Claude Mythos 5 Cuts Quantum Gates 17x: What It Means for Bitcoin Security

Anthropic says Claude Mythos 5 designed a quantum circuit with 17x fewer gates. Here is what the research means for Bitcoin and crypto security.

On October 16, 2026, Anthropic published research showing that Claude Mythos 5 can design quantum circuits that beat the best published versions. One of the results touches the math that protects Bitcoin wallets, and that’s why crypto readers are talking about it.

You’ll see headlines saying Claude cut quantum gates by 17x. The number is real, but it needs context. It describes a circuit design on paper, not a working machine that can attack a wallet.

In this piece, I’ll walk through what Anthropic reported and how it fits with earlier work from Google. I’ll also cover what Bitcoin developers are doing about quantum risk. Every fact links to the source behind it.

Key takeaways

• Anthropic says Claude designed more efficient circuits across eight quantum computing tasks.
• For elliptic-curve point addition, one design uses 17x fewer gates but 12% more qubits than the smallest earlier design.
• This is a design on paper. No quantum computer today can break Bitcoin keys.
• Bitcoin developers have a draft proposal, BIP 360, but it isn’t active on the network.

What did Anthropic announce about quantum circuits?

Andi Gu led the project through Anthropic’s STEM Fellows Program, with mentoring from quantum physicist Alek Kemeny. Susanne Yelin of Harvard and Mikhail Lukin of Harvard and QuEra Computing collaborated, according to Anthropic’s research post. You can read the full study as a paper on arXiv.

The team gave Claude plain-language descriptions of eight quantum circuits, drawn from chemistry, optimization, physics simulation, and number theory. An automated evaluator checked each design for correctness and gave it a score.

Claude Mythos 5 worked in a loop. It proposed a design, got a score back, and used that feedback to try again. Anthropic says no human stepped in between rounds.

The score was simple: qubits multiplied by gates. Anthropic uses that product as a rough measure of how long a circuit would take to run. The company says Claude beat the best published circuits, sometimes by an order of magnitude or more.

What are qubits and Toffoli gates?

Normal computers store information in bits that are either 0 or 1. Quantum computers use qubits, which can hold a mix of states at once. Anthropic notes that today’s machines have only hundreds to thousands of qubits.

Qubits are also fragile. Heat, vibration, and even cosmic rays can knock them off course, and small errors add up. That’s why researchers want circuits that need fewer qubits and fewer steps.

A gate is a basic operation on qubits. According to Anthropic, the Toffoli gate is one of the most expensive to run, so counting Toffoli gates is a standard way to estimate how long a computation will take.

Anthropic gives an example of why this matters. In 2017, researchers estimated that simulating a molecule called FeMoco would take about 50 trillion Toffoli gates. Later algorithm advances brought that down to about 340 million, a roughly 150,000-fold drop. Anthropic says most of that came from redesigning circuits, not from better hardware.

How did Claude improve elliptic-curve point addition?

Anthropic’s first task for Claude was point addition, a rule for combining two points on an elliptic curve to get a third. Anthropic explains that it’s the core step in quantum algorithms for the elliptic-curve discrete logarithm problem.

Here’s the problem in plain terms. Take a starting point and add it to itself n times. If you’re only given the result, can you find n? Ordinary computers can’t do that for large curves in any reasonable time, but a big enough quantum computer could.

Most of the cost of point addition comes from one step, modular inversion. Ordinary computers handle it well with a method called divsteps. On a quantum computer, though, divsteps hit a memory problem. Every step needs a record of which operation was chosen, and a quantum circuit has to keep that record so it can run in reverse.

Claude’s idea was to skip storing the record. It reasoned that the numbers themselves could reveal what happened. Early decoding rules worked on small tests but failed on full 256-bit numbers. So Claude proved new algebraic identities, derived an exact decoding formula, checked it with large simulations, and formalized the claim in Lean.

Anthropic says this took a single 53-hour run. The prompt was a one-paragraph brief, and humans only nudged Claude now and then to think more broadly. Claude then built a family of designs that trade qubits against gates. One circuit uses 12% more qubits but 17x fewer gates than the smallest earlier design. The Quantum Insider reports that one complete benchmark circuit used about 4 million Toffoli gates and 935 qubits.

What else did the research show?

Point addition wasn’t the only result. Claude also redesigned a decoder used in decoded quantum interferometry, an optimization algorithm. Anthropic says the new decoder needs 12 times fewer gates than Google’s earlier construction.

