Today, arXiv published a paper reporting the results of ECDSA.fail, an open autoresearch challenge that, over approximately two months, drove down the estimated cost of the arithmetic at the center of a quantum attack on elliptic-curve cryptography. During that time, participants managed to reduce Google’s March quantum attack figure by over 50 percent. Seven contributors from StarkWare and the Starknet Foundation are named co-authors of the paper.
The challenge
In March 2026, Google Quantum AI and collaborators reported a large reduction in the quantum resources needed to run Shor’s algorithm against elliptic-curve cryptography, then took an unusual route to publishing it. Rather than publish the construction, the team published the cost figures it hit and a zero-knowledge proof that something meeting them existed. They withheld the circuits, but did release the simulation and validation code behind the claims, which meant anyone could check a candidate circuit without ever seeing Google’s.
At the end of May 2026, Eigen Labs turned that verifier into an open challenge, publishing the code, the scoring tool, and a leaderboard that anyone could submit to. The challenge covers a single operation, point addition on the curve that Bitcoin and Ethereum use for signatures. Shor’s algorithm repeats that operation many times over, so the cost of the whole attack tracks the cost of doing it once.
A submission is a circuit that performs the operation, and the scoring tool measures two things:
- How many logical qubits the circuit needs at its busiest moment, since all of them have to exist on the machine at the same time.
- How many Toffoli gates a typical run executes, since on a fault-tolerant computer those gates take far longer than anything else in the circuit.
The logical qubit measurement indicates how big a machine you need, and the Toffoli gates measurement indicates how long that machine has to keep running. The score consists of the two multiplied together, so a circuit only improves by reducing the total. Using fewer qubits, but more gates, won’t necessarily bring the score down.
Challenge entrants relied on coding agents to do the work: read the published research and the circuits already on the board, try a change, build it, score it, repeat. The entrants set the direction and decided which of the results mattered. The paper argues that open autoresearch works because the target is machine-checkable. Anyone can rerun the evaluator to reproduce the reported score and check the circuit against the benchmark’s validation tests.
What it achieved
In about two months, a field of over one hundred entrants and their agents landed on a point-addition circuit scoring less than half of Google’s March figure, and 86.1 percent below the score the challenge itself started from. The paper is careful about that first comparison. The two circuits sit behind different interfaces and count their costs by different rules, so the numbers exist side-by-side without one formally beating the other. IEEE Spectrum magazine reported at the time that it took the leaderboard eight hours to reach the number Google had shown, and around three days to surpass it.
Submissions have kept arriving since the paper’s data cutoff, and during that time the score has continued to decrease further and new records have been set for the narrowest working circuit.
ECDSA.fail measured circuits; it did not run them on quantum hardware because no such hardware exists yet. There is no error correction in these circuits at the physical level, and they have not been wired into a working Shor’s algorithm end-to-end. What the work does is give a sharper estimate of what point addition would cost in the case of a real attack, and that is the kind of number migration planning relies on.
Who was involved
The paper was led by Jieyi Long, CTO of Theta Labs. In addition, four co-authors from StarkWare and three from the Starknet Foundation are named. They worked on the circuits, the techniques that made the circuits smaller, checking the results, reviewing the paper, and on agent harnesses they built themselves, alongside co-authors from over a dozen outside organizations.
How this ties into our post-quantum work
Quantum readiness has been a standing priority at StarkWare, and ECDSA.fail is the latest work on it this year.
In June, we published a three-phase plan for moving Starknet off its remaining elliptic-curve dependencies, beginning with BLAKE2 in place of Pedersen hashing and Falcon-512 signatures for consensus. The STARK proof system underneath is hash-based already, so it needs no replacing. Last month, a transaction built with Avihu Levy’s Quantum-Safe Bitcoin method was mined on Bitcoin mainnet, moving coins into hash-based storage with no soft fork and no change to consensus rules.
ECDSA.fail demonstrates that same commitment focused on a different part of the problem. The amount of time the industry has to change its cryptography depends on a credible figure for what the attack costs, and until this year the best one came from a circuit nobody outside Google could inspect. Seven contributors from StarkWare and the Starknet Foundation helped advance this work.
The resource requirements for a quantum attack keep falling, and replacing cryptography that is already deployed takes years. What determines whether a network survives a quantum attack is the speed with which it replaces a broken primitive under pressure. That capacity, known as crypto agility, is what all of the work described above is building toward. Hash-based proofs mean Starknet’s proof system never has to change. Native account abstraction keeps signature logic inside the account contract, so a wallet can move to a post-quantum scheme without a network-wide fork. The migration phase of the roadmap exists so that live contracts can follow without breaking. ECDSA.fail’s measurement tells us how much of that has to be in place, and when.
According to Oli Freuler, Head of Product Growth at StarkWare, “Google kept its circuits private. ECDSA.fail’s open community and AI agents more than halved Google’s benchmark score in about two months. Starknet’s proofs are hash-based and post-quantum by design. The industry must upgrade before quantum hardware catches up.”
The challenge is still running at ECDSA.fail, with new circuits submitted daily. Bring whichever model, tooling or harness you like. When it comes to quantum, we would rather measure the threat than talk about it.
Read the full paper here: https://arxiv.org/abs/2609.09582
Learn more about StarkWare’s quantum work: quantum.starkware.co
