First Quantum-Safe Bitcoin Transaction: What QSB Proves

Table of Contents

26 Aug 2026 – A Bitcoin transaction designed to resist a quantum computer running Shor’s algorithm was confirmed in block 964,199. The transaction ID is 305a24ff…ab07. StarkWare described it as the first quantum-safe Bitcoin transaction mined on mainnet.

Avihu Levy, general manager of applications at StarkWare, designed the method, called Quantum Safe Bitcoin (QSB). StarkWare engineer Tomer Giladi brought the construction to a working mainnet transaction. Levy published the underlying research and open-source implementation on 9 April 2026.

The transaction took 39,179 and 10,000 satoshis as inputs, sent 44,000 to the protected output, and paid 5,179 in fees, according to the Blockstream record cited by The Defiant. It was 1,403 bytes.

QSB adds a quantum-resistant lock alongside Bitcoin’s existing elliptic-curve cryptography, built on the pre-image resistance of RIPEMD-160 rather than the secp256k1 curve. The technique builds on Binohash, a transaction-introspection scheme developed by BitVM creator Robin Linus of ZeroSync and Stanford University. Levy replaced Binohash’s signature-size proof-of-work puzzle, which Shor’s algorithm would break outright, with a hash-to-signature puzzle whose security depends on hash-function pre-image resistance.

The construction uses a technique called signature grinding. Before broadcast, the sender spends extensive off-chain computation searching through the order of 2^46 candidate signatures, until the resulting hash forms a valid signature that never exposes the elliptic-curve key data a quantum computer could exploit. Levy’s recommended configuration estimates approximately 118-bit second pre-image resistance against an attacker using Shor’s algorithm.

Levy’s April 2026 paper estimated the off-chain computation at $75 to $150 in cloud GPU time. StarkWare said the completed mainnet transaction cost several hundred dollars in GPU compute. The transaction was nonstandard under Bitcoin Core relay policies, so it could not propagate through the public mempool. StarkWare submitted it through MARA Pool’s Slipstream service, which sends transactions directly to MARA’s mining infrastructure. Mempool.space labeled the spend “Non-Standard” and “Not seen in Mempool.”

QSB required no soft fork, hard fork, or protocol change – but StarkWare said it does not make Bitcoin quantum-safe. The method protects individual coin holdings only after they are moved into the QSB-protected output. It does not retrofit resistance onto ordinary ECDSA- or Schnorr-secured holdings and does not cover Taproot outputs or Lightning Network channels. Addresses whose public keys have already been exposed on-chain are beyond its reach.

“I still want Bitcoin to choose to do a soft fork and I expect we will get one,” StarkWare CEO Eli Ben-Sasson said. “What today’s successful transaction offers Bitcoin is a reassurance that holdings can be protected before that happens.” Levy called QSB a last-resort measure in his paper.

Developers are separately examining BIP-360, a proposed soft fork merged into the official Bitcoin BIP repository on 11 February 2026. Authored by Hunter Beast (MARA), Ethan Heilman, and Isabel Foxen Duke, BIP-360 introduces Pay-to-Merkle-Root (P2MR), a new output type that removes Taproot’s quantum-vulnerable key-path spend. Levy developed QSB independently; he is not a BIP-360 author.

A companion proposal, BIP-361, authored by Jameson Lopp and others and published in April 2026, outlines a phased sunset for legacy ECDSA and Schnorr signatures and proposes migration deadlines for quantum-vulnerable coins.

My Analysis

The Bottom Line

StarkWare proved that a single Bitcoin holder can protect a specific holding against a future quantum attacker without waiting for anyone’s permission. That is a genuine engineering achievement. It is also the limit of what happened on 26 August. The transaction moved 44,000 satoshis, about $35 at the time, into a hash-based construction that cost more to create than the coins were worth. Roughly 6 million BTC are held in addresses with public keys already visible on-chain, and this method cannot help any of them.

StarkWare drew the lines clearly. Much of the coverage called the transaction a “breakthrough.” Levy himself called it a last-resort measure. I side with Levy. The media framing overstated the scope; Levy described the role accurately.

What the Transaction Actually Demonstrates

QSB works because Bitcoin’s consensus rules are more permissive than most users realize. The network validates transactions against the opcodes that exist; it does not care whether the resulting construction is standard, efficient, or ergonomic. Levy exploited that permissiveness to build a spending condition whose security depends on RIPEMD-160’s pre-image resistance – a property that Shor’s algorithm does not threaten and Grover’s algorithm only halves. Here is how the mechanism works, and why those details determine whether the security claim is credible.

To understand what Levy solved, start with what Robin Linus built. Binohash, published earlier in 2026, was the first scheme to let a spender prove ownership of a legacy Bitcoin output using only existing Script primitives – no OP_CAT, no new opcodes, no soft fork. Its security depended on a proof-of-work puzzle over ECDSA signature sizes: the spender had to find a signature whose r-value was shorter than a known minimum, which is hard classical work. The problem, as Levy documented in section 2.8.1 of his paper, is that Shor’s algorithm makes that search trivial. An attacker with a quantum computer can compute the discrete log of any shorter r-value at will. Levy called this a total break, not a weakening.

