Safe or shipped: anatomy of the first quantum-safe bitcoin transaction

Bitcoin's quantum problem has two halves, and only one is mathematics. StarkWare settled that half on 26 August, no soft fork required. The other half is whether the network will carry it, and block 964,199 made that much harder to ignore.

Safe or shipped: anatomy of the first quantum-safe bitcoin transaction

The most quantum-resistant spend ever constructed could not travel through Bitcoin. StarkWare ground it out of hash preimages, and no node on the network would relay it. One miner took it by hand and put it in block 964,199 on 26 August. The cryptography worked. The delivery did not.

TL;DR

What happened - On 26 August 2026 a bitcoin transaction was confirmed in block 964,199 that does not depend on elliptic-curve cryptography for its security. StarkWare calls it the first quantum-safe bitcoin transaction on mainnet. It required no soft fork, no hard fork and no change to consensus rules.

The method - A technique called signature grinding. The spender burns hours of GPU time searching offchain until a hash lands in the exact shape Bitcoin will accept as a valid signature. Security rests on preimage resistance instead of the discrete logarithm problem, so Shor's algorithm has nothing to solve.

The catch - The transaction is non-standard. No ordinary Bitcoin node will relay it. It reached a block only because MARA runs Slipstream, a service launched in February 2024 to accept transactions the network refuses to carry.

The scale of the problem - Estimates of quantum-exposed supply run from about 10,200 BTC to 7 million BTC depending on the question being asked. The BIP-361 draft counts over 34 percent of all bitcoin as having revealed a public key on-chain as of 1 March 2026.

The response - Two proposals sit in the Bitcoin Improvement Proposals repository, BIP-360 and BIP-361. Both are drafts. Neither has been activated. StarkWare's own chief executive says he still wants a soft fork.

The crux - The hard part of Bitcoin's quantum problem was never the mathematics. It is relay policy, miner access and a network-wide upgrade nobody has scheduled.

What was actually mined?

On 26 August 2026 a transaction confirmed in block 964,199. It was 1,403 bytes, it moved a 10,000-satoshi output, and it paid a fee of 5,179 satoshis out of a 49,179-satoshi input. Anyone can pull it up: txid 305a24ffea912b9cf428f29ebf952321c96dab5bab284fc0d0801562f5abab07.

The method was designed by Avihu Levy, who runs StarkWare's applications division, and taken to completion by StarkWare engineer Tomer Giladi. StarkWare's own summary of what it delivers: "Bitcoin holders now have a way to move coins into storage a quantum computer cannot open."

The timeline is the detail most coverage skipped. Levy published the construction, Quantum Safe Bitcoin or QSB, as a paper on GitHub in April 2026, and CoinDesk wrote it up on 10 April. The approach borrows heavily from Binohash, built by BitVM's Robin Linus. Getting one of these transactions into an actual block took another four months.

Which means the news of 26 August is not a new idea. It is proof that an idea from the spring can survive contact with the live network, and the way it survived is the interesting part.

How does signature grinding work?

Bitcoin's exposure to a quantum computer is not the key sitting in your wallet. It is the moment you spend.

When a transaction is broadcast, the public key goes on chain and waits in the mempool for confirmation. An attacker holding a sufficiently capable machine could, in principle, derive the private key inside that window and race a competing transaction into a block. Minutes of exposure, and the coins are gone.

QSB closes that window by taking elliptic curves out of the security argument altogether.

Hash-based one-time signatures do the real work, verified inside Bitcoin Script, with ECDSA left in place as scaffolding the network still recognises. The spender searches offchain, varying sequence and locktime values, until the RIPEMD-160 hash of a transaction-bound public key happens to come out as a well-formed DER-encoded ECDSA signature.

That is roughly a one in 2^46 event. About 70 trillion attempts, which is where the hours of GPU time go.

Worth flagging for anyone quoting the numbers: several write-ups describe the search as "millions" of candidates. The construction implies something around seven orders of magnitude more than that, and the published cost figures only make sense at the larger number.

What the grinding buys is a shift in the underlying assumption. Security no longer rests on the hardness of the discrete logarithm problem, which Shor's algorithm attacks directly. It rests on preimage resistance, which Shor cannot touch.

Why couldn't the network carry it?

Because the transaction breaks the rules every node uses to decide what to pass along.

QSB leans on FindAndDelete, a pre-SegWit quirk of OP_CHECKMULTISIG that SegWit itself removed, and on the long-known SIGHASH_SINGLE bug. It cannot use SegWit or Taproot. Default relay policy on an ordinary node drops it without comment.

So it never travelled through Bitcoin's network. It was handed straight to a miner, and MARA's Slipstream, launched in February 2024 to accept exactly this class of transaction, put it in a block.

This is the part that has had almost no pickup, and it is the whole story.

A quantum lifeboat that cannot be relayed is not a property of the protocol. It is a commercial relationship with somebody who has hashrate. In a real emergency, when every holder on the network has the same incentive to move first, the binding constraint is not whether the cryptography works. It is how many parties are willing to run a private door, and how long the queue behind it gets.

