2 hours ago
11
Project Eleven’s 1 BTC Q-Day Prize was meant to sharpen the debate over quantum risk to Bitcoin and other ECC-secured crypto assets. Instead, a sharp critique from Google quantum researcher Craig Gidney has turned the competition itself into the story.
In an April 25 blog post titled “The predictable failure of the QDay Prize,” Gidney, a research scientist on Google’s quantum computing team, argued that the winning submission did not meaningfully demonstrate progress toward a cryptographically relevant quantum attack. His central claim was blunt: the contest was structured around a benchmark that current quantum computers are poorly suited to measure.
Bitcoin’s Quantum Threat Debate Explodes
Project Eleven had announced the previous day that it awarded the Q-Day Prize to Giancarlo Lelli for breaking a 15-bit elliptic curve key on publicly accessible quantum hardware. The group described the result as the “largest quantum attack on elliptic curve cryptography to date” and said it represented a 512x jump from a prior 6-bit public demonstration.
For crypto markets, the framing mattered. Project Eleven explicitly linked the result to the long-term security assumptions behind Bitcoin, Ethereum, and more than $2.5 trillion in ECC-secured digital assets.
But Gidney argued that the test may have proved far less than advertised. Gidney said he was invited last year to participate in the Q-Day Prize but declined because he viewed the premise as flawed. His first objection was that Shor’s algorithm requires quantum error correction for cryptographically meaningful instances.
“Current quantum computers experience on the order of one error per thousand gates, but cryptographically relevant instances of Shor’s algorithm require billions of gates,” he wrote. “The only known way to cross this chasm is quantum error correction. There are promising quantum error correction experiments being done, but ultimately quantum error correction is still a work in progress.”
That distinction sits at the center of the dispute. In Gidney’s view, running small non-error-corrected circuits does not provide a useful proxy for breaking real-world ECC keys, because the scaling behavior is fundamentally different from the systems that would be needed to threaten Bitcoin-scale cryptography.
His second objection was more damaging for the prize result. Gidney argued that small Shor-style problems can appear to succeed even when the quantum hardware is not contributing meaningful computational value. The issue, he said, resembles a joke paper he published for SIGBOVIK 2025, where he claimed to factor all numbers up to 255 using a quantum computer, only to show that the same success could be reproduced with randomness. He called this the “Falling With Style” problem.
“For the near future, the contribution of luck is going to massively outweigh any legitimate contribution of the quantum computer,” Gidney wrote, quoting the warning he said he gave when declining to participate. “So I suspect the winner in 2026 will be whoever did the best job at obfuscating how they made themselves unavoidably lucky. You’re going to find yourself in a philosophical debate, with 100K$ on the line, over where exactly the line for a quantum computer ‘really’ breaking a key is.”
According to Gidney, that is effectively what happened.
He pointed to work by GitHub user Yuval Adam, who reportedly replaced the quantum calls in the winning submission with random calls and found that the results were “indistinguishable” from the quantum version. Gidney said the circuit construction itself looked valid, including its implementation of the ELDPC circuit from Roetteler et al. 2017, but that this made the problem more subtle rather than less serious.
“You make a correct circuit, you get the expected result, you celebrate… but you got the right answer for the wrong reason,” he wrote. “This is a fear that every competent experimentalist knows in their bones. It’s why they don’t just check that something works when it should work, they check that it breaks when it should break.”
Project Eleven Defends The Broader Aim
Project Eleven framed the winning result as a practical demonstration of the attack class that could eventually threaten Bitcoin and Ethereum. In an reaction, CEO Alex Pruden said the submission showed that “the resource requirements for this type of attack keep dropping” and that the barrier to running such experiments was falling because the work used cloud-accessible public hardware rather than private or national-lab systems.
The group also cited recent theoretical resource estimates, including Google’s April 2026 estimate of under 500,000 physical qubits for a full 256-bit attack and a later Caltech and Oratomic paper that put the figure as low as 10,000 qubits in a neutral-atom architecture. Project Eleven argued that while the distance from 15 bits to 256 bits remains large, the gap is increasingly an engineering problem rather than a fundamental physics problem.
Pruden later acknowledged Gidney’s critique on X, writing that “small factoring problems are a very imperfect yardstick for Q-Day.” Still, he defended the purpose of the competition as an attempt to bridge a gap between quantum researchers who see rapid acceleration and cryptographers or Bitcoin developers who want stronger evidence before treating current systems as near-term vulnerable.
“So, since small factoring problems aren’t a good yardstick for Q-Day, then what is?” Pruden wrote. “I’ll happily take feedback on how we can better incentivize open benchmarking towards Q-Day risk.”
A Credibility Problem For Quantum Risk Messaging
Gidney did not dismiss quantum risk to crypto outright. In fact, he wrote that there are “legitimate concerns” quantum computers could become cryptographically relevant before the end of the decade, pointing to post-quantum migration efforts at companies such as Google and Cloudflare.
His argument was narrower, but consequential: a weak benchmark can undermine the case it is trying to make. If a competition designed to raise awareness produces a result that critics can reproduce with randomness, it risks becoming ammunition for skeptics rather than a warning signal for the industry.
At press time, BTC traded at $77,750.
English (US) ·