Bitcoin Tests Quantum-Safe Mainnet Transaction Without Protocol Upgrade

How Quantum-Safe Bitcoin works

QSB relies on the fact that many Bitcoin addresses keep a holder’s public key concealed behind a cryptographic hash until the holder spends from that address. That delay creates a window in which eligible coins can be moved before the classical public key is revealed and potentially becomes a target for a sufficiently capable quantum computer.

The method uses a process called “signature grinding.” Candidate transaction data are repeatedly varied off-chain until the resulting transaction hash has a form Bitcoin accepts as a validly formatted signature. The computation takes place before broadcast, shifting the protected spend’s security assumption away from elliptic-curve cryptography and toward the difficulty of reversing cryptographic hash functions.

Bitcoin uses elliptic-curve cryptography to authorize transactions, which a sufficiently powerful quantum computer running Shor’s algorithm could theoretically break to derive private keys from exposed public keys and steal funds. Quantum computers can also accelerate attacks on hashes, but their advantage against hashes is substantially smaller than the advantage Shor’s algorithm provides against public-key cryptography, giving QSB a potential migration route for coins whose public keys remain hidden.

StarkWare Chief Executive Eli Ben-Sasson cautioned against treating the experiment as a complete solution. “This amazing feat should not be viewed as a message saying ‘Bitcoin is prepared for the quantum threat.’ Far from it,” Ben-Sasson wrote.

Ben-Sasson said the successful transaction proves that workable approaches exist while the larger task remains building a migration path before quantum hardware becomes capable of threatening exposed keys. StarkWare continues to favor a soft fork as Bitcoin’s long-term defense, with QSB serving as a way to protect qualifying holdings before such an upgrade is adopted.

“I still want Bitcoin to choose to do a soft fork and I expect we will get one,” StarkWare CEO Eli Ben-Sasson said. “What today’s successful transaction offers Bitcoin is a reassurance that holdings can be protected before that happens.”

A soft fork can introduce additional Bitcoin rules while remaining compatible with older nodes, while a hard fork introduces rules incompatible with older software and can split the network. StarkWare’s position is that QSB can provide an interim protection mechanism for individual holdings, but broader protocol changes are still needed for network-scale preparation.

Ben-Sasson reinforced that point in another statement: “I hope whatever attention this brilliant work gets will also help folks hear loud and clear our message: Huston, we've got a problem, and the way to fix it should be to get serious about serious soft forks for [Bitcoin].” He added, “That's how catastrophe can be avoided, and we still have time.”

Already-exposed Bitcoin remains outside QSB protection

QSB cannot protect Bitcoin whose public keys are already visible. Older pay-to-public-key outputs, Taproot outputs and reused addresses remain exposed because a future quantum attacker could target those keys before their owners completed a migration.

Coinbase’s quantum advisory council estimated in June 2026 that roughly 7 million BTC could be vulnerable because of exposed public keys and address reuse. The potentially exposed group includes coins associated with older address formats, Taproot use and reused addresses, meaning those holdings do not retain the concealed-key window on which QSB depends.

That leaves Bitcoin facing two distinct technical problems: creating migration tools for holders whose public keys remain hidden and developing a protocol-level answer for coins whose public keys are already exposed. The mainnet QSB transaction demonstrated a working approach to the first problem, while the second remains unresolved for millions of Bitcoin.

QSB also remains impractical for ordinary wallet use under current conditions. Although its transaction is valid under Bitcoin consensus rules, it is nonstandard under default node policy and would not normally propagate through the public mempool. StarkWare therefore submitted the transaction directly to MARA through Slipstream, which handles certain transactions that are consensus-valid but fall outside normal relay policies.

Computational requirements create another limitation. StarkWare said the mainnet experiment cost several hundred dollars, while the project’s open-source repository estimates approximately $75 to $150 for some configured cloud-GPU search phases required during the off-chain grinding process.

Those constraints make QSB a specialized migration mechanism for qualifying holdings rather than a routine network-wide solution. The experiment established that a quantum-resistant spend can work on Bitcoin mainnet under existing consensus conditions, but it did not resolve Bitcoin’s broader quantum-security challenge.