Brevis at ECDSA.Fail: A Hundred Agents, One Quantum Circuit, an 86% Cut

2026-09-11

[read_meter]

TL;DR: We spent the summer pointing AutoEng, our autonomous optimization agent, at ECDSA.Fail, an open challenge to work out how cheaply a quantum computer could break the cryptography protecting crypto wallets. More than a hundred people and their AI agents cut the cost of the core operation by 86.1%, past the best figure Google Quantum AI has reported. AutoEng held the top of that leaderboard for some time along the way. The paper is now on arXiv, our engineer Zhao (Ben) Huang is one of its leading authors (3rd), and other Brevis engineers are also named contributors.

What We Joined

Every Bitcoin and Ethereum wallet is protected by the same kind of math, an elliptic curve signature. There is a known quantum algorithm, Shor’s, that would break it given a large enough quantum computer. That algorithm works by repeating one small operation, adding two points on a curve, an enormous number of times. Make that single operation cheaper and the whole attack gets cheaper, which means it needs a smaller machine and arrives sooner. Knowing how cheap it can get is how the industry knows how much time it has.

ECDSA.Fail, launched on 30 May by Eigen Labs and organized alongside the Ethereum Foundation, put that question on a public leaderboard. Every submission was scored on a single number: how many qubits the circuit needs, multiplied by how much expensive gate work it performs. In plain terms, how big the quantum computer has to be times how hard it has to work. Lower is better. Anyone could enter, with no affiliation and no approval, and a locked evaluator decided every score.

The starting circuit scored 10.75 billion. Eight weeks and four hundred accepted submissions later, the best score was 1.496 billion, an 86.1% cut, and below the figure Google Quantum AI published for the same operation earlier this year. This is a leaderboard score, not a working attack, and nobody’s wallet is less safe this week. This helped the community have a more accurate estimate for a post-quantum migration timeline.

What AutoEng Did

We entered with AutoEng, the autonomous optimization agent we published in July. AutoEng runs the full performance-engineering loop with no human approving any step. It profiles the live system, picks the highest-value bottleneck, writes a candidate fix, and keeps it only when measurement proves the change both correct and faster.

The model proposes but never judges.

We built it to be general and pointed it first at the hardest system we had. On Pico, our zkVM, already tuned by experts for years, it found an 11% end-to-end speedup in under three days. ECDSA.Fail was the same loop pointed at something completely different: not our code, not our language, not even classical computing. Different hardware, different math, same recipe. An objective a machine can check, and an agent that keeps only what survives the check.

It worked. AutoEng held the top of the leaderboard for some time during the challenge, ahead of Google’s reported circuit. That is the part we find most useful. A loop we wrote to speed up a zkVM went and competed at the frontier of quantum circuit design without being redesigned for it.

Our Role in the Paper

The write-up went beyond the circuits we submitted. Appendix A credits our engineer Zhao (Ben) Huang, alongside Theodore Pender, Manuel B. Santos and Samrendra Kumar Singh, with “major technical and empirical sections, including the quantum-circuit background, circuit-optimization analysis, results, and Pareto-frontier analysis.” He is the third of roughly thirty-five authors. Our CEO and CTO are also named leaderboard contributors.

Section 4 of the paper sets out what actually worked across a hundred independent teams, and the answer is a specific engineering discipline:

Reusable agent skills, so a technique learned once can be invoked again later
Long-running loops that repeat the propose-test-measure cycle with little supervision
Parallel agents kept apart, each working in its own isolated copy of the code so nothing contaminates anything else
A shared memory of experiments that keeps failures on the record instead of deleting them
Cheap tests first, so only survivors ever reach the real evaluator

These are the same techniques that make up AutoEng.

Why This Matters to Us

This proves humans and AI agents working together can do frontier research, on a real open problem, and significantly beat the status quo. The problem here was genuine, an open question specialists had been chipping away at for years. A hundred people and their agents took 86% out of it in eight weeks, in public, with every step on the record.

For us the sharper result is what AutoEng has now done twice, in two places with nothing in common. It found most of the improvement behind Pico Prism 2.1, which proves 99.9% of Ethereum mainnet blocks in under ten seconds at the 60M gas limit, averaging 4.87 seconds end to end. Then the same loop went and competed at the top of a quantum circuit leaderboard, in a field we do not work in, against people who do. One method, two unrelated frontiers, both settled by measurement rather than opinion.

That is a shift worth paying attention to. Optimization at the frontier has always been the slowest craft in engineering, gated on a small number of specialists and years of accumulated intuition. It is becoming something you can run, in parallel, against any problem where progress can be measured. Brevis now sits at the center of that, because we build both halves: the agent that does the work, and the proving systems that make results checkable in the first place.

We are going to keep pushing on both. More of our own stack as well as wider, because nothing about the loop is specific to zero-knowledge, and ECDSA.Fail is our evidence for that.

The paper is available on arXiv: arxiv.org/pdf/2609.09582, and the challenge’s full public record lives at ecdsa.fail.

About Brevis

Brevis is a verifiable computing platform powered by zero-knowledge proofs, serving as the infinite compute layer for Web3. Applications can offload expensive computations off-chain while proving every result on-chain. The Brevis stack includes Pico zkVM for general-purpose computation, the ZK Data Coprocessor for trustless access to historical blockchain data, Pico Prism for real-time Ethereum block proving (99.8% coverage on 16 GPUs, hitting the Ethereum Foundation’s $100K hardware target), Vera for ZK-proven media authenticity, and ProverNet, the decentralized marketplace for ZK proof generation now running on mainnet. To date, Brevis has generated 340M+ proofs across 50+ protocols on 8+ blockchains.