To get there, Claude ran 403 million sample decodings to see how often rare exceptions actually happen. That let it reserve 19 qubits instead of 665 for the worst case. About one run in 10,000 needs more room and fails, which Anthropic says the task allows.

Why was Claude a good fit for circuit design?

Anthropic gives three reasons. Circuits can be written as code, so Claude can write, run, and revise them like ordinary programs. The algorithms it targeted are easy to test, because each input gives one definite answer an ordinary computer can check. And the team could give Claude a clear score to improve.

Quantum circuits also play by strict rules. They can’t make if-then decisions like normal programs, because a circuit works on many inputs at once. They can’t throw away scratch work either, since every step has to be reversible. The only way to clear information is to run the computation backward, which costs extra gates.

Anthropic says the gains came from new insight, not fine-tuning. For an iron-sulfide molecule, Claude noticed that symmetries let some results be calculated once and reused. Elsewhere, it removed costly parts that only existed to handle extremely rare inputs.

Why does elliptic-curve math matter for Bitcoin?

Bitcoin proves ownership with digital signatures, and those rely on elliptic-curve cryptography. Bitcoin uses a specific curve called secp256k1. A talk abstract from Google Quantum AI researchers calls secp256k1 the core of modern blockchain cryptography.

The link to point addition is direct. A private key is the hidden number in the discrete logarithm problem. If a quantum computer could solve that problem for secp256k1, it could work out a private key from an exposed public key.

That’s why any gain in point-addition efficiency gets attention. A cheaper circuit means a smaller quantum computer or a shorter runtime for the same attack. According to Physics Magazine, a classical computer would need a billion years or more to break an elliptic-curve system.

Does this make Bitcoin easier to break today?

No. A few limits apply, and headlines often skip them.

First, the hardware doesn’t exist. Physics Magazine says current quantum computers are too small and too error-prone to break elliptic-curve cryptography. Machines can now have more than 1,000 qubits, which is far below what the estimates below call for.

Second, point addition is just one building block. Anthropic notes that these algorithms perform point addition many times, so one circuit isn’t a full attack. Anthropic also doesn’t claim a new total estimate for breaking Bitcoin.

Third, the 17x figure compares designs. Claude’s circuit uses 12% more qubits than the smallest earlier design, so the gain comes with a trade-off. Anthropic’s comparison table cites designs by Schrottenloher and Luo et al..

The bigger warning came earlier. In March 2026, Google Quantum AI and co-authors published Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities in PRX Quantum. An abstract of the work says Shor’s algorithm for secp256k1 could run with up to 1,200 logical qubits and 90 million Toffoli gates, or up to 1,450 logical qubits and 70 million Toffoli gates.

Physics Magazine sums up the physical-hardware picture. The team estimates about 500,000 physical qubits and roughly 80 million gates on a superconducting machine, with a runtime under 10 minutes. That’s a factor of 20 below earlier estimates. A separate estimate from Oratomic suggests 26,000 atom-based qubits could do it in several days.

Google didn’t publish its attack circuit, which I’ll explain below. Physics Magazine adds that quantum information expert Scott Aaronson finds the results reasonable, though details remain unsettled. One more caution: don’t compare Anthropic’s single-circuit numbers directly with Google’s whole-attack numbers.

How are researchers handling disclosure?

Google chose not to publish its attack circuit. According to Physics Magazine, the team used a zero-knowledge proof to show its estimates were valid. The proof confirms the circuit’s size and function without revealing the design.

The plan had limits. Physics Magazine reports that a cryptographer used the limited information to rebuild a full algorithm, which Schrottenloher posted online. It shows how quickly public research can fill in gaps.

Anthropic took a different route for its circuits. It published a post and a paper, and its table names the earlier designs it compares against. That makes it easy for readers to check any headline number.

Which Bitcoin coins face the most quantum risk?

Risk depends on whether a public key is visible. The BIP 360 draft describes two cases. Long-exposure attacks go after keys that sit on the blockchain for a long time. Short-exposure attacks go after keys that are revealed briefly while a transaction waits for confirmation.

The BIP 360 authors say Bitcoin addresses aren’t quantum resistant today, and they name Taproot addresses and Satoshi’s coins specifically. Physics Magazine says a runtime under 10 minutes could threaten transactions that reveal a key for a short time. Both point to the same thing: exposed keys are the weak spot.

What is Bitcoin doing about quantum risk?

