A Proposed ECDLP Algorithm Has Not Shown Bitcoin Is at Risk
A proposed subexponential algorithm for the elliptic-curve discrete logarithm problem has raised questions about Bitcoin’s cryptography. But the discussion does not show that the method works in practice, applies to Bitcoin’s curve, or poses a threat today.
- The proposal is described as impractical and relies on a separate, unverified claim.
- No demonstrated attack on Bitcoin’s secp256k1 curve is presented.
- Quantum-computing estimates circulating alongside the claim cannot be assessed without the original papers.
What the proposed algorithm claims
Bitcoin uses the secp256k1 elliptic curve for public-key cryptography. In simple terms, a private key lets its holder create a digital signature, while the corresponding public key lets others verify it. The system’s security depends on how difficult it is to work backward from the public key to the private key. This is known as the elliptic-curve discrete logarithm problem, or ECDLP.
A MathOverflow discussion of the proposed ECDLP algorithm links to a paper titled “A Subexponential Time Algorithm for Elliptic Curve Discrete Logarithm.” The discussion calls the proposed method “impractical.” On its own, it does not establish the paper’s publication status, validate its results, or show that the method can attack secp256k1.
The discussion also says the proposal depends on a separate claim attributed to OpenAI researchers about the Exponential Time Hypothesis, or ETH. ETH is a conjecture in theoretical computer science, not an established fact. The discussion provides too little detail to verify the claimed result or explain exactly how it would support an attack on the ECDLP. For now, that dependency remains unconfirmed, not an established breakthrough.
“Subexponential” describes how an algorithm’s resource needs grow as a problem gets larger. It does not mean “fast.” Large constants, narrow assumptions, or a threshold beyond practical key sizes can make an algorithm unusable in the real world.
Pollard’s rho is often cited as a general-purpose classical method for the ECDLP. The MathOverflow discussion describes the proposed work as impractical, but offers no curve-specific comparison showing that it outperforms Pollard’s rho on Bitcoin’s secp256k1.
Quantum estimates are a separate question
Classical algorithms and quantum attacks pose different threats. In theory, a sufficiently capable, fault-tolerant quantum computer could use Shor’s algorithm to recover private keys from exposed public keys. That would threaten Bitcoin’s elliptic-curve cryptography, but it would not put every Bitcoin wallet at risk in the same way.
Exposure depends on the Bitcoin output type and how it is used. For many common output types, the public key becomes visible when funds are spent. Some types reveal public-key information earlier. That distinction matters: a hypothetical attack could target keys available to it, but it would not magically reveal every private key at once.
Quantum resource figures attributed to Google and quantum-computing company Alice & Bob have also circulated, including estimates involving cat qubits and attack runtimes. Without the original papers and their assumptions, those figures cannot be responsibly presented as verified findings. Quantum-computing estimates about Bitcoin’s potential vulnerability need careful scrutiny. Logical-qubit and physical-qubit counts measure different things, and neither alone tells us whether a machine can carry out the required computation.
Any estimate depends on details such as the hardware model, error correction, algorithm, and which costs are included in the runtime. A resource estimate does not prove that a machine with those capabilities exists, nor does it offer a reliable timeline for building one.
What can be said about the warning
These developments are worth monitoring, but the evidence described here does not demonstrate a practical break of Bitcoin’s cryptography. The classical proposal appears in a user-contributed forum discussion, and the quantum figures lack the primary documentation needed to assess them.
An urgent warning has also been attributed online to Ledger CTO Charles Guillemet. Without a verifiable original post and date, neither his wording nor the precise context can be confirmed. Presenting an unverified attribution as a direct warning would be misleading. It would also be wrong to treat it as proof that Bitcoin is safe from every future cryptographic advance.
For users, the right response is attention, not panic. If credible evidence emerges that widely used signatures are vulnerable, affected systems would need carefully engineered changes and broad coordination. That is a serious long-term security concern, not evidence of an attack underway.
Key questions and answers
-
Does the proposed algorithm break Bitcoin’s secp256k1 today?
No demonstrated attack is presented. The discussion describes the method as impractical and does not show that it improves on existing approaches for secp256k1.
-
What could a quantum attack put at risk?
A sufficiently capable quantum computer could threaten exposed public keys by trying to derive their private keys. Exposure varies by Bitcoin output type and use, so not all funds face the same risk.
-
Are the reported quantum resource estimates verified?
They cannot be assessed without the original papers and their hardware and error-correction assumptions. Physical-qubit counts and logical-qubit measures are not interchangeable.
-
What should readers watch for?
Look for the primary ECDLP paper, an independent technical assessment, curve-specific analysis of secp256k1, and full documentation behind any quantum estimates. Until then, dramatic claims are leads to investigate, not proof of a current vulnerability.
