The first quantum-safe Bitcoin transaction has been mined on the network’s mainnet, marking the point at which the Quantum-Safe Bitcoin scheme, or QSB, crossed from research paper to live block.
The confirmation lands more than four months after the method was published, and it establishes that Bitcoin holders now have a working, if costly, path to move coins into an output that a large-scale quantum computer running Shor’s algorithm would not be able to open, and to do so without any change to the base protocol.
StarkWare disclosed the milestone on August 26. The confirming transaction was routed to a block through MARA Slipstream, the direct-to-miner submission service run by Marathon Digital. That routing is not decorative. QSB outputs use nonstandard script formats, so they cannot travel through the ordinary Bitcoin mempool and effectively need a miner willing to accept them.
Avihu Levy, researcher and General Manager of Applications at StarkWare, designed the scheme on personal time and published the paper in April. StarkWare engineer Tomer Giladi carried the implementation across the last stretch of work needed to broadcast on the live network. The open-source code and the research paper both sit on Levy’s GitHub. The Crypto Times covered the initial April release when the paper first landed.
What the QSB construction actually does
Bitcoin’s signature security rests on elliptic curve cryptography, and a public key that has been broadcast is meant to remain useless to anyone but the owner of the private key that produced it. Shor’s algorithm, running on a large enough quantum computer, would erase that assumption by deriving private keys from public keys in tractable time.
The immediate exposure window on Bitcoin is the seconds between a signed transaction leaving a wallet and its inclusion in a block, when the public key sits open in the mempool.
QSB does not extend that window or alter signature verification. It adds a second lock, built on hash functions rather than curves, alongside the existing one. The technique Levy uses is called signature grinding. Instead of proving ownership with a private key, the sender searches by brute force for a spending transaction whose hash happens to be a validly formatted signature. Bitcoin accepts it.
The security of the resulting output then rests on the difficulty of reversing a hash, not on the secrecy of a private key. Shor’s algorithm does not break hash functions in the same way. The best-known quantum speedup against a hash is Grover’s algorithm, and it falls well short of what would be needed to unwind the puzzle.
The design draws heavily on Binohash, a transaction introspection technique developed by BitVM creator Robin Linus and demonstrated on Bitcoin mainnet earlier this year.
The cost gap is the story
The compute for the grinding happens offchain, before a QSB output is created. StarkWare has said the current cost sits at several hundred dollars per transaction, higher than the $75 to $200 range Levy estimated in April. A standard Bitcoin transaction, for comparison, currently clears for roughly 33 cents.
That gap is the practical reason QSB will not eat into ordinary usage. It also identifies the target audience clearly. QSB is a last-resort lock for holders who consider the risk of a quantum attack imminent enough to accept a four-figure premium for coverage. It is not a wallet default. Levy framed the scheme this way in the original release, and StarkWare has repeated the framing today.
Two limits inside the design
Two constraints sit inside the QSB architecture and are worth naming plainly. The first is that a QSB transaction cannot rescue an address whose public key has already been broadcast. If the key is already on chain, a quantum adversary would have the same mempool window to derive the private key and race the QSB transaction to a miner.
The second is that QSB does not make Bitcoin itself quantum-safe. The network is unchanged. What changes is that a specific output, on the receiving side of a QSB transaction, sits under a hash lock instead of an elliptic-curve one.
Both limits push against reading today’s news as a resolution to the quantum question. It is a hedge that is now available to individual holders, no more and no less.
Reads across BIP-360, BIP-361, and the soft-fork debate
The mainnet confirmation lands in the middle of a live governance conversation on how Bitcoin should handle quantum risk at the protocol layer. BIP-360, co-authored by StarkWare’s Isabel Foxen Duke along with Hunter Beast and Ethan Heilman, was merged into the Bitcoin BIP repository in February and introduces a Pay-to-Merkle-Root output that removes the exposed key path from Taproot.
BIP-361, published in April by a group led by Casa’s Jameson Lopp, layers an enforcement plan on top of that and, in the version that drew the sharpest reactions, would freeze coins in vulnerable address types after a block-height flag day. The Crypto Times has tracked the trajectory of both proposals in detail.
QSB now sits alongside those proposals as a third path with an unusual political shape. It does not require anyone else to act. A single holder, willing to pay the premium, can move coins today. That does not remove the case for a base-layer change, and StarkWare has explicitly kept advocating for one. It does, however, reduce the argument for treating a soft fork as the only option.
StarkWare co-founder Eli Ben-Sasson said in the company blog post that he “still wants Bitcoin to choose to do a soft fork” and expects one to arrive. In that framing, QSB is reassurance rather than replacement.
Slipstream is a bottleneck worth naming
The mainnet execution ran through MARA Slipstream, a service Marathon launched in February 2024 for direct submission of nonstandard transactions to its own mining pool. Slipstream is one of the few open commercial paths for scripts that Bitcoin nodes will not relay by default. That is a practical constraint.
Any expansion of QSB usage over the coming months would sit on the willingness of Marathon, or another pool with a comparable service, to accept the traffic. In a decentralized protocol, having a single or a small set of miners act as the effective gateway for a defensive tool is a dependency worth reading carefully.
Where Starknet fits, and where it does not
StarkWare’s proving system, ZK-STARKs, has never relied on elliptic curves. Starknet already has post-quantum accounts live on mainnet. QSB does not use STARKs. It runs entirely inside Bitcoin, using tools Bitcoin already has. StarkWare has published a three-phase quantum roadmap for Starknet that walks through hashing in state commitments, then existing contracts, then bridge and data availability dependencies inherited from Ethereum.
The company’s position is that today’s result validates Bitcoin’s ability to add a defensive option quickly, and does not imply STARKs are the mandatory delivery vehicle for post-quantum work anywhere else.
Three questions to watch
Three follow-up questions run out of today’s confirmation.
The first is how fast the per-transaction compute cost of QSB falls if optimization work continues, because that number determines whether the method stays niche or becomes a routine hedge for larger holdings. The second is whether more mining pools open direct submission paths for QSB or the method stays tied to Marathon’s Slipstream.
The third is how a working non-forking option shapes the pace of BIP-360 and BIP-361 discussions, which have been the primary forum for Bitcoin’s quantum debate for most of the year. The Crypto Times had earlier flagged the urgency around Bitcoin’s quantum defense as researchers pushed multiple parallel approaches.
Also Read: Bitcoin Core Dev Reports Reducing Bitcoin Adoption in El Salvador
