Bitcoin has recorded its first mainnet transaction using a construction designed to resist attacks from sufficiently powerful quantum computers, marking a significant test of how the network could protect funds without changing its consensus rules.
The transaction was mined on August 26, 2026, in Bitcoin block 964,199 by MARA Pool. It used Quantum-Safe Bitcoin (QSB), a system developed by StarkWare researcher Avihu Mordechai Levy. The demonstration involved 10,000 satoshis, or 0.0001 BTC.
StarkWare said the transaction was completed without a soft fork, hard fork, new opcode or other change to Bitcoin’s consensus rules. The achievement was presented as a demonstration that a quantum-resistant spending method can operate under rules already enforced by the Bitcoin network.
The transaction ID was 305a24ffea912b9cf428f29ebf952321c96dab5bab284fc0d0801562f5abab07. Because the transaction used QSB, it was not a standard Bitcoin transaction for ordinary network relay. The transaction was instead sent directly to MARA’s Slipstream service before being included in the mined block.
That distinction is important. The transaction was valid under Bitcoin’s consensus rules, but it could not simply be propagated through the normal mempool relay process used by standard transactions.
Levy published the QSB research in April 2026 in a paper titled “Quantum-Safe Bitcoin Transactions Without Softforks”. The corresponding open-source implementation describes QSB as a transaction scheme that operates within Bitcoin’s existing legacy script limits.
The central problem QSB addresses is the use of elliptic-curve cryptography in Bitcoin. Traditional Bitcoin transactions rely on ECDSA signatures, while Taproot uses Schnorr signatures. Both depend on mathematical problems that a sufficiently capable quantum computer could attack using Shor’s algorithm.
A quantum computer capable of solving the relevant problem could theoretically recover private keys from exposed public keys and use them to forge signatures. Research from Google has examined this threat and estimated that, under its assumptions, a future cryptographically relevant quantum computer could recover a Bitcoin private key from an exposed public key in roughly nine to 12 minutes.
Bitcoin’s exposure to this threat is not limited to one type of address. Public keys can already be visible for some outputs, giving an eventual quantum attacker more time to attempt key recovery. Other attacks would target transactions after they are broadcast but before they are confirmed, creating a much shorter window for an attack.
A May 2026 analysis from Glassnode estimated that 6.04 million BTC, representing 30.2% of issued Bitcoin under its methodology, had exposed public keys. The research classified 1.92 million BTC, or 9.6% of issued supply, as structurally exposed. Glassnode estimated that the remaining 13.99 million BTC, or 69.8%, had no public-key exposure at rest.
Those figures do not mean that 30.2% of Bitcoin can currently be stolen by a quantum computer. No known quantum computer today is capable of carrying out the attacks required to do that. The figures describe the amount of supply that would already have exposed public-key material under Glassnode’s definition of quantum exposure.
QSB takes a different approach from simply replacing Bitcoin’s existing signature system with a post-quantum signature algorithm.
The construction uses Bitcoin’s existing script capabilities to create a hash-based spending mechanism. It builds on an earlier construction called Binohash but replaces the component of that design that was vulnerable to a quantum attack.
QSB uses a hash-to-signature puzzle based on RIPEMD-160. A transaction-bound public key is hashed, and the resulting 20-byte value is interpreted as a DER-encoded ECDSA signature. The transaction generator searches for a result that satisfies the required structure.
According to the QSB implementation, a random 20-byte value meets the required DER structural constraints with a probability of about 2-46. That makes the search computationally expensive, but it also means that the security of the puzzle depends on hash preimage resistance rather than the elliptic-curve problem targeted by Shor’s algorithm.
ECDSA remains part of the construction, but the QSB researchers describe it as a vehicle rather than the security assumption. The security argument instead relies on the underlying hash functions and hash-based commitments.
The QSB paper estimates approximately 118-bit second-preimage resistance under its stated Shor threat model, with the security level roughly halved under Grover’s algorithm. Those are theoretical security estimates from the construction and are not the result of testing against a capable quantum computer.
The computational requirements are another limitation. The QSB implementation estimates roughly $75 to $150 in cloud GPU costs for the off-chain search, while reporting around 238 million candidate attempts per second on an RTX PRO 6000 and 88 million per second on an RTX 4070 SUPER. Reporting around the completed mainnet demonstration placed the actual computational cost at roughly $150 to $200, with the computation taking hours.
The transaction also carried a fee of 5,179 satoshis, according to transaction-level reporting on the demonstration.
QSB does not automatically make existing Bitcoin holdings quantum-resistant. A user would have to move coins into a QSB-protected output. That migration could itself present a problem if the source public key were already exposed and a sufficiently powerful quantum attacker existed at the time.
For that reason, QSB is not being presented as a permanent replacement for Bitcoin’s cryptographic system. Its developers describe it as a mechanism that can provide quantum-resistant spending under today’s rules, while Bitcoin would still need a broader protocol-level approach for widespread use.
One of the other major efforts is BIP-360, a draft proposal for a new Pay-to-Merkle-Root output type. The proposal removes the quantum-vulnerable key-path spend from Taproot-style outputs and is intended as a step toward reducing long-exposure quantum attacks.
BIP-360 does not solve every quantum threat. Its specification distinguishes between long-exposure attacks, where a public key can remain exposed for an extended period, and short-exposure attacks, where an attacker would need to recover a key while a transaction is still waiting for confirmation. The proposal says short-exposure protection could require post-quantum signature schemes.
Another effort has already reached a production Bitcoin-related network. On March 3, 2026, Blockstream Research said it had completed the first post-quantum-signed transactions on the Liquid Network, a Bitcoin sidechain. Its quantum research says the signature used in the demonstration was 324 bytes, while the full transaction, including the Simplicity verification program, was roughly 38 KB.
That Liquid milestone is separate from the StarkWare demonstration. Liquid is a Bitcoin sidechain, while the QSB transaction was mined directly on Bitcoin mainnet.
Blockstream has also been researching its SHRINCS post-quantum signature scheme and the possibility of adding dedicated verification capabilities to Bitcoin. The company has highlighted signature size as a major challenge because many post-quantum signatures are substantially larger than Bitcoin’s existing signatures.
Bitcoin’s current Schnorr signatures are about 64 bytes. Blockstream cites approximately 2,420 bytes or more for the smallest NIST-standardized post-quantum option it discusses, compared with about 324 bytes for its SHRINCS configuration. Larger signatures would increase transaction sizes and could reduce the number of transactions that fit into each block.
The StarkWare demonstration therefore does not mean Bitcoin has been upgraded to withstand quantum computing. It shows something narrower: a specially constructed transaction can be accepted and mined by Bitcoin’s existing consensus rules while using a security mechanism designed around hash-based assumptions rather than the elliptic-curve problem used by ordinary Bitcoin signatures.
The experiment also exposes the limits of that approach. QSB currently requires substantial computation to generate, uses a non-standard transaction format and needs a direct route to a miner rather than normal transaction relay. Those constraints make it unsuitable as a general-purpose replacement for Bitcoin’s existing transaction system.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
