StarkWare Completes Quantum-Resistant Bitcoin Transaction on Mainnet Without a Soft Fork

Bitcoin remains the foundation of digital money for many, yet new technological risks continue to appear on the horizon. One of the most discussed long-term concerns involves quantum computers and their potential to challenge the cryptography that secures Bitcoin wallets and transactions. Recent developments show that researchers are not waiting for a distant threat to become real before testing practical defenses.

By the end of this article, readers will understand how a specific method allowed a quantum-resistant Bitcoin transaction to settle on the live network, why it required no protocol change, what it means for ordinary holders, and where the real limits still exist. The discussion covers the technical idea in plain language, its place in the broader market, clear benefits, and the practical hurdles that remain.

For years, many people assumed that making Bitcoin safe from a powerful quantum computer would demand a soft fork or hard fork that alters the network’s core rules. That assumption no longer holds in the same way. A working transaction has already settled on mainnet using only the rules that exist today.

This piece walks through the key concept, examines its impact on security and markets, lists the advantages available right now, and outlines the challenges users and developers still face. The purpose is straightforward. It aims to give a clear, accurate picture of what StarkWare’s recent mainnet demonstration actually achieved and why the result matters for Bitcoin’s long-term resilience.

This article will delve into how the Quantum-Safe Bitcoin method works, what the first mainnet transaction proved, the real advantages and limitations for holders, and what it means for Bitcoin’s path toward stronger quantum resistance.

Bitcoin’s spending security relies heavily on elliptic-curve cryptography, alongside other cryptographic primitives such as hash functions. When someone spends coins, a digital signature proves ownership of the private key without revealing the key itself. Today’s computers cannot reverse that process in any practical amount of time. A sufficiently powerful quantum computer running Shor’s algorithm could change that picture. Once a public key becomes visible on the network, a quantum adversary might derive the matching private key and attempt to spend the coins first.

Many commonly used Bitcoin output types hide the public key behind a hash until the coins are spent, while other output types, such as Taproot outputs, use a different public-key-based structure. The key only appears when a transaction is signed and broadcast. That creates a narrow window while the transaction sits in the mempool waiting for a miner. Google researchers estimated that a sufficiently powerful quantum computer could potentially recover a Bitcoin private key in minutes once the corresponding public key is exposed. That window is short but real.

Researcher Avihu Levy, General Manager of Applications at StarkWare, published a method in April 2026 called Quantum-Safe Bitcoin, or QSB. The approach adds a second lock based on hash functions rather than elliptic curves. Hash functions resist Shor’s algorithm. The best quantum attack against them is a speedup of brute-force search, which remains far too slow for practical breaks at current security levels.

QSB uses a hash-based construction combined with computational grinding. The sender performs heavy computation offline to create a transaction that satisfies the required conditions under Bitcoin’s existing rules. Bitcoin’s existing verification rules accept the result. Security instead relies on the computational difficulty of finding the required hash preimage or second preimage. The method builds on earlier research on hash-based Bitcoin spending and related constructions, including work by Robin Linus.  Levy designed the scheme on his own time, and StarkWare engineer Tomer Giladi helped bring the final implementation to a working state.

On August 26, 2026, the first such transaction was mined into Bitcoin block 964,199. It spent a 10,000-satoshi output protected by the QSB construction. Because the transaction used a nonstandard format, ordinary nodes would not relay it through the public mempool. MARA’s Slipstream service provided a direct path to the miner. The computation took several hours of GPU time and cost roughly $150 to $200.

StarkWare has emphasized that QSB does not upgrade Bitcoin itself. It moves specific coins into an output whose security rests on hashes. Coins whose public keys were already exposed before the move remain vulnerable until they are transferred using this or a similar method. The open-source code and research paper sit on GitHub for anyone to examine.

