StarkWare announced that the first quantum-resistant transaction on the Bitcoin mainnet was confirmed on August 26, 2026. The spend, processed in block 964,199 by MARA Pool, used researcher Avihu Levy’s Quantum-Safe Bitcoin, or QSB, construction. It demonstrated that certain outputs can be secured against potential quantum attacks under Bitcoin’s existing consensus rules.

The transaction spent a 10,000-satoshi output protected by the QSB scheme. On-chain data confirmed the transfer without requiring new opcodes, a soft fork, or modifications to Bitcoin nodes. Because the transaction was classified as nonstandard under Bitcoin Core’s default relay policies, it was submitted directly to the miner through MARA’s Slipstream service rather than propagating through the public mempool.

How the QSB Method Works

Standard Bitcoin transactions depend on elliptic-curve cryptography for signatures. A sufficiently powerful quantum computer running Shor’s algorithm could, in theory, derive a private key from an exposed public key. QSB replaces that reliance for specific outputs with hash-based commitments and a hash-to-signature puzzle whose security rests on the preimage resistance of RIPEMD-160.

Levy’s approach combines hash-based one-time signatures with computational searches that bind authorization to a particular transaction. The published implementation estimates roughly 118-bit second-preimage resistance against an attacker using Shor’s algorithm. Generating each spend requires searching for parameters whose resulting hash can be interpreted as a valid DER-encoded signature, involving on the order of 2^46 hashing attempts.

The method does not employ StarkWare’s STARK proving technology, though both rely heavily on hash functions. QSB was designed as a last-resort measure rather than a routine replacement for ordinary transactions.

Costs, Practical Constraints and Scope

Earlier estimates placed the off-chain GPU computation needed to create a QSB transaction between $75 and $150. For the mainnet demonstration, StarkWare indicated the actual expense fell in the low hundreds of dollars, approximately $150 to $200, and required several hours of continuous computation. These figures cover only the preparatory work and do not include the ordinary network fee.

QSB currently applies only to legacy pre-SegWit scripts. It does not protect Taproot outputs, Lightning Network channels or addresses whose public keys have already been revealed by prior spending. Coins must first be moved into a compatible QSB output through a conventional transaction before receiving the additional protection. That migration step itself carries risk if a capable quantum attacker already exists and can intercept the public key before confirmation.

Research cited in coverage of the event estimates that roughly 6.9 million bitcoin, nearly one-third of the total supply, sit in addresses with publicly visible keys. That figure includes an estimated 1 million bitcoin associated with early wallets. Daniel Batten, a Bitcoin specialist, has described claims that QSB already renders the network quantum-safe as an overstatement, noting its inability to address dormant coins and previously exposed keys.

Context of Quantum Concerns and Ongoing Proposals

In March, Google researchers estimated that a sufficiently advanced quantum machine might derive a Bitcoin private key in nine to twelve minutes after the corresponding public key becomes visible. Such a window could allow an attacker to replace a pending transaction before full confirmation. Levy introduced QSB in April in response to that threat model.

StarkWare positions the construction as a temporary safety net. Ben-Sasson has stated that a soft fork should occur and that he believes it will. Developers continue to examine protocol-level options, including BIP-360, which proposes Pay-to-Merkle-Root outputs designed to reduce long-term quantum exposure and remove Taproot’s quantum-vulnerable key-path spend. Unlike QSB, that proposal would require a consensus change.

The mainnet confirmation establishes that Bitcoin’s existing rules can accommodate at least one form of quantum-resistant spending. Independent review of the publicly available code, further testing and progress on more scalable post-quantum signature systems remain the next practical steps. The demonstration provides a working fallback while the broader discussion of network-level migration continues.