Starknet Foundation's Damo framed the achievement this way: "It required no soft forks, it required no hard forks, it required no core protocol upgrades." All true. It also required a specific miner to agree, which is a different kind of dependency and one the protocol cannot guarantee.

Which coins does this actually protect?

Fewer than the headlines imply, and not the ones most at risk.

QSB defends the transit, not the vault. Coins whose public keys are already published on chain get nothing from it. CoinShares counts roughly 1.6 million BTC, about 8 percent of supply, sitting in legacy pay-to-public-key outputs where the key has been visible for years. Coinbase's Quantum Advisory Council puts about 1.7 million BTC in that same category. None of it is reachable by this technique, by construction.

There is a second-order problem, and StarkWare states it plainly. Moving coins into a quantum-safe output requires one ordinary spend first, which exposes the sending key for exactly the window the scheme exists to close.

The lifeboat has to be boarded through the water.

Lightning channels are out of scope entirely. And the QRL's technical review of the construction puts it at roughly 118-bit second preimage resistance inside Bitcoin's script limits, falling to about 69 bits under combined Shor and Grover attacks, short of the 128-bit floor NIST sets for its Category 1 quantum security level. That is an argument about margins rather than a refutation, but it belongs on the record.|

What does it cost?

Levy's own repository puts the offchain compute at 75 to 150 dollars per transaction. StarkWare's write-up says several hundred. CoinDesk's April coverage gave a range of 75 to 200 dollars, against roughly 33 cents for an ordinary bitcoin transaction at that date.

The absolute figure is not the interesting part, though.

The cost is fixed per transaction and does not scale with the amount being protected. Grinding a QSB spend is a rounding error on a thousand-BTC position and completely irrational on a tenth of one.

Priced per seat, not per passenger. Whatever this technique becomes, it will not be a retail defence, and Levy has been consistent about that from the start. He calls QSB "a last resort measure."

How big is the quantum risk really?

It depends entirely on which question you are asking, and the two headline numbers in circulation answer different ones.

CoinShares published research on 6 February 2026, written by Christopher Bendiksen, arguing that the exposure figures being quoted conflate categories that behave nothing alike. Of the roughly 1.6 million BTC in P2PK outputs, CoinShares put only about 10,200 BTC in holdings large enough to cause appreciable market disruption if stolen. The remainder sits across more than 32,000 separate UTXOs averaging around 50 BTC each.

On hardware, the same research estimated that breaking secp256k1 inside a day would take roughly 13 million physical qubits, on the order of 100,000 times the largest machine then operating. Doing it inside an hour would need capabilities around 3 million times better than current systems. CoinShares placed the threat at least a decade out.

Coinbase's Quantum Advisory Council, reporting on 17 June 2026, counts every coin with an exposed key and arrives at up to 7 million BTC, roughly a third of supply. The BIP-361 draft independently puts it at over 34 percent of all bitcoin as of 1 March 2026, which corroborates the Coinbase framing from a completely different author set.

One number is an attack surface. The other is a blast radius. Neither is a rebuttal of the other, and any coverage presenting this as a dispute that one side has won is misreading both.

What is Bitcoin actually deciding?

Two proposals sit in the Bitcoin Improvement Proposals repository, both of them drafts, neither activated.

BIP-360 (Pay-to-Merkle-Root), from Hunter Beast with Ethan Heilman and Isabel Foxen Duke, was merged into the repository as a draft consensus change in February 2026. It defines a Taproot-like output with the quantum-vulnerable key-path spend removed. It does not introduce post-quantum signatures itself, which is a point lost in most summaries.

BIP-361 (Post Quantum Migration and Legacy Signature Sunset), from Jameson Lopp and five co-authors and created on 11 February 2026, is the uncomfortable one:

Phase A - around three years after activation, sending funds to quantum-vulnerable addresses is disallowed
Phase B - two years after Phase A, ECDSA and Schnorr spends are restricted, which renders vulnerable UTXOs unspendable
Phase C - pending research, a quantum-safe recovery path using zero-knowledge proofs of seed possession

Bendiksen gives the opposing case its cleanest statement: "I find the very idea of burning coins that are not your own squarely contradictory to Bitcoin's ethos."

That is the actual fight, and it is not a cryptography argument. It is a question about whether a network can decide, collectively, to make a third of its own supply unspendable in order to stop somebody else spending it first.

One thing that is not in play, since it comes up in every quantum thread. The Great Consensus Cleanup, specified as BIP54, does not target FindAndDelete or the SIGHASH_SINGLE behaviour that QSB depends on. It covers the timewarp bug, slow-to-validate blocks, the 64-byte merkle weakness and the duplicate-transaction vector. The escape hatch is not on anyone's demolition list right now.

StarkWare sits closer to the critics than the coverage suggests. CEO Eli Ben-Sasson: "I still want Bitcoin to choose to do a soft fork and I expect we will get one." The company's own write-up is blunter than most of the reporting about it: "This amazing feat should not be viewed as a message saying 'Bitcoin is prepared for the quantum threat.' Far from it."

Where does this leave holders?

Two scenarios, one demonstration.

