StarkWare Says a Quantum-Safe Bitcoin Transaction Was Mined on Mainnet

StarkWare says a Bitcoin transaction protected against quantum attack was mined on the main network on Wednesday, with no change to Bitcoin's consensus rules. The coins came out of an output locked by a hash instead of by an elliptic-curve key, which is the part of Bitcoin a large quantum computer would break first. The firm is also the source for nearly everything known about it. Its own write-up says the method "does not make Bitcoin quantum-safe", and its chief executive said as much in blunter language. No independent cryptographer has published an assessment.

Grinding a signature instead of signing one

The method is called Quantum-Safe Bitcoin, or QSB, and the StarkWare researcher Avihu Levy published it in April. It works by signature grinding: a machine searches off-chain until it finds a transaction whose hash Bitcoin will accept as a correctly formed signature, so nothing is signed with a private key at all. Security then rests on the difficulty of reversing a hash function, and Shor's algorithm, the quantum method that breaks elliptic-curve keys, does not help there. crypto.news puts the search at roughly 2^46 hashing attempts and the result at about 118-bit second-preimage resistance. Tomer Giladi, a StarkWare engineer, built the working transaction from Levy's proposal.

One transaction, two descriptions of it

The Defiant, reading the transaction record, has two inputs of 39,179 and 10,000 satoshis, a single output of 44,000 satoshis and a fee of 5,179 satoshis, in a transaction 1,403 bytes long. BeInCrypto describes the same transaction as spending 10,000 satoshis, worth about $8, with the same fee. Both put it in block 964,199. The fee matches and the block matches; the amount does not, and the two accounts do not reconcile. Cost is quoted two ways as well. Levy's repository puts the off-chain computation at $75 to $150 a transaction, while StarkWare called this one several hundred dollars.

It did not travel the usual way

The transaction is non-standard, so ordinary nodes would not relay it and it never appeared in the public mempool. It reached a miner through MARA Pool's Slipstream service, which takes transactions directly. Anyone using QSB has to do the same. That is the third of the constraints StarkWare lists, and the first two bite harder. An address whose public key is already published gains nothing here, because a quantum adversary could derive the private key from what is on the chain already. Moving coins into a hash-secured output also takes an ordinary transaction, which exposes the public key on the way in. The method covers legacy pre-SegWit scripts; Taproot outputs and Lightning channels sit outside it.

The soft fork is still the plan

Eli Ben-Sasson, StarkWare's chief executive, was careful about what the result proves.

"This amazing feat should not be viewed as a message saying 'Bitcoin is prepared for the quantum threat'," Ben-Sasson said.

He told Decrypt he still wants Bitcoin to adopt a soft fork and expects one, calling a consensus change the preferred long-term solution. BIP-360, which would add pay-to-Merkle-root outputs, is the proposal usually named for that job, and it needs a protocol change to work. QSB needs none. Levy's own framing calls it a last-resort measure that does not scale to the number of users Bitcoin has.

Scale is where the argument sits. Coinbase's quantum advisory council estimated in June that about 7 million BTC are held in addresses with exposed public keys or reuse, and none of those coins is reached by a technique applied one transaction at a time at a hundred dollars or more a go. Daniel Batten, quoted by crypto.news, called the wider claims around the result an overstatement, pointing at dormant coins and keys already on the chain; his is the only critical voice in the coverage, and StarkWare has not answered it. Other chains have been rehearsing the same problem, with banks moving post-quantum transfers on a NEAR testnet and an Ethereum draft that would let validator deposits carry 8,192-byte keys. Nothing changed at the consensus layer on Wednesday, and nobody has put a date on when it might.