StarkWare Executed the First Quantum-Resistant Bitcoin Transaction on Mainnet, Without a Fork

StarkWare said it executed the first quantum-resistant Bitcoin transaction on mainnet. The 10,000-satoshi spend landed in block 964,199 on Wednesday, no network fork required. MARA Pool mined it after StarkWare routed the transaction through the miner’s Slipstream service, skipping the public mempool queue where ordinary Bitcoin transactions sit and wait.

The method is called Quantum Safe Bitcoin, or QSB. Avihu Levy, head of StarkWare’s applications division, devised it. The approach pairs hash-based one-time signatures with computational searches that bind a signature to one specific transaction, so a future quantum computer cannot forge a replacement. In practice, that means the transaction stays protected while it waits for confirmation, the moment when Bitcoin’s existing signatures are most exposed. A transaction sitting in the mempool reveals the public key material a sufficiently powerful machine could use to derive the private key. QSB’s “signature grinding” refuses the first valid signature and brute-forces millions of candidates until one takes a shape that keeps the key material hidden.

The limits are concrete. QSB transactions are classified as nonstandard under Bitcoin Core’s default relay rules. Ordinary nodes would ignore them. In practice, only miners running custom software can carry QSB spending today. The completed test cost roughly $150 to $200 in computation, StarkWare spokesperson Nathan Jeffay told Cointelegraph, up from an April estimate of $75 to $150 in GPU time that Levy offered when he introduced the scheme.

QSB applies to individual spending, not a network-wide upgrade. StarkWare CEO Eli Ben-Sasson, in remarks reported by The Block, called Levy’s breakthrough important less for the method itself than for what it proves. “Avihu’s breakthrough is important because it gives the psychological reassurance which we need and which the asset itself needs,” he said. “I’ve said before that crypto is behaving like passengers on the Titanic. What Avihu has illustrated is that there are lifeboats. That is not a reason to relax. It is a reason to build more of them, and to build them now.” In a separate Cointelegraph interview he put the point more directly: “A soft fork should happen, and I believe it will.” QSB, he said, provides a safety net while protocol-level protections are developed.

That protocol-level work is already underway, though on a separate track. A Bitcoin Improvement Proposal for the SHRINCS signature scheme, a hash-based post-quantum design from Blockstream researchers Jonas Nick and Mikhail Kudinov, was published earlier this year after the pair unveiled the design in December 2025. The opcode proposal followed in May. In practice, a concrete candidate now sits in the Bitcoin improvement process for replacing elliptic-curve signatures with quantum-resistant ones. SHRINCS was tested in production on Blockstream’s Liquid sidechain in March.

The tradeoffs are visible. SHRINCS signatures run a minimum of 548 bytes, plus a 48-byte public key, and can grow to 4,619 bytes. That is roughly nine times the size of the 64-byte Schnorr signatures Bitcoin uses today, and far smaller than the 38-to-123-times penalty carried by NIST-approved lattice schemes, which would throttle Bitcoin to an estimated 0.5 transactions per second. Nick, writing on X, called SHRINCS “the first concrete proposal for a post-quantum signature scheme designed specifically for Bitcoin,” but added it is “not intended to be Bitcoin’s ‘final’ signature scheme, and it is not optimal along every axis.” In practice, SHRINCS is the best-fit option available. Not the last word.

The BIP itself flags unfinished work. A security proof is listed as “TODO.” The proposal has not been formally audited. It has not benefited from the years of public cryptanalysis that NIST-standardized signatures carry. The scheme also introduces statefulness: each use grows the signature by 16 bytes, and losing the signing device forces a roughly 5,777-byte stateless fallback transaction to recover funds. Keys generated using hypertree pruning for the stateless component are not compatible with implementations that do not support that pruning; importing a key across incompatible software, the BIP warns, may result in lost funds. In practice, wallet vendors would have to coordinate on the same key-generation rules or wallets would not be interoperable.

The two developments are distinct. QSB is an application-level technique requiring no protocol change, tested on one transaction. SHRINCS would require a soft fork, an opcode-level upgrade activating through the Bitcoin improvement process, to deploy at all. The sources treat them as parallel responses to the same threat, not a single roadmap.

That threat has a rough clock. In March, Google researchers estimated a sufficiently capable quantum computer could derive a Bitcoin private key nine to 12 minutes after its public key becomes visible. In practice, the vulnerable window is the mempool wait, exactly the gap QSB was built to close.

Other proposals are circulating. BIP-360, a separate draft, would introduce a Pay-to-Merkle-Root output type while removing Taproot’s quantum-vulnerable key-path spend. The engineering menu is filling; the governance is not. Marin Ivezic, author of PostQuantum.com and founder of Applied Quantum, told Cointelegraph that the binding constraint is not cryptography but selection. “Between BIP-360, BIP-361, SHRINCS and STARKs, the engineering menu is filling up fast,” he said. “What Bitcoin lacks is a mechanism for choosing from it before the clock runs out.”