Trail of Bits

Google tried to keep a quantum weapon secret using zero-knowledge proofs. It lasted 63 days. In March, Google Quantum AI published a new version of Shor's algorithm aimed at secp256k1, the elliptic curve that protects every Bitcoin and Ethereum wallet. It needs roughly 1,200 logical qubits, a dramatic improvement over everything before it. Then Google did something no one had done before. It didn't publish the circuit. It published a zero-knowledge proof that the circuit exists, which certifies the attack is real without revealing the attack. Then the experiment started to break. Six weeks later, @trailofbits found memory bugs in Google's Rust prover. They forged a valid proof for a circuit that claimed zero Toffoli gates, an attack that cannot exist. It passed verification with the same key as the original. Google patched it. On day 63, André Schrottenloher of Inria published his own circuits, rebuilt independently from Google's public papers. They matched Google's qubit counts and needed fewer gates. The hidden weapon was now open source, and slightly better. Google researcher Craig Gidney confirmed the match and wrote: "We should just publish openly." Zero-knowledge proofs were built to hide your balance, your identity, your vote. Here, a cryptographic tool was used to hide a weapon against cryptography, and both the hiding and the secret failed within one quarter. The lesson isn't that ZK is broken. A proof is only as honest as the code that checks it. And in mathematics, a secret doesn't stay a secret just because it's hidden: once the world knows an answer exists, someone finds it. The only thing still protecting Bitcoin from this attack isn't secrecy. It's hardware, and hardware gets better every year.