Claude Pushes Bitcoin and Banks to Accelerate in 53 Hours

Anthropic has optimized the quantum circuit for elliptic curve point addition using AI, significantly reducing the Toffoli gate count, but this is only a modular improvement. The quantum cracking estimates for Bitcoin's secp256k1 continue to decline, with challenges in coordinating quantum migration, while banks have clear post-quantum cryptography transition plans. How much longer until quantum computers can crack Bitcoin signatures? What are the differences between the encrypted connections on bank websites and the signatures in Bitcoin wallets? What is the post-quantum cryptography transition plan?

Written by: Conflux

The encrypted connections on bank websites and the signatures in Bitcoin wallets are fundamentally the same type of public key cryptography: elliptic curves or RSA.

Last Friday, Anthropic released a study: letting Claude Mythos 5 run continuously for 53 hours, it redrew the quantum circuit for elliptic curve point addition. This step accounts for most of the quantum bits and operational costs when quantum attacks target Bitcoin signatures.

For a quantum computer to crack Bitcoin signatures, it must meet two conditions simultaneously: the machine must be large enough, and the operational scheme must be efficient. The machines are still far from sufficient. However, on the scheme side, AI has just redesigned the most costly part of the process.

What Was Saved

The most expensive part of point addition is modular inversion. Traditional computers use an algorithm called divsteps, which runs very quickly. However, moving it to a quantum circuit is problematic: quantum computation must be reversible, and every branch chosen must be stored to calculate backward and clean up drafts. Storing these records consumes a large number of quantum bits.

Claude discovered that records do not need to be stored. After each calculation step, the remaining pair of numbers inherently carries enough traces to infer which branch was taken. It first tried several simple rules, which all failed on 256-bit numbers. It then shifted to mathematical derivation, proving a set of algebraic identities, and formally verified the core properties of divsteps using Lean.

The final design uses about 12% more quantum bits than the previous most efficient scheme, with the Toffoli gate count reduced to about one-seventeenth.

The same approach (coding, automatic scoring, iterative loops) was applied to another 7 tasks, with each improvement stemming from different discoveries. The largest one reduced the product of quantum bits and gate counts by 39 times.

Anthropic provided a comparison: in quantum chemistry, an estimate dropped from 50 trillion Toffoli gates to 340 million, with multiple research teams working for 8 years. This time, it was achieved in a continuous run of 53 hours.

The One-Seventeenth Boundary

Here, two numbers need to be separated: one is the cost of a specific circuit module, and the other is the total cost of the complete attack. A decrease in the former does not imply a proportional decrease in the latter.

First, only one module has been optimized. There are other computational steps, error correction overhead, hardware architecture, and runtime between inputting the Bitcoin public key and recovering the private key. Only by reintegrating the new circuit into the complete attack scheme and recalculating all resources can we know how much has ultimately been saved.

Second, one-seventeenth has a clear opponent. It is compared to Luo et al.'s scheme: about 69.5 million Toffoli gates and 838 logical quantum bits. Claude's scheme involves about 4 million gates and 935 bits.

Switching opponents changes the conclusion. Schrottenloher's scheme this year requires about 1.9 million gates but needs 1,446 logical quantum bits. Claude's circuit gate count is 2.1 times that, with about 35% fewer quantum bits. Whether more gates or more quantum bits is more critical depends on the specific hardware constraints. This feels more like an additional design option rather than a complete domination.

Third, the circuit allows for a very small number of input failures. The specification tolerates a failure rate of at most 2×10⁻⁴ for each point addition in exchange for fewer resources. The Lean proof only covers part of the properties of divsteps, not the entire circuit and gate count estimation.

Fourth, it has not been run on any quantum hardware. Verification relies on an automatic evaluation program simulating candidate circuits. Anthropic also admits that Claude was initially conservative, repeatedly verifying established conclusions, and researchers required it to explore multiple paths while occasionally reminding it to think outside the box.

Therefore, this research cannot conclude that "the time to crack Bitcoin has been reduced by seventeen times." It proves that there is still significant optimization potential in key modules, and AI can already participate in finding these improvements.

This Lock Has Already Been Loosened Three Times

Bitcoin uses the secp256k1 curve. The estimates for cracking it have been declining over the past few years.

In 2017, Microsoft researchers estimated about 2,330 logical quantum bits and 2.3×10¹¹ Toffoli gates.

By the end of March this year, Google's quantum AI team (collaborators include Justin Drake from the Ethereum Foundation and Dan Boneh from Stanford University) provided two circuit designs: one requiring less than 1,200 logical quantum bits and less than 90 million gates, and another requiring less than 1,450 logical quantum bits and less than 70 million gates, both needing fewer than 500,000 physical quantum bits. In a scenario of "pre-computing half and waiting for the target to appear," the runtime is about 9 minutes. In September, quantum computing company IonQ estimated that with about 20,000 trapped ion quantum bits, it could perform an operation in about 26 days.