The demonstration changes the conversation around quantum risk in a practical way. Previously, the dominant view held that holders had to wait for a soft fork proposal, such as BIP-360, to gain meaningful protection. BIP-360 introduces a Pay-to-Merkle-Root output type that removes the quantum-vulnerable key-path spend from Taproot-style addresses while preserving script flexibility. Other proposals, including migration roadmaps, continue to advance. QSB shows that an individual holder can act sooner without waiting for network-wide consensus.

Shifting Protection from Collective to Individual Action

Until this mainnet result, most discussions treated quantum resistance as something that could only arrive through a coordinated protocol change. Soft-fork proposals remain essential to providing every user with a clean, standardized address type. Yet the successful Quantum-Resistant Bitcoin (QSB) transaction proves a holder does not have to remain idle while those proposals move through review and activation. Someone controlling coins behind an unspent hashed address can begin the process of moving them into a hash-based construction under today’s rules. That option lowers the urgency that would otherwise build if quantum hardware advanced faster than the consensus process.

The practical difference is timing. Soft forks need broad agreement among developers, miners, and economic nodes and can take years. Quantum-Resistant Bitcoin (QSB) needs only offline computation and a path to a miner that accepts nonstandard transactions. For custodians holding significant cold-storage balances, the ability to act on their own schedule rather than waiting for a network flag day is a meaningful shift. The method does not replace better native address types, but it removes the feeling that nothing can be done in the interim.

Market Sentiment and Network Flexibility

For markets, the effect is mostly psychological and preparatory at this stage. Bitcoin’s price is influenced by many factors, and a single experimental transaction of 10,000 satoshis does not affect liquidity or daily trading volume. What it does is reduce the sense of inevitability that quantum progress would force a rushed and contentious upgrade. Holders of large balances, exchanges, and custodians now have a documented path to move funds into storage that a quantum adversary cannot open using known attacks on elliptic curves.

In the short term, the news is unlikely to move prices by itself. Over a longer horizon, however, the existence of a working fallback can influence how institutions assess risk. Auditors, treasury teams, and risk managers who previously treated quantum exposure as an open-ended liability now have a concrete technique they can reference. That shift from pure uncertainty to a known, if imperfect, tool can lower perceived tail risk, even as the actual probability of a near-term quantum attack remains low.

The method also highlights the difference between network-level security and individual transaction security. Bitcoin’s consensus rules stayed untouched. Miners simply included a valid transaction that happened to use a nonstandard script. That flexibility is valuable. It means the network can absorb new spending techniques without coordination among all nodes and miners. Consensus changes affect every participant. Individual constructions affect only the coins that choose to use them. QSB belongs firmly in the second category: it does not make the entire blockchain quantum-safe, yet it shows that Bitcoin’s script system still has room for experimentation.

Parallel Work on Starknet and Across Chains

At the same time, the demonstration sits alongside StarkWare’s separate work on Starknet. ZK-STARKs, the proving system behind Starknet, never relied on elliptic-curve assumptions. Starknet already supports post-quantum accounts through native account abstraction, and the company published a three-phase quantum roadmap in June 2026. Phase one addresses new activity, phase two covers existing contracts, and phase three aligns with Ethereum’s post-quantum timeline, given the shared bridge and data-availability layer. QSB itself does not use STARKs. It works entirely with Bitcoin’s existing tools.

The contrast is useful. Starknet can change signature schemes at the account level without a network-wide vote. Bitcoin cannot. QSB therefore serves as a limited bridge: it gives Bitcoin users a restricted version of the flexibility that account-abstraction chains already enjoy while the slower soft-fork process continues.

In the broader crypto landscape, similar conversations are happening on other chains. Ethereum, Solana, and others face the same theoretical deadline. Solutions that require no consensus change give those ecosystems breathing room while longer-term upgrades are debated and tested. By proving that at least one viable construction works on the largest and most conservative chain, the Bitcoin demonstration raises the baseline expectation for the rest of the industry.

