StarkWare Mines First Bitcoin Transaction Built to Resist Quantum Attacks, With Big Caveats

StarkWare says it pulled off something new on Bitcoin: a transaction built to survive an attack from a quantum computer, confirmed on the mainnet without changing a single rule of Bitcoin's consensus code.

The transaction moved 3.1 BTC and confirmed Wednesday, August 26, in Bitcoin block 964,199, according to Starknet and confirmed by onchain data cited by Symplexia News. The method behind it, called Quantum Safe Bitcoin (QSB), was designed by StarkWare's head of applications, Avihu Levy, who first published the concept as a whitepaper in April.

How it actually works

Bitcoin's standard security relies on ECDSA signatures, tied to elliptic-curve math. The theoretical worry, laid out by Google researchers in March according to Symplexia News, is that a sufficiently powerful quantum computer could derive a private key from an exposed public key in as little as nine to 12 minutes, potentially letting an attacker hijack a transaction while it's still sitting in the mempool waiting for confirmation.

QSB sidesteps that by leaning on a different kind of math problem entirely. Instead of trusting elliptic-curve cryptography, it uses hash-based commitments, banking on the fact that quantum computers have no known shortcut for reversing a hash function like RIPEMD-160, according to Crypto.news. The published implementation estimates about 118-bit security against an attacker running Shor's algorithm, the quantum method that threatens standard Bitcoin signatures.

The technique is called "signature grinding." Rather than accept the first valid signature a wallet generates, the software searches through roughly 2^46 hashing attempts, according to Crypto.news, until it lands on one whose signature doesn't leak public-key information that a quantum computer could exploit. StarkWare CEO Eli Ben-Sasson said the transaction was mined by MARA through its Slipstream service, which routes non-standard transactions directly to a miner willing to include them, since ordinary Bitcoin nodes won't relay them through the public mempool.

Not cheap, not fast, not for everyone

This is not something you'll do to buy coffee. Generating a single QSB transaction takes several hours of GPU computation, according to Bloomingbit and BigGo Finance, and StarkWare spokesperson Nathan Jeffay told Cointelegraph the completed transaction cost "low hundreds of dollars," landing around $150 to $200. Levy's original April estimate put the range at $75 to $150. An ordinary Bitcoin transaction, by comparison, costs about 30 cents, according to Yellow.com.

Ben-Sasson was blunt about what this does and doesn't mean. "This breakthrough provides needed psychological reassurance," he told The Block, as reported by Bloomingbit. "It shows there is a lifeboat, not that everyone can relax. We need to build more lifeboats now."

StarkWare itself is drawing a hard line against overselling the result. The company says QSB is not a fundamental fix for Bitcoin's quantum exposure, and Levy has said the network ultimately needs a protocol-level upgrade, according to Crypto.news and Symplexia News. Ben-Sasson said a soft fork "should happen, and I believe it will," pointing to QSB as a stopgap while that process plays out.

The limits critics are pointing to

Bitcoin analyst Daniel Batten pushed back on the "quantum-safe" framing as an overstatement, according to Yellow.com, noting that roughly 1.7 million BTC sitting in early pay-to-public-key addresses remain exposed no matter what new transaction types get built. Those coins already have their public keys sitting on the blockchain in plain sight. No new spending method can retroactively hide information that's already public.

There's a second limitation baked into QSB's own design. Coins have to pass through a normal, non-quantum-safe transaction before they can land in a QSB-protected output, according to Crypto.news. If a capable quantum attacker already existed at the moment that transaction revealed a public key, the attacker could theoretically strike before the QSB transaction even confirms. Addresses that have already exposed their public keys through past spending stay outside QSB's protection unless the holder moves the coins first.

QSB also doesn't touch Taproot outputs or Lightning Network channels, working instead with older, pre-SegWit script formats, according to Crypto.news. And because it's a non-standard transaction type under Bitcoin Core's default relay rules, it can't just be broadcast normally. It has to go directly to a cooperating miner, which right now means MARA's Slipstream service.

No sufficiently powerful quantum computer capable of actually breaking Bitcoin's cryptography exists today. This remains a defense against a threat that hasn't materialized yet, built and tested in advance of it. Levy also co-authored BIP-360, a separate proposal for quantum-resistant Bitcoin addresses that was merged into Bitcoin's official code repository in February, according to Yellow.com. Unlike QSB, that proposal would require an actual soft fork, meaning the debate StarkWare's transaction was designed to get ahead of still hasn't been resolved by the network itself.