Giancarlo Lelli used a variant of Shor's algorithm on publicly accessible quantum hardware to derive a private key from its public counterpart, claiming Project Eleven's Q-Day Prize and advancing the timeline for practical quantum attacks on cryptographic systems.
Giancarlo Lelli has won one bitcoin — worth roughly $77,500 at current prices — for breaking a 15-bit elliptic curve key on a publicly accessible quantum computer, the largest such attack ever executed on real hardware.
The bounty came from Project Eleven, a post-quantum security firm that launched the Q-Day Prize in late 2025 to incentivise researchers to push the boundary of what quantum machines can actually do to the cryptography underpinning bitcoin and most of the internet. Lelli used a variant of Shor's algorithm to derive a private key from its corresponding public key across a search space of 32,767 possibilities. The previous record — a 6-bit demonstration by Steve Tippeconnic in September 2025 — covered a search space of just 64.
That 512-fold increase matters more than it might sound. Quantum computing progress isn't measured in the tidy doublings that classical hardware follows; each additional bit of key length exponentially increases the computational burden. Lelli's result doesn't threaten bitcoin's 256-bit elliptic curve security — the gap between 15 bits and 256 bits is astronomical — but it demonstrates that practical quantum attacks on real cryptographic systems are accelerating faster than many in the industry assumed.
Project Eleven, which raised $20 million in a Series A earlier this year, designed the prize to produce empirical benchmarks rather than theoretical estimates. Most projections for when quantum computers will crack bitcoin's cryptography rely on extrapolations from laboratory conditions and unpublished hardware specifications. The Q-Day Prize demands that entrants use publicly accessible machines and publish their methods, creating a verifiable record of what current technology can and cannot do.
The timing adds weight to a debate that has consumed bitcoin's developer community for months. Roughly 6.9 million bitcoin — about a third of total supply, including Satoshi Nakamoto's estimated one million coins — sit in wallets whose public keys are already visible on-chain. These coins are stored in older address formats that published the public key by default, or in wallets that have been spent from at least once, which reveals the key for whatever balance remains. A sufficiently powerful quantum computer could, in theory, derive the private keys for all of them.
Ethereum has responded with a coordinated, well-funded post-quantum migration plan. Bitcoin has not. The network's anti-centralisation culture makes large-scale protocol changes exceptionally difficult to push through; its governance, such as it is, treats any central authority as a design failure. The result is a slow-moving standoff in which everyone agrees the threat is real but nobody can agree on what to do about it.
Resource estimates for a full-scale attack on 256-bit elliptic curve cryptography have been falling. Current projections suggest a quantum computer would need fewer than 500,000 physical qubits to break bitcoin's key scheme — still far beyond the capabilities of today's machines, which top out in the low thousands, but no longer the kind of number that allows the industry to dismiss the problem as a concern for the next generation. IBM's roadmap targets 100,000 qubits by 2033; Google has made similar commitments.
Lelli's achievement won't keep anyone at Coinbase or Fidelity up at night. But it moves the conversation from "if" to "when" in a way that theoretical papers and conference talks do not. A working demonstration on publicly accessible hardware carries a rhetorical force that equations on whiteboards lack — it is the difference between knowing a lock can be picked and watching someone pick it.
The Q-Day Prize remains open for further submissions. Project Eleven has said it will increase the bounty as researchers push into higher bit ranges, though it hasn't specified by how much. The firm is also working with the Solana Foundation on post-quantum security for that network, and its Series A backers include several institutional investors who have publicly expressed concern about the quantum timeline.
For bitcoin, the uncomfortable fact is that the network's greatest strength — its resistance to top-down change — is also the quality that makes it most vulnerable to a threat requiring coordinated, urgent action. The 15-bit key Lelli broke is a toy by cryptographic standards. The 256-bit keys protecting $1.5 trillion in value are not.