Several clear benefits emerge from the QSB approach. First, it requires no soft fork, hard fork, or change to consensus rules. Anyone who can perform the necessary computation and reach a miner willing to accept a nonstandard transaction can do so today. That independence from governance debates is rare in Bitcoin’s history.

Independence from Protocol Changes

Most upgrades that touch Bitcoin’s core security model require months or years of discussion, testing, and eventual activation. Soft forks demand broad support from developers, miners, and economic nodes. QSB sidesteps that process entirely. Because the construction stays within the existing legacy script limits and consensus rules, a user does not need network permission to protect a specific set of coins. 

The only practical requirements are the ability to run the offline grinding process and a direct channel to a miner that will include the resulting nonstandard transaction. For institutions that already maintain relationships with mining pools, this path is already open. For individuals, it remains more technical, yet the barrier is technical rather than political. That distinction matters in a system where coordination has historically been slow and sometimes contentious.

Stronger Security Assumptions and Offline Work

The security model shifts to hash pre-image resistance. Estimates place the second-preimage resistance at roughly 118 bits under a Shor’s algorithm threat model. That level is considered adequate for the near term. The computation happens entirely off-chain before the transaction is broadcast, so the network never sees the grinding process.

In standard Bitcoin, the critical secret is the private key, which must remain hidden. Once a public key appears, the security assumption changes. 

QSB moves the hard problem onto a hash function. Even a quantum computer that can run Shor’s algorithm gains little advantage against a properly sized hash; the best-known quantum speedup is quadratic and still leaves the search space impractically large. Because all the expensive searching occurs before broadcast, the public network only receives a finished, valid-looking transaction. Miners and nodes perform their usual verification steps with no extra burden. This separation of heavy computation from on-chain activity is one of the cleaner design choices in the method.

Open Source Nature and Future Improvements

The method is open source. Researchers, wallet developers, and security firms can inspect the code, test variations, and improve efficiency. Lowering the computational cost over time would make the technique more practical for larger amounts or more frequent use.

The research paper and reference implementation are available in public repositories. 

Anyone can review the construction, reproduce the mainnet result, or experiment with optimizations. Over time, that openness tends to drive down cost and raise usability. Hardware improvements in GPUs or specialized hashing chips could shrink the hours currently required. Software refinements might reduce the number of attempts needed to find a valid signature hash. Neither improvement is guaranteed, yet the fact that the work is public increases the chance that progress will occur outside any single company.

A Practical Bridge While Soft Forks Mature

It provides a bridge while protocol-level solutions mature. StarkWare CEO Eli Ben-Sasson has stated that a soft fork remains the preferred long-term path and that he expects one to arrive. In the meantime, QSB offers reassurance that holdings can be protected before the upgrade takes effect.

Real-world application remains limited to experimental or emergency settings due to cost and the need for direct miner access. Yet the existence of a working mainnet example changes the risk calculus for custodians who manage significant Bitcoin balances. They can now plan migration strategies that do not depend solely on the timing of a network upgrade.

Large holders no longer face a binary choice between waiting indefinitely and accepting residual quantum exposure. They can move selected high-value outputs into QSB-protected storage as an interim step, then later migrate those coins again once a cleaner, standardized address type becomes available through a soft fork. The current technique is expensive and cumbersome, but it is available. That availability itself alters how risk is measured and how migration timelines are written. For the first time, Bitcoin holders have a documented, consensus-compatible method to place coins behind hash-based assumptions without waiting for the entire network to move in unison.

The advantages come with clear limitations. The most obvious is cost. Generating a QSB transaction currently requires hours of GPU time and expenses in the low hundreds of dollars. That price is acceptable for testing or for protecting high-value cold storage, but it is far too high for everyday payments or small balances. Future hardware improvements or optimized algorithms may reduce the expense, yet the gap remains large today.

