StarkWare confirmed that the first “quantum-safe” Bitcoin (QSB, Quantum Safe Bitcoin) transaction was mined on mainnet in block 964,199 on August 26. The transaction, with hash 305a24ff…ab07, combined two inputs (39,179 and 10,000 satoshis) into a single output of 44,000 satoshis, paid a fee of 5,179 satoshis, and had a size of 1,403 bytes.
How It Works
The notable aspect of this transaction is its use of a hash-based one-time signature rather than a conventional ECDSA signature. According to researcher Avihu Levy, who developed the open-source codebase for QSB, this mechanism relies on the hardness of the RIPEMD-160 preimage problem rather than the difficulty of breaking elliptic curves. ECDSA still appears in the verification process, but Levy describes it as “merely a vehicle,” while the actual security stems from hashing.
The transaction creation process is quite complex. First, an off-chain search over sequence and locktime values is required until the RIPEMD-160 hash of a public key bound to the transaction resembles a valid ECDSA signature (with a probability of roughly 1/2^46). Then, two additional search rounds select a subset of pseudo-signatures, and the chosen indices form a compressed identifier for the transaction, while the final step extracts the HORS preimage.
The transaction was executed without changing any of Bitcoin’s consensus rules. It utilizes legacy Bitcoin scripting rather than requiring a soft fork.
Putting It into Context
StarkWare and Levy refer to this as a QSB transaction, but the “quantum-safe” claim originates from them and the method’s author. The blockchain itself does not prove this claim. The Defiant, which reported the story, explicitly noted: “on-chain records confirm that the transaction was mined into a block, but they do not inherently validate the quantum-safe claim.”
Furthermore, QSB does not make all of Bitcoin quantum-resistant. Protection applies only to coins after they are moved into this specific output. Because it was a non-standard transaction, it had to be mined with the help of MARA Pool (via its Slipstream service), as it was not accepted by the standard mempool. Mempool.space labeled it “Non-Standard” and “Not seen in Mempool.”
The current scope cannot scale to everyday users or the Lightning Network. Levy himself acknowledged in the paper that this is a “last resort” measure: off-chain computational costs and on-chain fees are exceedingly high, the transaction creation process is far more complicated than for standard Bitcoin transactions, and it does not apply to Lightning channels.
Why It Matters
Despite its narrow scope, this represents an important experimental step toward Bitcoin’s post-quantum security scenario. As sufficiently powerful quantum computers could potentially break ECDSA signatures in the future, having a working fallback solution on mainnet—even on an experimental scale—is a milestone. It also shows that StarkWare is positioning itself within the long-term Bitcoin security space, extending beyond its role as an Ethereum Layer 2.