QSB swaps out the broken component. Instead of a signature-size puzzle, it uses a hash-to-signature puzzle. The sender grinds through candidate signatures off-chain until the RIPEMD-160 hash of a recovered key happens to produce a valid DER-encoded signature. That signature is verified against a second recovered key via CHECKSIGVERIFY, binding the puzzle to one specific transaction. Five opcodes, down from Binohash’s thirteen. The sighash-flag vulnerability that made Binohash replayable across different transactions is closed by hardcoding SIGHASH_ALL.

The 118-bit figure determines whether the scheme can withstand a quantum attack. That is second pre-image resistance under the Shor threat model, meaning an attacker who has a cryptographically relevant quantum computer but tries to forge a QSB spend would face roughly $2^{118}$ work on the hash-based puzzle. RIPEMD-160 is a 160-bit hash, which retains about 80 bits of pre-image resistance against Grover’s quadratic speedup – a comfortable margin, though not the 128-bit floor that NIST’s post-quantum standards target for long-term security. The ECDSA signatures protecting standard Bitcoin transactions, by contrast, would face close to zero resistance from the same attacker. Shor reduces the elliptic-curve discrete-log problem from computationally infeasible to trivially solvable. The asymmetry between 118 bits and zero is QSB’s entire value proposition.

One detail that most coverage missed: QSB runs within Bitcoin’s legacy Script constraints of 201 non-push opcodes and 10,000 bytes. The script limits are restrictive, but QSB needs no protocol-level accommodation. Any miner who accepts nonstandard transactions can mine it. Bitcoin’s consensus layer already validates QSB transactions; only relay policy prevents propagation through the public mempool.

What It Does Not Prove

The list of things QSB leaves untouched is longer than the list of things it solves, and several of those gaps are structural.

It protects one output at a time. Coins must be actively moved into a QSB-protected construction. Every holding that stays in a standard P2PKH, P2WPKH, or Taproot output remains exactly as quantum-vulnerable as it was on 25 August.

The migration transaction itself is vulnerable. To move coins into QSB protection, the holder must first broadcast a standard Bitcoin transaction that exposes the public key during the confirmation window. A sufficiently fast quantum attacker could intercept during that window. The protection only begins after the exposure has already occurred. StarkWare acknowledges this.

It runs inside Bitcoin’s legacy Script envelope. Taproot key-path outputs, which store the tweaked public key unhashed by design, are not covered. Lightning Network channels are not covered. For protocol layers the Bitcoin community spent years developing, that exclusion is substantial.

It cannot help exposed keys. The approximately 6.04 million BTC with public keys already visible on-chain – Glassnode’s May 2026 figure, with a Google-linked analysis putting the number closer to 6.9 million – are beyond QSB’s reach. A separate estimate in the Quantum Horizon paper (arXiv 2606.14484, June 2026) treats roughly 2.3 million of those as irreducibly at risk – lost, dormant, or otherwise unmigratable – not merely coins in P2PK addresses. No technology, including QSB, can move those to safety because no one holds the keys to authorize the migration.

The economics do not scale. At several hundred dollars in GPU compute per transaction – Levy’s April paper estimated $75 to $150; the actual mainnet transaction cost more – QSB is a viable emergency vault for a whale protecting a large holding. It is not a payment mechanism. Bitcoin processed roughly 650,000 to 800,000 transactions per day in late August 2026. At even $75 each, QSB-protecting that throughput would cost $49 to $60 million daily in off-chain compute alone, before the on-chain fees.

Add these together: QSB can protect one holding at the moment the holder moves funds into it, and no more. It cannot be applied retroactively to exposed keys. It cannot scale to cover normal transaction volume. And it introduces its own window of quantum exposure during the migration step. For the roughly 6 million BTC with keys already on-chain – coins whose private keys a future quantum attacker could compute without waiting for a broadcast – QSB offers nothing.

Glassnode’s May 2026 data puts the exposure breakdown at 1.92 million BTC in structurally exposed P2PK addresses and 4.12 million exposed through address reuse, out of 6.04 million total. Exchange-labeled wallets account for 1.66 million BTC of the operationally exposed supply. Binance holds an estimated 85% of its bitcoin in addresses with exposed keys; Coinbase, 5%. Those numbers matter because exchange-held coins are the most actionable: a custodian who rotates to unexposed addresses and stops reusing them can reduce operational exposure without any protocol change. QSB is not needed for that. Basic key hygiene is.

The harvest-now, decrypt-later threat model that dominates PQC migration planning in enterprise IT does not map directly onto Bitcoin. The blockchain is a public ledger; there is nothing to harvest that is not already stored. Two types of quantum attack apply to Bitcoin: computing private keys from public keys already exposed on-chain, and forging a signature during the confirmation window before a transaction is mined. QSB addresses the second threat for a single transaction type at a high cost. The first threat, the larger one by value, remains a protocol-level problem.

QSB’s Political Significance

The QSB mainnet transaction is politically significant because it weakens the argument that Bitcoin cannot respond to the quantum threat without a contentious protocol upgrade.

