Project Eleven awarded independent researcher Giancarlo Lelli one bitcoin, worth approximately $78,000, after he claimed to have carried out the largest public quantum attack on elliptic curve cryptography (ECC) to date.
The company stated that Lelli used a publicly available quantum computer and a version of Shor's algorithm to recover a 15-bit elliptic curve private key from its public key. The attack covered a search space of 32,767 combinations.
Project Eleven claims this result is 512 times better than its previously disclosed performance. The previous benchmark, conducted in September 2025, reportedly saw engineer Steve Tippeconnic break a 6-bit ECC key on IBM’s 133-qubit quantum system.
The company stated that this result is significant because Bitcoin, Ethereum, and many other blockchains rely on elliptic curve cryptography (ECC) for wallet signatures. An estimated $2.5 trillion in digital assets use the same security model.
The real threat is still far from Bitcoin's scale.
Bitcoin uses 256-bit elliptic curve cryptography, far exceeding the 15-bit key used in this test. Project Eleven believes the remaining gap is now more a matter of engineering scale than fundamental science.
It cites recent academic estimates indicating that the hardware requirements for a full-scale attack are relatively low. Google research paper estimated in April 2026 that fewer than 500,000 physical qubits would be sufficient to break 256-bit ECC.
A subsequent paper by researchers at Caltech and the startup Oratomic suggests that in neutral atom designs, the number of qubits could be as low as 10,000. Current quantum systems are far below this level.
The company also stated that approximately 6.9 million bitcoins are stored in wallets whose public keys have been exposed on the chain and would become direct targets in the event of a large-scale quantum attack.
Related:Coinbase alerts to quantum risks facing Bitcoin and crypto wallets
The developer said the results are noise, not progress.
This news was quickly opposed by Bitcoin developers and security researchers. Bitcoin developers Jonas Schnelli and James O'Brien argued that the results did not demonstrate true quantum advantage.
Their view is that classical filtering and post-processing found the answer, and the quantum hardware output itself added no useful signal.
Researcher Yuval Adam publicly raised the sharpest criticism, stating that he copied the winning code, removed the IBM quantum hardware calls, and replaced them with random bytes, yet still recovered the same key.
According to Adam, the software accepts candidate values until one passes the standard mathematical verification steps. After enough random guesses, a valid answer will eventually be found.
He said that the flagship 17-digit operation used 20,000 attempts with a modulus of 65173. He estimated the success rate of random guessing alone to be approximately 26%. In his own tests, two out of five attempts succeeded.
His conclusion is that the system behaves like a brute-force search using an expensive source of random numbers, rather than an efficient quantum cryptanalysis attack.
Related:Ripple sets goal to make XRP Ledger quantum computing-ready by 2028