Bitcoin's first quantum-safe spend — what it protects and what it cannot

On Aug. 26, a transaction built to hold up against a future quantum computer was mined into Bitcoin block 964,199. StarkWare, which developed the method, calls it the first quantum-safe spend on Bitcoin's main network. Its own chief executive says it should not be read as proof that Bitcoin is ready for quantum computing.

The underlying worry is specific. Bitcoin secures spending with elliptic-curve signatures, and a sufficiently powerful quantum computer running Shor's algorithm could in theory derive a private key from a public key. For many addresses the public key stays hidden behind a hash until the first time you spend from that address, which means a future attacker has to see the key before it can work on it.

The method, called Quantum-Safe Bitcoin or QSB, uses that window. It was designed by StarkWare researcher Avihu Levy, who published the research in April, and turned into a working mainnet transaction with engineer Tomer Giladi. It shifts the critical spending condition away from elliptic curves and toward hash-based security, which quantum computers weaken far less, and it does so without changing Bitcoin's consensus rules. The trick is signature grinding: repeatedly varying candidate transaction data off-chain until the result is a hash that Bitcoin will accept as a validly formatted signature.

The limits are large. The transaction is nonstandard under default node policy, so it will not travel through the ordinary mempool — StarkWare had to hand it directly to the miner MARA through its Slipstream service. The grinding also costs money: several hundred dollars for this mainnet test, with the project's open-source repository estimating roughly $75 to $150 for some cloud-GPU search phases. Most importantly, it does nothing for coins whose public key is already visible, which covers older pay-to-public-key outputs, Taproot outputs, and any address that has been reused. Roughly 7 million BTC are considered potentially exposed for those reasons.

StarkWare says a soft fork, a rule change that older software can still accept, remains its preferred long-term answer, and chief executive Eli Ben-Sasson said the real task is building a migration path before quantum hardware becomes capable of threatening exposed keys. Institutions are circling the same problem: in July, BlackRock, Coinbase, Strategy and six other institutions formed a Bitcoin Security Consortium pledging a combined $15 million over three years toward Bitcoin security research, and the US Treasury has folded digital assets into the financial sector's quantum-readiness planning.

None of this asks you to do anything today, and there is nothing here to buy. The one habit worth taking from it is old advice with a fresh reason: do not reuse an address after you have spent from it, because that spend is the moment the public key becomes visible. And if anyone offers to quantum-proof your coins for a fee, or asks for your recovery phrase to migrate them, that is a scam. The work described here is experimental, expensive, and not something your wallet app is quietly doing for you.