The preparation scenario. The demo does what a good demo does, which is to make an abstract deadline concrete. Address hygiene stops being enthusiast folklore. Holders stop reusing addresses, rotate to output types that keep the public key hidden until spend, and the exposed share of supply falls from a third toward something manageable. BIP-360 activates, wallets ship support, and the migration happens over years rather than in a weekend. The lifeboat is never needed because the ship gets fixed.

The procrastination scenario. The demo does the opposite. "Quantum-safe bitcoin transaction executed" reads as problem solved, urgency drains out of the soft-fork debate, and the exposed supply keeps growing because nobody changes their habits. Then the constraint that actually binds is the one 26 August exposed: a few hundred dollars a transaction, delivered by hand to whichever miners will take them, for a set of coins that mostly cannot be protected this way at all.

Which one prevails is not a technical question. It gets decided by how well the difference between a demonstration and a defence is understood, and right now the coverage is not helping.

There is a direct echo here of the Coldcard breach five weeks ago, which drained roughly 1,816 BTC from more than 5,200 addresses because a firmware bug made seed phrases guessable at the moment of creation. Different failure, same shape. In both cases the vault worked exactly as advertised and the key was the problem, and in both cases the holders who came through best were the ones who had assumed a single layer would eventually fail.

Key terms

Public key exposure window - the period between broadcasting a transaction and its confirmation, when the spending public key is visible on chain. The window a quantum attacker would target.

Shor's algorithm - a quantum algorithm that solves the discrete logarithm problem efficiently, which is what would let a sufficiently large quantum computer derive a bitcoin private key from a public key.

Grover's algorithm - a quantum algorithm that speeds up brute-force search quadratically. It weakens hash-based security without breaking it, and that is what makes hash-based schemes the post-quantum fallback.

Preimage resistance - the property that makes it infeasible to find an input producing a given hash output. QSB's security rests here rather than on elliptic curves.

P2PK (pay-to-public-key) - the earliest bitcoin output type, where the public key sits in plain view on chain. Roughly 1.6 to 1.7 million BTC still sits in these outputs, permanently exposed.

Signature grinding - searching offchain across millions upon millions of candidate transactions until one produces a hash the network will accept as a valid signature. The work moves from the protocol to the sender.

Non-standard transaction - a transaction that is valid under consensus rules but violates the relay policy nodes use to decide what to forward. Valid in a block, invisible on the network.

Out-of-band submission - handing a transaction directly to a miner rather than broadcasting it. MARA's Slipstream is the best-known service of this kind.

Soft fork - a backwards-compatible consensus change. The mechanism both BIP-360 and BIP-361 would need, and the one nobody has scheduled.

FAQ

Is bitcoin quantum-safe now?

No. One transaction used a quantum-resistant construction. The protocol is unchanged, the technique is opt-in and non-standard, and StarkWare says so directly in its own announcement.

Do I need to do anything today?

Nothing urgent, and nothing involving QSB. Coinbase's June report recommends the same basic hygiene it always has: avoid address reuse, use a fresh address per transaction, and hold funds in modern output types where the public key stays hidden until you spend.

Are my coins exposed?

If you have ever spent from an address and then reused it, or if you hold coins in a legacy P2PK output, the public key is on chain. Over 34 percent of all bitcoin falls into that category by the BIP-361 draft's count. If an address has never been spent from, the key is not yet visible.

Can this technique protect coins already sitting in cold storage?

Not the ones that need it most. QSB protects the moment of transit, and any coin whose key is already published is outside its reach. Getting into a quantum-safe output also requires one ordinary spend first, which exposes the key.

How soon could a quantum computer actually break a bitcoin key?

Nobody knows, and the honest range is wide. CoinShares estimated in February 2026 that a one-day break of secp256k1 would need roughly 13 million physical qubits, around 100,000 times the largest machine then operating, and placed the threat at least a decade away. Coinbase's advisory council cited expert warnings of 10 to 20 years. Treat anything more precise than that with suspicion.

Will there be a soft fork?

Unresolved. BIP-360 and BIP-361 are both drafts, neither is activated, and the second would eventually make a large share of existing coins unspendable. That is a governance decision with no obvious majority behind it yet.Cryptography was the easy half

A few hundred dollars of GPU time settled the mathematics. What 26 August measured is the distance between a working defence and a network able to carry one, and that distance is made of relay policy, miner access and a soft fork nobody has activated.

Coordination, in other words, which is where this problem has lived the whole time.

At Bitcoin Poland Conference 2026, 5-6 October at the Poznań Congress Center, protocol upgrades, key management and the governance of consensus changes are on the programme precisely because weeks like this one show how far apart a proof of concept and a network-wide answer really are.

Poland's first bitcoin-only conference brings together the people who build, break and defend these systems, in a format designed for substance over spectacle.

Read also: our anatomy of the Coldcard breach in "Cold or cracked" on the Bitcoin Poland blog.

About Bitcoin Poland Conference

Bitcoin Poland Conference is a bitcoin-only conference taking place on 5-6 October 2026 at the Poznań Congress Center. The programme covers bitcoin as a monetary network and the technology, security and governance questions that surround it.