Google withheld an ECDSA circuit. It lasted nine weeks.

On 31 March, Google's quantum team published a resource estimate for the elliptic-curve discrete log problem and withheld the circuit behind it.

The estimate covers point addition on secp256k1, the primitive Shor's algorithm repeats inside a windowed phase-estimation loop to recover a private key: roughly 1,175 logical qubits and 2.6 million Toffoli gates, about 3.0 × 10⁹ on the qubit-Toffoli product. In place of the construction, Google published a zero-knowledge proof that a circuit meeting those counts exists. The stated reason was responsible disclosure, reportedly at US government urging.

Two things then happened to that decision:

• The prover, not the proof. In April, Trail of Bits found memory-safety and logic bugs in Google's Rust prover, enough to forge a proof for a claim that was not true. The protocol was sound. The implementation was not, and the disclosure format put that implementation beyond anyone's reach to audit.
• The construction, from the literature. On 2 June, André Schrottenloher published open circuits reconstructed from Google's own prior published work. Space-optimised: about 1,192 logical qubits against Google's 1,175. Gate-optimised: 1,446 against 1,425, with roughly 10% fewer Toffolis. No leak, days of work, and the load-bearing ideas were already in print.

Craig Gidney, who designed the originals, wrote afterwards that open publication would have been the better path. Nine weeks from announcement to independent reconstruction.

The full attack moved just as fast. It now sits near 1,460 logical qubits and 56 million Toffolis, against roughly 200 million under 2023 constructions: half the qubits and a third of the gates in a year.

What ecdsa.fail scores

Eigen Labs turned point addition into a leaderboard. Submit a circuit computing the same function at a lower qubits × Toffolis product.

The verification is what makes the score mean anything:

• Reversible circuit, checked over 9,024 test cases
• Ancillas uncomputed back to zero
• Circuit composed with its inverse must restore the input state exactly

Nothing here executes. No QPU, no simulator, nothing close: these circuits are orders of magnitude past runnable, and every entrant knows it. On hardware you can book today, factoring 35 fails because the circuit runs long enough that noise dominates the output before filtration helps.

A mechanically checkable objective is one an agent loop can grind against, and several entrants wired LLMs straight into the harness. As of late August 2026 the board sits near half of Google's cost and moves most days, now in fractions of a percent. The remaining headroom is smaller than that churn suggests: the arithmetic floor for a 256-bit prime is around 2n qubits, roughly 500, so getting from ~1,150 down to it is a factor of two rather than another order of magnitude.

doubleAI's WarpSpeed reports 1,205 qubits and 993,181 Toffolis: 1.20 × 10⁹ against the board leader's 1.49 × 10⁹ and Google's ~3.0 × 10⁹. It skipped the truncated-Schrottenloher inverse the board had been optimising and used a Kaliski almost-inverse instead, with an AVX-512 simulator checking 512 inputs per pass. Days of work, under $5k in tokens. Along the way it found a sandbox escape in the evaluation harness: constructor functions in a submitted Rust binary run before main, so a submission could execute code inside the grader before its circuit was ever evaluated. Reported and patched before use.

The circuit itself is unpublished. What doubleAI released is a zero-knowledge proof of its cost, the same disclosure move Google made in March, from the team that had just beaten it.

Checkable, not open

"Open wins" is the wrong reading, because a closed team currently holds the best number: what survives the episode is checkable versus not.

Schrottenloher's reconstruction was possible because Google's prior work was published. The leaderboard means something because its verifier is public and deterministic. Trail of Bits found the forgery path because they could reach the binary. The one artifact nobody could examine is the one that failed.

And of everything produced across five months, only the published circuits are usable by anyone else. Google's and WarpSpeed's are, from outside, indistinguishable from claims that are wrong.

So the conclusion is not that Google should have published. It is that publishing norms did not settle this and a verifier did. WarpSpeed withheld its circuit and took the top score anyway, so the norm plainly does not bind. What made both withheld circuits irrelevant was that anyone could check a better one inside a quarter. If you want a field where secrecy does not pay, build the checker rather than argue for openness.

Which is easier said than done, because a checker needs a scalar. Point addition has one. So do a handful of other quantum problems: circuit optimisation against a fixed unitary, state preparation to a target fidelity on a fixed gate budget, decoder design scored on logical error rate under a fixed noise model. Most work has none, and for that the closest substitute is an artifact someone else can fork and run: a much weaker check, and still the whole difference between a claim and a result.