Bitcoin records quantum-resistant mainnet spend; 7M BTC exposed

On Aug. 26 Bitcoin included a hash-based, quantum-resistant transaction on mainnet that used a construction developed by Avihu Levy of StarkWare. The transaction was submitted directly to North American miner MARA via the Slipstream service and recorded in block 964,199. StarkWare described it as the first quantum-safe spend on Bitcoin mainnet.

The technique, called Quantum-Safe Bitcoin (QSB), replaces the usual elliptic-curve signature condition with a hash-based proof. The proof is produced off-chain and then broadcast as a spend that fits existing consensus rules, so no protocol change was required for the transaction to be accepted.

QSB takes advantage of address formats where the public key is hidden behind a hash until the owner spends. The method searches for transaction data that yields a hash matching Bitcoin’s expected signature format, allowing a user to lock coins with a hash-based spending path before the public key appears on-chain. That moves the security assumption from elliptic-curve cryptography to the difficulty of reversing hash functions; quantum algorithms offer much smaller speed-ups against hashes than against public-key algorithms like those targeted by Shor’s algorithm.

The approach does not protect coins whose public keys are already visible on-chain. Older pay-to-public-key outputs, Taproot outputs and addresses that have been reused remain susceptible because a future attacker could target known public keys. An estimated 7 million BTC are potentially vulnerable for those reasons.

The QSB transaction faced practical limits. Default node policy treats such transactions as nonstandard, so it did not propagate through the public mempool. StarkWare routed the spend directly to a miner. The company reported the mainnet test cost several hundred dollars; its public repository estimates some cloud GPU search phases could cost roughly $75 to $150.

In July a group of institutions including BlackRock and Coinbase formed the Bitcoin Security Consortium and pledged a combined $15 million over three years for Bitcoin security research, including work on post-quantum cryptography. The consortium members control their commitments independently and directed the funding toward research rather than an immediate protocol change.

Earlier experiments have applied post-quantum techniques in Bitcoin Script and on Blockstream’s Liquid sidechain. The Aug. 26 transaction demonstrates that Bitcoin’s current consensus rules can accept a hash-based spending path without a soft-fork. Developers and researchers identify two technical challenges that remain: building migration tools for coins whose public keys remain hidden and finding a protocol-level solution for coins with exposed keys.

StarkWare’s chief executive, Eli Ben-Sasson, cautioned that the test does not make the network broadly quantum-resistant and emphasized the need for a migration path before quantum hardware could threaten exposed keys.