# ECDSA secp256k1 attacks

Are there any known and feasible ECDSA attacks on secp256k1 which can reduce the bit security of the algorithm? For example from 256 bits of security down to 192 bits?

Yes. Pollard's $$\rho$$, a generic method to compute discrete logs, costs only about $$2^{128}$$ group operations for a group of order about $$2^{256}$$ so secp256k1 should be considered to have a ‘128-bit security level’, not a ‘256-bit security level’, against discrete logs. But a 128-bit security level is enough to thwart all adversaries—at least, the ones who don't have a quantum computer or a cryptanalytic breakthrough against secp256k1 in particular.