StarkWare said on August 26, 2026, that a Bitcoin transaction protected by Quantum Safe Bitcoin, or QSB, had been mined on Bitcoin’s main network. Avihu Levy, StarkWare’s general manager of applications, designed QSB to protect transactions against an attacker with a quantum computer without changing Bitcoin’s rules.
StarkWare wrote that the transaction was “the first time anyone has run it on mainnet,” referring to Levy’s method. Mainnet is Bitcoin’s production network, not a test network. StarkWare said engineer Tomer Giladi continued the work through to a working transaction.
StarkWare showed that coins in a QSB lock can be spent on Bitcoin’s main network without a soft fork, but holders must first move their coins into such a lock and pay for off-chain computing that StarkWare put at several hundred dollars. A soft fork is a backward-compatible change to the consensus rules that Bitcoin nodes use to decide which transactions are valid.
Disclosure: Quantum Observer’s Editor-in-Chief Marin Ivezic is an advisor to Project Eleven, which works on post-quantum security for digital assets.
What was signed
The transaction, confirmed in block 964,199, was mined by MARA Pool, according to mempool.space, a block explorer that displays Bitcoin’s public transaction record. It had two inputs, 10,000 satoshis from an output locked by a nonstandard script and 39,179 satoshis from an ordinary SegWit address. A satoshi is one hundred-millionth of a bitcoin.
In the transaction, 44,000 satoshis went to another ordinary address and 5,179 went to fees. StarkWare signed the ordinary input with a standard elliptic-curve signature and the locked input with QSB’s hash-based signature.
The locked output was created on July 16, in block 958,306, by an earlier transaction with a fee of 30,000 satoshis.
How the lock works
With a large enough quantum computer, an attacker could run Shor’s algorithm to derive a Bitcoin private key from its public key. The attacker could then forge the elliptic-curve signatures that owners use to authorize transactions. No one has built such a machine, known as a cryptographically relevant quantum computer, or CRQC.
StarkWare wrote that for most Bitcoin addresses, the public key stays hidden until the owner spends from them. The key then appears in the spending transaction, which waits in the mempool until a miner includes it. Taproot and pay-to-public-key outputs are exceptions, because they publish the key when they are funded. A reused address has also exposed its key.
The mempool is the public pool of unconfirmed transactions. An attacker with a CRQC could derive the private key during that wait and spend the same coins first, StarkWare wrote.
In a paper published with open-source code on April 9, Levy wrote that he built QSB by modifying an earlier scheme, Binohash, and replacing the one part of it vulnerable to Shor’s algorithm. StarkWare said Robin Linus, the creator of BitVM, developed Binohash.
Levy’s locking script contains hash commitments to a Lamport signature key. A Lamport signature is a one-time signature built only from hash functions. QSB uses none of NIST’s standardized post-quantum signature algorithms, such as ML-DSA, formerly CRYSTALS-Dilithium.
The owner spends the coins by signing a fingerprint of the spending transaction. To tie that fingerprint to the transaction, Levy’s script runs a public key derived from the transaction through the RIPEMD-160 hash function. The script accepts the spend only if the result is a validly formatted signature.
In Levy’s analysis, each attempt succeeds with odds of about 1 in 90 trillion. The sender therefore uses GPUs to try candidates until one passes, a search StarkWare called signature grinding.
For his recommended configuration, Levy estimated about 118 bits of second-preimage resistance against an attacker using Shor’s algorithm and roughly half that against one using Grover’s algorithm. Second-preimage resistance here is the difficulty of building a different transaction that matches the fingerprint the owner signed. Grover’s algorithm is a quantum method for speeding up brute-force searches.
Cost and limits
Levy estimated the off-chain GPU cost of a spend at $75 to $150 at cloud spot prices in his paper’s cost breakdown and at a few hundred dollars in its summary.
Levy wrote that QSB transactions are valid under Bitcoin’s consensus rules but are nonstandard. Nodes running Bitcoin Core with default settings do not relay them, so senders must submit them directly to a mining pool that accepts nonstandard transactions. StarkWare sent its transaction through Slipstream, a private mempool service run by the mining company MARA.
Levy wrote that his construction cannot use the SegWit or Taproot formats and runs only as legacy script, Bitcoin’s original format. In the paper, he called QSB “a last-resort measure,” citing costs that do not scale to Bitcoin’s users and throughput, a user experience more complex than standard Bitcoin use, and gaps in coverage such as Lightning Network payment channels.
“QSB does not make Bitcoin itself quantum-safe,” StarkWare wrote. “What happened today is that a specific construction worked on mainnet, and the network is unchanged.”
StarkWare CEO Eli Ben-Sasson said he still wants Bitcoin to choose a soft fork and expects it to get one. “What today’s successful transaction offers Bitcoin is a reassurance that holdings can be protected before that happens,” he said.
Proposed protocol changes
BIP-360, a draft soft fork by Hunter Beast, Ethan Heilman, and Isabel Foxen Duke, proposes Pay-to-Merkle-Root outputs that cannot be spent directly with a public key. Its authors wrote that the outputs would resist only attacks on keys exposed for longer than a transaction takes to confirm. Protecting keys exposed in the mempool may require adding post-quantum signatures to Bitcoin, they wrote.
Levy wrote that QSB’s cost, ease of use, and coverage could all be improved. He also wrote that, to the extent the quantum threat is believed to be real, work on a protocol-level solution must continue.
Update, November 12, 2026: On October 7, Levy merged a fix to the QSB code from Matt Black of LygosLabs. Black wrote that in the original script, the first of two signature rounds “was never enforced,” and that outputs funded to a lock built before the fix “remain exposed to the bug.” According to the transaction record on mempool.space, the lock that StarkWare spent in August used the original script. Levy’s 118-bit estimate assumed that both rounds must match.
