StarkWare Confirms First Quantum-Safe Bitcoin Spend On Mainnet, Without A Protocol Change
StarkWare has reported that a Bitcoin transfer designed to withstand a future quantum-computer attack has been confirmed on the live network. The company said the spend used Avihu Levy’s Quantum-Safe Bitcoin construction, which was first described in a research paper in April 2026 and has now been executed on mainnet without any change to Bitcoin’s consensus rules.
The concern is well known. Bitcoin authorizations today depend on elliptic-curve signatures.
A sufficiently large quantum machine running Shor’s algorithm could recover a private key from a public key.
Most unused addresses hide that public key behind a hash.
The danger appears when a spend is broadcast: the signature reveals the key while the transaction still sits unconfirmed.
In that interval, an attacker with a working quantum computer could theoretically derive the key and race a competing spend.
Levy’s method adds a second lock based on hash functions rather than elliptic curves.
Hash constructions are not broken by Shor’s algorithm; the best-known quantum speedup against them is only a quadratic improvement in brute-force search, which is not enough to forge the spend.
In practice, the technique relies on intensive off-chain “signature grinding”: the sender searches until it finds a transaction whose hash happens to look like a validly formatted Bitcoin signature.
The network accepts the result under existing rules, and security then rests on the hardness of inverting a hash rather than on keeping an elliptic-curve secret.
The first such transaction was mined on 26 August 2026.
Because the script format is nonstandard, ordinary nodes would not relay it through the public mempool.
It was therefore submitted directly to a miner through Marathon Digital’s Slipstream service.
StarkWare and later reports described the computation as taking hours and costing on the order of a few hundred dollars—far above a typical Bitcoin fee, and therefore intended as an emergency path rather than everyday usage.
Company leaders were careful not to oversell the result.
The demonstration does not make the Bitcoin protocol itself quantum-safe.
Coins whose public keys were already visible remain exposed, and a protocol-level upgrade such as a soft fork is still described as the better long-term answer.
The test shows that holders can, at a cost and with miner cooperation, move funds into an output that a quantum adversary cannot open using today’s rules.
Levy presented the work as a personal project, with engineering support from Tomer Giladi. It does not use StarkWare’s STARK proofs; it is built only from primitives already available inside Bitcoin Script. StarkWare continues to argue for a coordinated protocol change while pointing to this construction as an interim option.