The leading proposal is BIP 360, which defines a new output type called Pay-to-Merkle-Root, or P2MR. It works a lot like Taproot but removes the key-path spend that exposes a quantum-vulnerable key. The BIP itself lists its status as Draft.

According to Bitcoin Magazine, the proposal was merged into the official BIP repository. Co-author Hunter Beast calls it a first step in a larger set of quantum-resistance proposals. Still, merging a draft doesn’t activate anything on the network.

It has limits, too. BIP 360 doesn’t replace Bitcoin’s current signatures with post-quantum ones. The draft itself says stopping short-exposure attacks likely needs genuine post-quantum signatures, which are outside its scope.

What do official post-quantum standards say?

Outside Bitcoin, governments have already moved. On August 13, 2024, NIST finalized its first three post-quantum encryption standards: FIPS 203, FIPS 204, and FIPS 205. NIST says they’re ready for immediate use and encourages administrators to start transitioning as soon as possible.

NIST has also released a draft transition report, known as IR 8547. Analysis of the draft says it proposes deprecating RSA and 112-bit elliptic-curve algorithms after 2030 and disallowing them after 2035. Those dates are proposals, not final.

Could AI speed up the quantum timeline?

Anthropic thinks so. The company says improvements like these substantially cut the quantum resources useful applications need, so practical quantum computers could arrive sooner than expected. That’s Anthropic’s own claim, so weigh it that way.

The company offers one comparison. The 150,000-fold drop in the FeMoco estimate took many research groups eight years. Claude’s elliptic-curve design came out of a single 53-hour run. Anthropic also floats a bigger idea: AI could optimize everything from algorithms to hardware to build an error-corrected machine for one specific problem.

Outside experts urge caution on timelines. Stephanie Simmons of Simon Fraser University told Physics Magazine that large-scale quantum computers may become available in a few years. She also warned that the public state of the art probably lags the real one. So treat every date as uncertain, and remember the firmest dates come from standards bodies, not from physics.

What should crypto holders and publishers take from this?

There’s no reason to panic. Nothing in Anthropic’s research shows a wallet has been attacked, and the hardware to do it doesn’t exist. Still, the direction is clear. Circuit designs keep getting cheaper, and Anthropic itself says practical quantum computers could arrive sooner than people thought.

If you hold Bitcoin, follow updates from your wallet developers and the Bitcoin Core discussion of BIP 360. If you write about this, link to primary sources and keep resource estimates separate from working machines. That distinction is the heart of this story.

What are the limits of Anthropic’s research?

Anthropic is upfront about the limits. Early on, Claude was cautious. It second-guessed apparent improvements and leaned toward well-known approaches. The team required parallel approaches and sometimes prompted Claude to broaden its search.

Circuit design is also only one piece of a useful quantum computer. Anthropic points to error-correcting codes, fast decoders, and hardware control as other pieces. And the results are designs checked by an evaluator program, not circuits that have run on a real quantum computer.

FAQ

Did Claude Mythos 5 break Bitcoin?

No. Anthropic reported more efficient circuit designs. It didn’t report an attack on Bitcoin or any wallet.

What does 17x fewer gates mean?

One point-addition circuit uses about 17 times fewer Toffoli gates than the smallest earlier design. According to Anthropic, it needs 12% more qubits to do that.

How many qubits would a Bitcoin attack need?

Google Quantum AI’s paper estimates up to 1,450 logical qubits, or about 500,000 physical qubits on a superconducting machine. Those are estimates, not demonstrations.

Is Bitcoin working on a fix?

Yes. BIP 360 proposes a quantum-resistant output type. It’s a draft and isn’t active on the network.

What should Bitcoin readers watch next?

Five things will show whether the risk is growing or shrinking.

• Independent review of Anthropic’s arXiv paper and its point-addition numbers.
• Any move to activate BIP 360 or a follow-on proposal for post-quantum signatures.
• Final publication of NIST’s transition plan after the IR 8547 draft.
• Progress in logical qubit counts and error correction on real hardware.
• New resource estimates for secp256k1 from Google, Oratomic, or other groups.

Each of these is a place where a reported number could change, so check them before you write your next update.

Conclusion

So what should you take away from all this? Anthropic showed that an AI model can help redesign quantum circuits, and one of its results touches the math that protects Bitcoin. What it did not show is a working attack. On paper, the cost of a future attack keeps dropping. Meanwhile, the defenses, like BIP 360 and the NIST standards, are still being built. It’s a race, and it’s worth watching both sides of it.