Our Mochimo developer moved the frontier on ecdsa.fail on 23 October.

The submission takes 460 Toffoli gates off the best-known circuit at 1,236 logical qubits, landing at 742,306.

ecdsa.fail is the public leaderboard for attacking secp256k1.
7
1
4
14
381
Replying to @mochimocrypto
1/

secp256k1 is the curve used for Bitcoin and Ethereum signatures. The board scores submissions on logical qubits multiplied by Toffoli gates. The first sets how large a machine has to be; the second sets how long it has to run.
1
0
2
67
Replying to @mochimocrypto
2/

The improvement is 0.062%, which is small and worth calling small. The board records 1,265 frontier advances from 81 solvers. It moves in increments like this one, which is the reason the aggregate is worth watching at all.
1
0
2
30
Replying to @mochimocrypto
3/

One piece of arithmetic the page leaves to you: 742,306 x 1,236 = 917,490,216. The entry listed as the low Toffoli record is 740,798 x 1,240 = 918,589,520. Fewer gates, more qubits, larger product.
1
0
0
15
Replying to @mochimocrypto
4/

So this is not the low Toffoli record, and not the low qubit record, which sits at 660 qubits. It is a point on the Pareto frontier with a smaller qubit-times-Toffoli product than the record point above it. Multiply them yourself.
1
0
0
15
Replying to @mochimocrypto
5/

Now the part worth sitting with. Mochimo does not use secp256k1. It has signed every transaction with WOTS+ since 2018. A Mochimo developer spent the night making the quantum attack on a signature scheme Mochimo does not use measurably cheaper.
1
0
0
14
Replying to @mochimocrypto
6/

We have spent a week telling people to watch one number on this board and to ignore headlines that leave it alone. You cannot ask people to watch a number and then decline to help measure it. The board is now 69.3% ahead of Google’s circuit, from 68.6% on 19 October.

Oct 22, 2026 · 10:37 PM UTC

1
0
0
21
Replying to @mochimocrypto
7/

The usual caveat, unchanged. This is a resource estimate checked by a classical evaluator. No quantum computer has run anything, and no full Shor estimate has been published on any of these circuits. The number is a measurement, not a countdown.
0
0
0
26
RepliesRelevant