Bitcoin mines first quantum-safe mainnet transaction: StarkWare

Bitcoin confirmed the first mainnet transaction using researcher Avihu Levy’s Quantum-Safe Bitcoin method on Aug. 26, according to StarkWare.

The mined transaction demonstrated that QSB can operate under Bitcoin’s existing consensus rules. It did not require new opcodes, a soft fork or changes by Bitcoin nodes.

Bitcoin transaction moves security toward hashes

Standard Bitcoin transactions rely on signatures using elliptic-curve cryptography. A sufficiently powerful fault-tolerant quantum computer running Shor’s algorithm could theoretically calculate a private key from its exposed public key.

QSB changes the security assumptions for a particular output. It uses hash-based commitments and a hash-to-signature puzzle rather than depending on the difficulty of solving an elliptic-curve discrete logarithm.

StarkWare Researcher Executes First Quantum-Safe Bitcoin Transaction on Mainnet

StarkWare researcher Avihu Levy’s Quantum-Safe Bitcoin (QSB) scheme has completed its first confirmed transaction on the Bitcoin mainnet, demonstrating a way to protect transactions from… pic.twitter.com/ZiCoQdMuhD

— Wu Blockchain (@WuBlockchain) August 27, 2026

The method uses Bitcoin’s existing ECDSA verification operations as a vehicle, but its security comes from the preimage resistance of RIPEMD-160. The published implementation estimates approximately 118-bit second-preimage resistance against an attacker using Shor’s algorithm.

QSB does not use StarkWare’s STARK proving technology. However, both approaches depend heavily on hash functions. As previously reported, zk-STARKs avoid elliptic-curve security assumptions while producing larger proofs than many zk-SNARK systems.

QSB required off-chain computation and miner access

Creating a QSB spend involves searching for transaction parameters whose resulting RIPEMD-160 hash can be interpreted as a valid DER-encoded signature. Finding a suitable result requires approximately 2462^{46} hashing attempts.

Levy’s repository estimates that the search costs between $75 and $150 using cloud GPUs. The research paper allows a wider range of $75 to $200 for implementation uncertainty and describes the cost more generally as a few hundred dollars.

These figures cover off-chain computation, not the Bitcoin network fee. Each transaction requires its own search, although the work can be divided across several GPUs.

QSB transactions also exceed Bitcoin’s standard relay policy limits. Ordinary nodes will not normally propagate them through the public mempool. MARA’s Slipstream service provided a direct route to a miner for the first mainnet transaction.

The transaction does not make Bitcoin quantum-safe

The confirmed transaction proves that Bitcoin’s consensus rules accept the QSB construction. It does not establish that Bitcoin, all existing addresses or the wider wallet ecosystem have become resistant to quantum attacks.

QSB works with legacy pre-SegWit scripts. It does not directly protect Taproot outputs or Lightning Network channels. Coins must also enter a QSB output through a conventional transaction before receiving its hash-based protection.

That migration creates an important limitation. If the source transaction reveals a public key while a capable quantum attacker already exists, the attacker could target the coins before confirmation. Addresses with public keys exposed by previous spending remain outside QSB’s protection unless holders move beforehand.

Bitcoin specialist Daniel Batten previously described broader claims that QSB already makes Bitcoin quantum-safe as “an overstatement,” citing its failure to address dormant coins and previously exposed public keys.

A protocol-level Bitcoin upgrade remains under study

Levy describes QSB as a “last-resort measure,” rather than a scalable replacement for ordinary Bitcoin transactions. The method’s computation cost, large scripts and reliance on miner-direct submission make it unsuitable for normal payment volume.

“What today’s successful transaction offers Bitcoin is a reassurance that holdings can be protected before that happens,” StarkWare CEO Eli Ben-Sasson said, referring to a possible soft fork.

That protection remains conditional on holders moving coins into compatible outputs before a quantum computer can attack existing signatures. No cryptographically relevant quantum computer capable of breaking Bitcoin keys has been publicly demonstrated.

Developers are separately considering BIP-360, which proposes Pay-to-Merkle-Root outputs designed to reduce long-term exposure to quantum attacks. Unlike QSB, adopting that proposal would require a Bitcoin protocol change.

The next steps include independent review of the QSB code, further mainnet testing and work on more scalable post-quantum signature systems. The transaction provides a working fallback, but it does not remove the case for a network-level migration.