
average Toffoli count × peak qubit width
Lower wins. Fewer Toffoli gates mean fewer costly “magic states,” and fewer qubits mean less hardware, so the product tracks how hard the attack really is to build.
New to these terms? Here is what a Toffoli gate and a qubit actually are
| Circuit | Toffoli | Qubits | Score |
|---|---|---|---|
| Challenge starting circuit | 3.94M | 2,715 | 1.07 × 10¹⁰ |
| Google, low-qubit point | 2.7M | 1,175 | 3.2 × 10⁹ |
| Google, low-gate point | 2.1M | 1,425 | 3.0 × 10⁹ |
As of mid-2026, the leading community submissions sit roughly 47% ahead of Google's published benchmark, and the leaderboard keeps moving.
The table shows published reference points. The community repo's main branch, which I reproduced locally in July 2026, already scores about 1.5 × 10⁹, so that is the real working frontier.
My approach
The cost lives almost entirely in the modular arithmetic underneath point addition, so that is where the search went.
Toolkit
Why it matters
Better resource estimates show how soon quantum computers could threaten today's cryptography, which tells banks, blockchains, and governments how urgently to migrate to post-quantum schemes. A public competition that drives the number down is a concrete way to test that timeline.
A result can also be a floor. Showing that this circuit is already as lean as its design allows, and pinning down why, tells everyone else where the remaining gains would have to come from. Mapping a frontier is as much a part of the research as moving it.
But what keeps me on it is the math. The security of billions of dollars rests on one rule for adding points on a curve, simple enough to draw yet impossible to run backward, and getting to work inside something that elegant, even just to measure it, is the kind of problem I find hard to put down. It also connects to the quantum solar optimization project, which taught me to think in qubits and gates, and this one applies the same ideas to a much harder problem.
Updates
These get technical. The terms they use, Toffoli gates, modular inversion, the floor, are explained in plain language on How the circuit works.
July 9, 2026
I got the challenge harness building and running on my ThinkPad, which meant fixing three real system problems along the way: sandbox networking, sudo credential caching, and home directory permissions. Then I reproduced the current community circuit and ran the full validation suite locally.
It passed everything: all 9,024 test points correct, every ancilla clean, no phase leakage, and the forward-then-reverse identity holds. Score: 1,320,763 average Toffoli gates × 1,152 qubits, about 1.52 × 10⁹. That score is the community’s accumulated work, which I reproduced and validated; my contribution so far is getting it to build, validate, and score cleanly on my own hardware.
July 10, 2026
I ran the validated baseline through the competition’s command-line submission tool. It built, validated, and scored cleanly, and came back at the same number as the current frontier, because it was the community circuit unchanged. A submission only moves the leaderboard if it lowers the score, so matching the frontier was the starting line rather than the finish.
So I profiled where the cost lives. About 95 percent of the Toffoli budget is the two modular inversions that a reversible affine point addition requires, both run through one binary-GCD engine. Then I tested every lever I could reach, and each was at its floor. The register widths sit at the algorithm’s mathematical bit-growth bound. A swap I hoped to shorten cannot be, because the registers are provably not equal where I needed them to match. The tables that strip out dead gates are saturated. A disabled squaring schedule I tried made the count worse. The one real lever left, an in-place squaring rewrite, saves at most 6 to 9 thousand gates out of 1.32 million, at real risk to correctness.
So this implementation is at its floor across every lever I tested. I did not rule out a different architecture for the inversion, such as a jump-k GCD engine, and that is the open research-scale question I would take up next. The circuit is the community’s work, not mine; my part here is the profiling and the analysis.
One caution the process taught me: the competition derives its test inputs from a Fiat-Shamir hash of the operation stream, so a change can pass on my machine and still be wrong on the inputs that decide the score.
July 11, 2026
The profiling showed this implementation was at its floor. That raised a bigger question: is 1.5 × 10⁹ a floor for the whole problem, or only for this one circuit? So I spent the day mapping the frontier. Affine point addition needs two full modular inversions, and those are about 95 percent of the cost, so one addition is floored near twice the cost of the best inversion, which is roughly the 1.3 million Toffoli gates this circuit already spends.
I then read the reversible inversion literature. The windowed binary GCD used here runs about 629 thousand Toffoli gates, and every alternative I found is worse on this metric: the Kaliski-style inverters land near 1.7 million, a space-saving version near 2.35 million, and a 2026 method that cuts the qubit count to about 800 pushes the gate count up near 10⁸. Bernstein-Yang divstep needs an in-place matrix multiply with no known efficient reversible circuit. Nothing I found beats windowed binary GCD.
Last, I compared against the only fully disclosed competing circuit, from Schrottenloher 2026. Its per-addition figure of about 2.34 million Toffoli includes a lookup table of 2¹⁶ entries, because its windowing reduces how many additions the full attack needs, not the cost of one addition, so a bare single addition here comes out ahead of it.
So this circuit sits at the two-inversion cost of point addition, near the frontier on both gates and qubits, and ahead of the disclosed circuits I could check. The one path left is a different inversion architecture, a jump-k GCD engine, which is a research problem rather than an engineering tweak.
Verify
The benchmark is public, so the score on this page is one anyone can reproduce.
Reproduce the score
Clone the community challenge, build it, and run the benchmark. It should validate all 9,024 test points and report 1,320,763 average Toffoli gates × 1,152 qubits, about 1.52 × 10⁹:
terminal
git clone https://github.com/ecdsafail/ecdsafail-challenge.git
cd ecdsafail-challenge
cargo build --release
./benchmark.shOn a fresh Ubuntu machine you may hit the three system obstacles I did; the fixes are on the setup page. My own runs are logged in results.tsv in my working copy, and the live standings are on the competition leaderboard.
Status
The community baseline is reproduced and validated clean on my own machine, the cost is profiled down to the two modular inversions at its core, and every optimization lever I could test is checked to be at its floor. That closes this phase, so I am calling the project complete for now. The one open question, a different inversion architecture such as a jump-k GCD engine, is research scale, and it is where I would pick the work back up. My runs and analysis are in my working copy below.