Another limitation is the nonstandard format. Bitcoin Core’s default relay policies treat these transactions as nonstandard, so they will not propagate through the ordinary peer-to-peer network. Users must submit them directly to a miner or mining pool that accepts them. MARA’s Slipstream service filled that role for the first demonstration. Wider adoption would require more mining pools to offer similar private submission channels or a change in relay policy.

QSB also cannot protect coins whose public keys have already been revealed. Once a public key is on-chain, a quantum adversary could derive the private key before any protective transaction is broadcast. Holders must move funds before exposure occurs. Addresses that have never spent, or that use formats that keep the public key hidden until the final spend, gain the most immediate value.

Finally, the method is not a complete network upgrade. It secures individual outputs. Broad protection for the entire Bitcoin supply still requires consensus changes such as those proposed in BIP-360 and related migration plans. Relying solely on QSB would leave large portions of the circulating supply exposed if quantum computers advance faster than expected.

Practical precautions for users include monitoring the progress of soft-fork proposals, testing small amounts with available tools once wallet support appears, and treating the current technique as a specialized option rather than a daily habit. Developers can contribute to open-source implementations to lower costs and improve usability.

The successful mining of a quantum-resistant Bitcoin transaction on mainnet without any soft fork marks a concrete step forward. It proves that Bitcoin’s existing rules already contain enough flexibility to support hash-based spending conditions that resist known quantum attacks on elliptic curves. Avihu Levy’s QSB method, brought to mainnet with help from Tomer Giladi and facilitated by MARA Slipstream, turned a research paper into an on-chain fact.

The result does not eliminate the need for protocol-level improvements. A soft fork remains the cleaner, more scalable long-term solution preferred by many, including StarkWare’s leadership. Yet the demonstration removes the sense that holders must simply wait. Coins can be moved into stronger storage today, provided the computational cost and submission path are acceptable.

Bitcoin’s design has repeatedly demonstrated its ability to absorb new ideas without compromising its core properties. This episode fits that pattern. As quantum research continues and other post-quantum proposals advance, the network now has both an immediate tool and a clearer path toward broader upgrades. Readers who follow these developments closely will be better prepared to evaluate the options that appear next.

Further reading on the original research paper, the open-source repository, and related Bitcoin Improvement Proposals offers the best next step for anyone who wants deeper technical detail. Staying informed about both experimental techniques and formal soft-fork progress remains the most practical way to understand Bitcoin’s evolving security landscape.

What exactly is a quantum-resistant Bitcoin transaction?

It is a spend that relies on hash functions rather than elliptic-curve signatures for its primary security. A quantum computer using Shor’s algorithm cannot break the hash-based lock the way it could break a traditional signature.

Did this transaction change Bitcoin’s rules?

No. The transaction followed existing consensus rules. No soft fork or hard fork was required.

How much did the first mainnet transaction cost?

Computation took several hours of GPU time and cost approximately $150 to $200, according to StarkWare.

Why was a special mining service needed?

The transaction used a nonstandard format that Bitcoin Core nodes do not relay by default. MARA’s Slipstream service provided a direct submission path to the miner.

Can ordinary users do this today?

In theory, yes, but the cost, technical complexity, and need for direct miner access currently limit it to specialized or experimental use.

Does QSB protect all Bitcoin?

No. It protects only the specific coins moved into a QSB-protected output. Previously exposed public keys remain at risk until the funds are transferred.

Is a soft fork still necessary?

Most experts, including StarkWare’s CEO, still view a soft fork as the better long-term solution for network-wide protection. QSB serves as an interim option.

Where can the research and code be found?

The paper and open-source implementation are available in Avihu Levy’s GitHub repository, Quantum-Safe-Bitcoin-Transactions.

Disclaimer: This article is for informational and educational purposes only. It does not constitute financial, investment, or legal advice. Cryptocurrency investments carry significant risk and high volatility. Always conduct your own research (DYOR) and consult a qualified financial advisor before making any investment decisions. Past performance is not indicative of future results.