StarkWare says the first quantum-safe Bitcoin transaction has been mined on the Bitcoin mainnet, marking a milestone in the effort to protect holder funds from future quantum computers without waiting for the network itself to upgrade its consensus rules.
The Israel-based blockchain infrastructure company, best known for building the Ethereum layer-2 network Starknet, announced the transaction in a blog post on Wednesday. The transfer was executed using a method called Quantum-Safe Bitcoin, or QSB, developed by StarkWare researcher Avihu Levy. Levy first published the underlying research in April, and StarkWare engineer Tomer Gilani later helped turn the proposal into a working mainnet transaction.
What makes the transaction quantum-safe
Bitcoin currently relies on elliptic-curve cryptography to secure transactions. A sufficiently powerful quantum computer running Shor’s algorithm could theoretically break that cryptography, derive private keys from public keys and steal the funds tied to them. Defending the network against such a machine has long been framed as a choice between a hard fork, which risks splitting the network by introducing rules incompatible with older software, and a soft fork, which can add new rules while staying backward-compatible.
QSB takes a different route. Instead of changing Bitcoin’s rules, it adds a second, quantum-resistant lock built on hash functions rather than elliptic curves. The method uses a technique StarkWare calls signature grinding: computational work is performed off-chain to find a transaction hash that Bitcoin’s existing validation logic will accept as a properly formatted signature. In other words, the quantum-resistant protection is wrapped inside a transaction that looks perfectly ordinary to every node on the network today.
“A quantum-safe transaction was mined on the Bitcoin mainnet today that holds up against an adversary running a working quantum computer,” StarkWare wrote in its announcement. “Bitcoin holders now have a way to move coins into storage a quantum computer cannot open.”
Not a fix for the whole network
StarkWare has been careful to stress the limits of the achievement. QSB protects specific transactions, not the Bitcoin network as a whole. It cannot help coins sitting at addresses where the public key has already been exposed, and in its current form it requires transactions to be sent directly to miners rather than broadcast normally through the mempool.
“This amazing feat should not be viewed as a message saying ‘Bitcoin is prepared for the quantum threat.’ Far from it,” StarkWare CEO Eli Ben-Sasson wrote on X. “I hope whatever attention this brilliant work gets will also help folks hear loud and clear our message: Houston, we’ve got a problem, and the way to fix it should be to get serious about serious soft forks for Bitcoin. That’s how catastrophe can be avoided, and we still have time.”
Ben-Sasson reiterated that StarkWare still believes a soft fork remains the preferred long-term defense for the network. What the successful mainnet transaction offers, he said, is reassurance that individual holdings can be protected before any such upgrade arrives.
How big is the quantum threat?
The experiment lands amid growing attention to which Bitcoin holdings are most exposed to a future quantum adversary. In June, Coinbase’s quantum advisory council estimated that roughly 7 million BTC could be vulnerable because of exposed public keys and address reuse, a figure that covers coins held in older address formats or moved multiple times.
Security researchers broadly agree that today’s quantum computers remain far too small and error-prone to threaten elliptic-curve cryptography. But the debate has intensified because of the long shelf life of Bitcoin balances: a machine that arrives a decade from now would still be able to target coins whose owners reused addresses or left public keys exposed in the meantime.
The QSB approach effectively gives long-term holders an opt-in way to put their coins beyond that reach, converting a passive vulnerability into a hash-based puzzle that quantum algorithms like Shor’s do not help solve. Hash-based cryptography is considered quantum-resistant because the best known attacks against it, Grover’s algorithm included, offer only quadratic speedups rather than the exponential advantage that breaks elliptic curves.
Why it matters for Bitcoin’s roadmap
The transaction also sharpens the ongoing conversation about Bitcoin’s upgrade path. Soft-fork proposals aimed at adding post-quantum signature schemes have circulated for years, but consensus among miners, developers and users has been slow to form, partly because any change to Bitcoin’s cryptography carries its own risks.
By demonstrating that hash-based protection can be layered onto the existing protocol today, StarkWare has given holders an interim option while the soft-fork debate continues. The company frames it as a bridge rather than a destination: individual users can act now, while the community decides how, and whether, to harden the base layer itself.
For an ecosystem that has often struggled to reach agreement on even modest protocol changes, the first quantum-safe mainnet transaction is a reminder that innovation at the application layer can move faster than consensus at the base layer, and that the quantum clock, however distant its deadline may be, is already ticking.
old p2pk coins sitting with exposed keys since 2011 are the actual fire drill here. one mainnet tx is a demo, a migration tool is the product
the p2pk coins are unsaveable until their owners move, which is the actual fire drill. a migration tool matters more than the demo tx
the migration tool is the product but the demo tx is how you pressure wallet devs to prioritize it. sequence makes sense to me
2011 coins with exposed keys are exactly why this should ship as a default wallet option, not a toggle buried in advanced settings
One quantum-safe transaction on mainnet is a nice demo but the hard fork question is still unanswered. Credit to Levy for shipping the April research as a live transaction.
the no fork part is the whole trick though. a hash lock layered on the utxo skips years of consensus gridlock, levy earned this one
The Shor scenario is decades out at current error rates, but wallets with exposed public keys are the ones sweating. Fresh addresses buy time while this gets debated.
current error rates also said rsa was safe for decades. shor math doesnt care about the calendar, opt in early
wallet adoption is the choke point though. a quantum safe utxo nobody can spend from a phone is a paperweight with great math
paperweight until ledger and sparrow ship it in a release. the spec is public, wallet devs have no excuse past Q1 imo
no fork needed, just a hash-based second lock on top of your utxo. the levy paper from april was lowkey one of the best btc reads this year
Impressive work by StarkWare, but lets be clear about the limits. This only protects coins that opt in. Old utxos with exposed public keys stay just as quantum-vulnerable as before.
opt in is the honest framing, agreed. but every migration starts as a power user thing, taproot activation looked niche too
^ exactly. the real question is whether wallets make QSB the default path or it stays a power-user thing nobody enables
StarkWare delivering a working mainnet transaction instead of another whitepaper is refreshing. Curious whether miners flagged anything odd about that tx in their mempool view.
hash lock on a utxo without touching consensus rules is the most bitcoin solution possible. no fork debate, no activation drama, just wallets shipping it
One signed mainnet transaction does more against quantum FUD than a hundred think pieces. Now watch how fast the p2pk conversation moves.
one hash locked utxo on mainnet and no fork drama. quietly the most bitcoin upgrade of the year if wallets adopt it
opt in is also the weakness. whales move first and the crowd that keeps reusing addresses becomes the juicy target queue
Thats the part that bothers me too. Address reuse has been preached for a decade and the same people ignoring it will be the target queue.
levy published the research in april and theres a mainnet tx by august. rare to see a paper go to chain that fast without a token sale attached