Bitcoin now has a quantum computing escape route, but 7 million BTC may still be exposed

Bitcoin has confirmed a quantum-resistant transaction on mainnet using its existing consensus rules, showing that some holders could migrate funds away from future quantum risk without waiting for a protocol upgrade.

The Aug. 26 transaction used a construction developed by StarkWare researcher Avihu Levy that shifts the critical spending condition away from elliptic-curve signatures and toward hash-based security. It was included in block 964,199 after being submitted directly to Bitcoin miner MARA through its Slipstream service.

StarkWare described the transaction as the first quantum-safe spend on Bitcoin mainnet. Earlier experiments explored post-quantum approaches in Bitcoin Script and on Blockstream’s Liquid sidechain, but this test showed that Bitcoin itself could accept a hash-based spending path without changing consensus rules.

However, the workaround does not make Bitcoin quantum-safe.

StarkWare Chief Executive Eli Ben-Sasson said the test should not be interpreted as evidence that Bitcoin is already prepared for quantum computing. He argued that broader soft-fork solutions are still needed to protect the network at scale.

“A quantum-safe Bitcoin tx on mainnet” proves that workable approaches exist, Ben-Sasson said, while warning that the main task remains building a migration path before quantum hardware becomes capable of threatening exposed keys.

How Quantum-Safe Bitcoin operates

For many Bitcoin addresses, the public key stays concealed behind a hash until the holder spends from that address. That delay matters because a future quantum attacker would need the public key before attempting to derive the corresponding private key.

Levy’s Quantum-Safe Bitcoin, or QSB, construction uses that window to move eligible coins into a hash-based spending condition before the classical public key is revealed.

The method works by repeatedly varying candidate transaction data until it produces a hash that Bitcoin accepts as a validly formatted signature. That computation takes place before the transaction is broadcast, shifting the security assumption away from elliptic-curve cryptography and toward the difficulty of reversing hash functions.

Quantum computers can also accelerate attacks on hashes, but the advantage is far smaller than the one Shor’s algorithm provides against public-key cryptography. That gives QSB a potential migration path for coins whose public keys remain hidden.

The protection does not extend to coins whose public keys are already visible. Older pay-to-public-key outputs, Taproot outputs, and reused addresses remain exposed because a future quantum attacker could target those keys before the owner completed a migration.

QSB also remains impractical for routine wallet use.

Although the transaction is valid under Bitcoin’s consensus rules, it is nonstandard under default node policy and therefore will not normally propagate through the public mempool. StarkWare had to submit the transaction directly to MARA through Slipstream, its service for handling certain nonstandard transactions.

The required computation adds another barrier. StarkWare said the mainnet test cost several hundred dollars, while the project’s open-source repository estimates roughly $75 to $150 for some configured cloud-GPU search phases.

Those constraints leave QSB as a specialized escape route for some holders rather than a scalable answer to Bitcoin’s broader quantum risk.

Bitcoin’s larger quantum problem remains unresolved

The demonstration arrives as quantum risk moves further into institutional planning.

Roughly 7 million BTC are considered potentially vulnerable because their public keys are already visible through older address formats, Taproot usage, or address reuse. QSB does not provide a rescue path for those coins.

In July, BlackRock, Coinbase, Strategy, and six other institutions formed the Bitcoin Security Consortium and pledged a combined $15 million over three years toward Bitcoin security research, including post-quantum cryptography. Members direct the funding independently rather than through a common pool.

The US Treasury has also brought digital assets into the financial sector’s broader quantum-readiness planning.

That leaves Bitcoin with two separate challenges: developing migration tools for holders whose keys remain hidden and finding a protocol-level answer for coins already exposed.

The Aug. 26 transaction shows that the first problem has at least one working mainnet solution. The second, which covers millions of Bitcoin, still requires a broader answer.