From 2017 to March this year, the estimates dropped over nearly 9 years; by September, IonQ's new estimate was only half a year apart.

On the hardware side, Anthropic wrote in the original text: current quantum computers have only a few hundred to a few thousand quantum bits. The demonstrated logical quantum bits range from dozens to nearly a hundred. According to Project Eleven's Q-Day award records from April this year, the largest elliptic curve key cracked on real quantum hardware was only 15 bits.

Another paper this year, ECDSA.Fail, titled "Open-Ended Automated Research," also optimized the same step of point addition. Project Eleven also stated that the next round of challenges will focus on the intersection of cutting-edge AI models and quantum cryptanalysis.

Anthropic's research cannot be directly summed up with Google's and IonQ's estimates: the former is a design of a single module, while the latter two are resource estimates for the entire attack.

Who Upgrades Slower

Bitcoin has no CEO and cannot mandate upgrades.

BIP-360 was incorporated into the official proposal repository on February 11 and is still a draft; it only provides a new address type for users to migrate voluntarily. A more radical BIP-361 proposed by developers like Jameson Lopp envisions eventually ceasing to recognize old signatures, which raises a debate about whether long-dormant old coins should be frozen. Ethan Heilman, a co-author of BIP-360, estimates that even if initiated now, a complete migration of Bitcoin to post-quantum would take about 7 years.

The exposure is significant. According to Glassnode's statistics from May this year, approximately 6.04 million Bitcoins with public keys have been disclosed, accounting for 30.2% of the total issued supply.

Ethereum has taken a more proactive approach: in January this year, it established a dedicated post-quantum security team, and Vitalik Buterin announced a roadmap in February.

What about banks? The NIST (National Institute of Standards and Technology) transition timeline is still a draft: algorithms with 112-bit strength like RSA-2048 will be deprecated after 2030; all public key algorithms vulnerable to quantum attacks will be banned after 2035. SWIFT plans to launch SwiftNet 8.0 supporting post-quantum cryptography in 2027. This point addition research targets secp256k1; does it have the same effect on curves commonly used by banks?

The problem for banks is that, according to a commentary by BankInfoSecurity, most banks cannot clearly articulate where their cryptographic deployments are located.

BlackRock's stance is closer to "disclosed." In May 2025, it first mentioned quantum risk in its Bitcoin ETF (IBIT) registration documents, at which point the fund's net assets were approximately $64 billion. Bloomberg Intelligence analyst James Seyffart reminded that such disclosures should list all risks, including highly unlikely ones.

In terms of pricing, the market has no unified view. Some analysts believe that quantum risk is one of the reasons Bitcoin is weakening relative to gold. Glassnode analyst James Check believes that the price weakness is mainly due to long-term holders selling; Bitcoin developer Matt Corallo pointed out that if quantum risk were indeed the main reason, Ethereum should be much stronger than Bitcoin.

Who Will Bear the Reconstruction Costs

Banks need to redo inventory, replacement, compatibility testing, and historical system migration, which is a massive engineering task, but the budget and schedule can be unified by management, and regulators and vendors can also push together. The costs are centralized, and the path is clear.

Bitcoin's costs are dispersed among individuals. Wallets, exchanges, node operators, and holders must upgrade independently, with no guarantee of synchronization. Those who can actively migrate can reduce risks, while those who have lost their private keys or no longer operate old wallets have no such option.

The beneficiaries on both sides are also different. Quantum hardware companies can improve machine utilization with more efficient algorithms; the migration to post-quantum cryptography represents a new business for security service providers.

The Next "53 Hours"

Anthropic's method is straightforward: write the problem as code, pair it with an automatic scoring program, focus on a single metric, and let the model iterate continuously for several days. Anthropic stated in the original text that error correction codes, decoders, and hardware controls also share similar characteristics, allowing AI to jointly optimize and design a fault-tolerant quantum computer tailored to specific problems.

Currently, these layers are mostly designed separately. If the next round of "53 hours" targets these layers, how much will the total bill become? No one has disclosed this yet. This does not mean that AI will soon be able to independently design a quantum computer to crack Bitcoin; research is still limited by task definitions, evaluation methods, and verification scopes.

However, it is conceivable that migration will take years to coordinate, while the cost curve for attacks does not wait for anyone.

Banks can advance according to the 2030 timeline, and Bitcoin already has a draft. However, some coins will neither migrate actively nor necessarily have anyone holding the private keys. By the day when upgrades become unavoidable, the fate of these old assets with publicly disclosed public keys will have to be decided by whom?