The Quantum Discount: A 50% Cheaper Shor Circuit Is Not a Countdown

The Quantum Discount: A 50% Cheaper Shor Circuit Is Not a Countdown A composite score of roughly 1.5 billion. Google's own published estimate sat near 3 billion. That is the entire technical claim behind the headlines that circulated this week: quantum attacks on Bitcoin and Ethereum just got 50 percent cheaper. Two numbers, one subtraction, and a market narrative that wrote itself before anyone opened the paper. Here is the anomaly. The paper is not about hardware. It is not about error correction. It is about point addition, the single heaviest sub-routine inside Shor's algorithm when the target is the elliptic curve discrete logarithm problem over secp256k1, the curve that Bitcoin and Ethereum both build their key systems on. I have spent enough hours inside constraint systems to recognize this shape of result. When someone optimizes the most expensive gate in a circuit, a cost metric moves. The feasibility boundary does not. Code does not lie, but it often omits the context. The context omitted here is the distance between a logical qubit and a physical one, and that distance is where the entire argument lives. The mechanics first, because the headline skipped them. Every Bitcoin and Ethereum private key is an integer. The public key is that integer multiplied by a fixed generator point on an elliptic curve. Recovering the private key from the public key means solving the discrete logarithm problem, which is computationally infeasible on classical hardware and polynomial-time on a sufficiently large fault-tolerant quantum computer running Shor's algorithm. That is not a speculative claim. It is a proof from 1994, and it has survived every attempt to break it. The new paper, produced by researchers affiliated with Theta Labs, the Ethereum Foundation, and StarkWare, does not challenge that proof. It refines the resource estimate. The authors report roughly 1,151 logical qubits and approximately 1.3 million Toffoli gates for the point addition stage, compressing the composite resource score from Google's roughly 3 billion down to roughly 1.5 billion. The composite score merges qubit count with gate operations and time into a single spacetime resource measure. Halving it is a genuine contribution to the algorithm layer. Why point addition? Because Shor's algorithm for the elliptic curve discrete log problem reduces to repeated point operations performed in superposition. Point addition and point doubling dominate the circuit. Optimize them and the whole resource estimate drops. It is the same instinct I applied to constraint systems: find the operation executed most often, restructure it, measure the delta. Elegant work, and entirely offline. Jieyi Long, Theta Labs' CTO and one of the authors, said plainly that this is not an imminent threat. That statement is the most useful sentence in the release, and it was the first thing dropped from the coverage. The number that matters is not 1,151. It is whatever 1,151 logical qubits expand into after quantum error correction. A logical qubit is an ideal, error-free unit that runs an algorithm. A physical qubit is a piece of hardware that leaks, decoheres, and drifts. You build one logical qubit by entangling hundreds to thousands of physical ones into an error-correcting code, surface codes, color codes, whichever architecture survives the decade. Divide 1,151 by a conservative overhead and you land in the hundreds of thousands to low millions of physical qubits. Current NISQ hardware sits in the hundreds to low thousands, with error rates around one in a thousand. The gap is not a factor of two. It is several orders of magnitude. There are two curves here, and they are independent. One is the algorithm curve: how many logical operations a Shor circuit requires, which this paper bends downward. The other is the hardware curve: how many physical qubits can be fabricated and kept coherent, which is driven by fabrication, cryogenics, and error-correction research. Neither curve predicts the other. Where they cross is the only date that matters, and nobody publishing estimates today can see that intersection with any precision. Which brings me to the asymmetry nobody priced. Bitcoin and Ethereum do not carry equal exposure, and the difference is architectural, not cryptographic. Ethereum's account model leaks. Every transaction an externally owned account signs publishes its ECDSA public key to the chain, permanently, in the historical record. There is no equivalent of spending from a fresh address to reset that. Once an account has transacted, its public key is public forever, for every account, everywhere. Bitcoin is more granular. P2PKH outputs hide the public key behind a hash until the moment they are spent, which means an address that has never been spent from presents a hash preimage problem, not a discrete log problem. That is a real buffer. It evaporates the instant the address is reused. And it does not apply at all to the earliest output type: P2PK, pay-to-public-key, which embeds the public key directly in the locking script at creation. The 2009 and 2010 coinbase rewards, including the blocks attributed to Satoshi Nakamoto, are P2PK. Their public keys have been sitting in the ledger in plaintext for over fifteen years. Security researchers describe a harvest-now, decrypt-later model for TLS traffic: capture ciphertext today, break it when the hardware matures. Blockchain is worse than that. There is nothing to harvest. The public keys are already in the chain, indexed, queryable, permanently available. When capability arrives, the vulnerable set is not assembled going forward. It is read backwards, in a single pass, from genesis. That changes the shape of the remediation problem entirely. Offline systems get a migration window. Public keys on a blockchain get none. The moment a cryptographically relevant quantum computer exists, every exposed key becomes a candidate at the same instant. When I optimized the proof verification circuit of a ZK-rollup in 2024, I cut verification gas by 15 percent by restructuring the constraint system. The team adopted it into the roadmap. What it did not do was change the soundness assumption underneath the circuit. Shaving constraints shaves cost. It does not shave trust. The same discipline applies here. A 50 percent reduction in a resource metric is a cost result, not a security result, and conflating the two is the most common analytical error in this sector. Earlier, during the 2020 DeFi summer, I spent three weeks reverse-engineering price feed mechanisms and found that delayed feeds could produce undercollateralization well before anyone flagged the positions at risk. The lesson transferred cleanly: metrics improve faster than systems do, and the spread between the two is where losses accumulate. The contrarian reading is not that the threat is overhyped. It is that the wrong thing is being feared. The near-term risk in this story is not a quantum computer. It is migration inertia, and it is misreading. Migration requires a hard fork on Bitcoin. Replacing ECDSA with a post-quantum signature scheme means changing the consensus rules that decide which signatures are valid, and Bitcoin's upgrade process demands a level of coordination that has historically taken years for far smaller changes. Ethereum has an EIP pipeline and a foundation that already publishes research on the topic. Neither chain has a plan with a date attached. The authors said the transition will take years and that a successful attack would be unrecoverable. That is the sentence to sit with. Second blind spot: who wrote it. Theta Labs has a token. StarkWare has a token. A finding about quantum resistance sits adjacent to narratives both ecosystems can use. That does not invalidate the mathematics, since point addition optimization is checkable by anyone with the patience. But the authors' own restraint, publicly calling the threat not imminent rather than amplifying it, is the signal worth weighing. Marketing departments rarely hedge. Third, and this is the part almost nobody discusses: the post-quantum side is under-allocated intellectually. NIST has already standardized algorithms such as Kyber and Dilithium. Wallet vendors, exchanges, and custodians have barely moved. In a bear market, the question that matters is not which chain survives a quantum computer. It is which custody provider is still holding keys whose format nobody has planned to change. Watch physical qubit counts and error rates, not composite scores. Watch key management upgrade logs from the largest custodians. Watch the Bitcoin developer mailing list for a formal migration proposal, because that is the earliest signal that inertia is breaking. The first genuinely vulnerable set is not the one that forms in the future. It is the one already exposed on-chain, waiting. The clock is not ticking on the algorithm. It is ticking on the migration.