That argument has been the primary obstacle. Bitcoin’s governance history offers a relevant precedent: Taproot took roughly four years from Maxwell’s January 2018 proposal to its November 2021 activation, and that was a relatively smooth upgrade. SegWit, the contentious one, took even longer. BIP-360 co-author Ethan Heilman has estimated that a post-quantum upgrade may take seven years. BIP-360 has been in the BIP repository since February 2026 and remains a draft, not scheduled for activation. That is a timeline measured in years, and I see no reason to expect it will compress.

The contrast between QSB and BIP-360 is instructive. QSB delivers immediate, individual protection at high cost and narrow scope. BIP-360 promises comprehensive, network-level protection at low per-transaction cost – but it requires a soft fork, community consensus, wallet updates, and a voluntary migration that could take years.

BIP-360 introduces Pay-to-Merkle-Root (P2MR), a new output type that preserves Taproot-style script trees while removing the key-path spend that exposes the public key. It is deployable as a soft fork using SegWit witness version 2 and does not require existing addresses or wallets to change. Post-quantum signatures, however, range from roughly 666 bytes for FALCON-512 to over 7,800 for SPHINCS+, against 64 for current Schnorr. That has direct implications for block throughput, fee economics, and the capacity of layer-2 systems like Lightning.

BIP-361 goes further. Jameson Lopp’s companion proposal outlines a phased sunset for legacy ECDSA and Schnorr signatures, which would effectively set deadlines for migrating quantum-vulnerable holdings. It acknowledges what the Bitcoin community has generally avoided stating: some coins – particularly the roughly 1.1 million BTC in early P2PK addresses attributed to the Patoshi mining pattern – may be permanently beyond anyone’s ability to migrate. BIP-361’s proposed response is a freeze: immobilizing those outputs rather than allowing a future quantum attacker to sweep them. That proposal was condemned as authoritarian and confiscatory within days of its publication – a reaction that illustrates the fault line any compulsory migration must cross.

Google Quantum AI’s March 2026 estimates put the resource requirement for breaking Bitcoin’s secp256k1 curve at 1,200 to 1,450 logical qubits and fewer than 500,000 physical qubits, with a runtime measured in minutes on a superconducting architecture. That is an engineering target, not a prediction – no such machine exists – but it is an order of magnitude smaller than the estimates from just three years ago. Bitcoin’s governance process is moving slower than the hardware threat. QSB buys time inside that gap, but it does not close it.

Meanwhile, the institutional response is accelerating. In July, nine institutions (Anchorage Digital, ARK Invest, BlackRock, Block, Blockstream, Coinbase, Fidelity Digital Assets, Galaxy, and Strategy) announced the Bitcoin Security Consortium with $15 million over three years directed at post-quantum development. Galaxy separately launched its own quantum readiness initiative with up to $5 million in developer grants. BitGo launched quantum risk scoring and exposed-address remediation for institutional wallets. The money and the attention are real. No one can predict whether they convert to protocol action before a CRQC arrives.

What QSB Changes and What It Leaves Exposed

The 26 August QSB transaction (designed by Levy, implemented by Giladi) is the first quantum-resistant Bitcoin transaction confirmed on mainnet using only existing consensus primitives. The code is public. The construction is sound. The on-chain record is permanent. That deserves credit.

It does not deserve the word “breakthrough.” The method is an individual insurance policy available to holders willing to pay a premium, trust a single mining pool for relay, and accept that their protection only begins after a moment of quantum exposure. No consumer wallet or exchange supports QSB. The roughly 30% of Bitcoin supply with exposed public keys is unaffected. The 2.3 million BTC the Quantum Horizon paper treats as irreducibly at risk (lost, dormant, early-era) will never be moved to safety by this or any other opt-in method, because the keys required to authorize the migration no longer exist.

Ben-Sasson called the demonstration “a reassurance that holdings can be protected” while a soft fork is developed. I think that is the right frame, and it deserves to be taken on its own terms. The biggest risk to Bitcoin from the quantum threat has always been a disorderly market response – a panic triggered by a quantum announcement that moves prices before the community can coordinate a technical response. In January 2026, Arkham Intelligence debunked a fabricated claim that Satoshi Nakamoto had moved 10,000 BTC, but not before the rumor rattled markets already contending with a sharp outflow month for spot Bitcoin ETFs. The two events – the hoax and the outflows – may not be causally linked, but together they showed how fast sentiment can move on quantum-adjacent fear. QSB’s existence gives institutional holders one more tool to point to when the next alarm arrives.

QSB buys time. Bitcoin’s governance process must deploy BIP-360 before the threat materializes, and no schedule exists. The authors of the Quantum Horizon paper (arXiv 2606.14484) frame the problem precisely: the binding constraint on Bitcoin’s quantum migration is governance, not technology.

For organizations holding digital assets, the decision framework has not changed: PQC migration timelines are set by regulators, insurers, and investors, not by predictions about when a CRQC arrives. Boards fund obligations, not threats. The existence of a single quantum-safe Bitcoin transaction is a data point for the optimists and a reminder for everyone else that one protected output does not constitute a protected network.

The post appeared first on PostQuantum - Quantum Computing, Quantum Security, PQC.