Quantum Safe Bitcoin Transaction: What It Proves

Bitcoin is trading around $77,678 as of Saturday morning UTC, consolidating below $80,000 after Friday's hawkish reaction to Fed Chair Kevin Warsh's Jackson Hole remarks. That's not this week's real story, though. On Wednesday, a StarkWare researcher named Avihu Levy broadcast what his team is calling a quantum safe bitcoin transaction directly on Bitcoin mainnet, and it confirmed in block 964,199 without needing a single change to Bitcoin's rules. For a network that has spent years fielding questions about what happens when quantum computers arrive with vague reassurance, an actual on-chain demonstration is new, and it's the first the network has seen. It's also narrower than the headlines suggest, and understanding exactly where the line falls matters more than the demo itself.

Bitcoin's quantum problem is specific: the moment you spend from an address, your transaction briefly sits in the mempool with your real public key exposed, waiting for a miner to confirm it. A sufficiently powerful quantum computer could, in theory, use that exposed key to forge a competing spend before confirmation lands. Levy's technique, which StarkWare calls "Quantum Safe Bitcoin" or QSB, sidesteps that window using hash-based one-time signatures secured by "signature grinding": hours of brute-force off-chain computation that produces a valid signature without ever putting the address's actual public key at risk during its wait in the mempool. Because the method needed no new opcodes or consensus changes, it didn't require Bitcoin Core developers to agree on anything, and it didn't need a network upgrade of any kind. It just needed a miner willing to accept it, which is exactly what happened when MARA's Slipstream service took the transaction directly, bypassing the relay policy that would normally reject a grinded signature as non-standard.

No, and StarkWare isn't claiming that either. CEO Eli Ben-Sasson was explicit that this is not "Bitcoin is prepared," and that a real fix still requires a protocol-level soft fork the network hasn't scheduled or even seriously debated yet. Two things limit QSB as a practical safeguard. First, it's expensive and slow: Levy's original design estimated the cost at roughly $75 to $150 in GPU compute, but the actual mainnet transaction ran higher, with StarkWare putting the confirmed cost at $150 to $200, plus hours of grinding time, which rules it out for routine payments and makes it a tool for specific high-value transfers at best, not a default setting anyone can flip on for everyday use. Second, and more importantly, it only protects addresses whose public key has never been exposed on-chain in the first place. If you've already spent from an address once, its public key sits in Bitcoin's transaction history permanently, and no clever signature trick applied to a future transaction undoes that exposure.

That second limitation is the part of this story that actually answers the reader's question. Estimates from Glassnode put roughly 6.04 million BTC, about 30.2% of circulating supply, in addresses with publicly exposed keys: reused addresses, old pay-to-public-key outputs from Bitcoin's early years, and other legacy formats that predate modern wallet hygiene. Separate estimates from Google Quantum AI and Ark Invest/Unchained put the figure at roughly 6.9 million BTC, about 32-35% of supply, so the different methodologies broadly agree. None of that coin population gets any protection from a quantum safe bitcoin transaction demo, however well it works, because the vulnerability isn't in the next transaction those coins make, it's already been created by a transaction they made years ago. A sufficiently capable quantum computer, if one ever arrives, would be able to target that exposed-key supply regardless of what technique gets used for future spends elsewhere on the network.

Not on any confirmed timeline. The honest forward view is that QSB stays a proof of concept, not an adopted standard. Its per-transaction cost and hours-long grinding process make it impractical for anything beyond a demonstration or an occasional high-value move, and there's no imminent Bitcoin Core proposal for the consensus-layer soft fork Ben-Sasson says is the real answer. What would meaningfully change the picture is either that soft fork gaining developer traction, which hasn't happened yet, or a major leap in quantum computing capability serious enough to restart the "Q-day" debate in earnest, also not currently on the calendar. In the meantime, the one practical step available to individual holders is address hygiene: moving coins out of old, reused, or exposed-public-key addresses into fresh ones that have never signed a transaction, which keeps a wallet inside the roughly two-thirds of supply that's still protected rather than the exposed third. StarkWare's demo is a genuinely useful proof that Bitcoin can support post-quantum techniques without a fork. It just isn't the fix for the coins that need one most.