
The “Quantum Safe Bitcoin” scheme uses a brute-force hash-to-sig method but estimates $75–$150 of GPU cost per transaction.
StarkWare chief product officer Avihu Levy published a “Quantum Safe Bitcoin” transaction scheme that aims to keep individual BTC spends secure against Shor’s algorithm without any Bitcoin protocol upgrade. The design shifts the security burden to brute-force hashing work, trading off cost, complexity, and limited deployability.
Levy’s proposal targets a narrow but urgent question: can a Bitcoin holder make a quantum-resistant spend today, without waiting for a network-wide upgrade. QSB’s answer is yes, at least for specific transactions, by operating entirely inside Bitcoin’s current legacy script constraints.
The claim is scoped to transaction-level protection. Levy argued the scheme would remain secure “even against an adversary with a large-scale quantum computer running Shor’s algorithm.” That matters because Shor’s algorithm is the canonical threat model for public-key cryptography, including the elliptic-curve assumptions that underpin Bitcoin’s ECDSA signatures.
StarkWare CEO Eli Ben-Sasson endorsed the significance, saying “This is huge,” and arguing it “essentially makes Bitcoin quantum-safe today.” That framing is contested, and the pushback is where the market-relevant nuance sits.
Bitcoin spends typically prove authorization with ECDSA, which relies on elliptic-curve math that becomes fragile if a sufficiently capable quantum computer can run Shor’s algorithm at scale.
QSB pivots away from that dependency. Instead of treating the signature as something produced by a private key, the spender brute-forces an input until its hash output randomly resembles a valid ECDSA signature. The proposal describes this as a “hash-to-sig puzzle,” and the security intuition is simple: brute-force hashing is expensive, and the work is not described as something a quantum computer can shortcut in the way it can shortcut elliptic-curve problems.
That is why QSB can be pitched as “no-upgrade” quantum resistance for a single spend. It does not require new opcodes or new consensus rules. It uses the script system Bitcoin already has.
The tradeoff is explicit. Levy estimated QSB could cost between $75 and $150 per transaction in GPU computing power, and he described it as more complex than a typical Bitcoin transaction. In practice, that cost profile reads like a tool for whales, treasuries, and high-value UTXO consolidation, not retail flow.
Deployability is the second constraint. The researchers characterized QSB as “non-standard,” meaning it may be valid under consensus rules but still fail to propagate cleanly across default node relay policies or get picked up by miners without policy changes. They also flagged that the approach does not cover Lightning Network use cases, limiting its relevance for off-chain payment channels.
The authors framed the scheme as a stopgap, not a migration plan. Their own language is blunt: “While this article describes a solution that works today for quantum-safe Bitcoin transactions, it should be treated as a last-resort measure.”
Criticism also centers on what QSB does not touch. Bitcoin ESG specialist Daniel Batten called the “quantum-safe today” framing “an overstatement” because exposed public keys and dormant wallets are “not addressed in the paper.” Batten pointed to an estimate of 1.7 million BTC in early P2PK outputs as potentially vulnerable to quantum cracking, a separate risk surface from making a new spend harder to attack.
The near-term tell is policy, not theory. If QSB remains “non-standard” in practice, the market impact is mostly narrative and contingency planning. If pools or major node operators explicitly accept and mine these transactions, QSB becomes a usable emergency lane for large holders.
The longer-term signal is whether follow-on work moves from transaction-level workarounds to protocol-level quantum-safe signatures, which the researchers still describe as the preferred end state.
Two open variables need tightening before desks can model real adoption: replication of the $75–$150 GPU estimate, including hardware and electricity assumptions, and any observed on-chain examples that demonstrate reliable relay and inclusion.
A parallel track is emerging around alternative authorization. Lightning Labs CTO Olaoluwa Osuntokun published a quantum “escape hatch” prototype that would let users prove wallet ownership from the original seed phrase without revealing it. Whether that stays a prototype or becomes a credible recovery path is another signal for how the ecosystem plans to handle key exposure.
QSB reads like an emergency procedure for specific UTXOs, not a credible path to migrate the whole network. The researchers themselves label it last-resort, non-standard, and not applicable to Lightning, which is enough to cap expectations even if the cryptographic idea holds up.
The threshold that matters is miner and relay acceptance. If QSB transactions can be reliably propagated and mined, large holders get a practical, expensive escape route for high-value spends. If it stays policy-fragile and costly, the setup looks more like a sentiment catalyst than a fundamental shift, and the only development that truly matters is momentum toward protocol-level quantum-safe signatures that cover the full surface area, including dormant-key exposure.