Bitcoin Mines First Quantum-Safe Transaction on Mainnet

MakeCryippreferred on

• A transaction confirmed on Bitcoin’s mainnet on August 26 became the first real-world use of “Quantum-Safe Bitcoin,” a method built by StarkWare researcher Avihu Levy, without any change to Bitcoin’s consensus rules.
• The method secures new coin movements with hash-based cryptography instead of elliptic curves, but it does not protect the roughly 6.9 million bitcoin already sitting in exposed addresses.
• Producing the transaction cost StarkWare several hundred dollars in computation, more than the roughly $35 worth of bitcoin it actually moved.

A Bitcoin transaction confirmed in block 964,199 on August 26 moved 0.00044 BTC, worth about $35, into an output secured by a new kind of lock.

StarkWare, the company behind the method, says it is the first real-world demonstration of Quantum-Safe Bitcoin, a technique its researcher Avihu Levy designed to shield coins from a future quantum computer without requiring Bitcoin to adopt a soft fork.

StarkWare CEO Eli Ben-Sasson’s 4% Bitcoin issuance proposal has reignited debate over the 21 million supply cap and digital scarcity. Meanwhile, StarkWare’s private KYC framework uses zero-knowledge proofs to verify eligibility without exposing users’ full identity documents.

Why it matters

The demonstration is real, but its reach is narrow. It only protects coins moved into new, hash-secured outputs going forward. Any address whose public key is already visible on-chain, including coins spent since Bitcoin’s 2021 Taproot upgrade, gets no benefit from it, because a quantum attacker could still derive the private key before a defensive transaction reaches the chain.

The mechanism behind it is called signature grinding, a way of producing a valid Bitcoin signature without holding the underlying private key. It replaces the elliptic-curve math that secures ordinary Bitcoin signatures, which a sufficiently powerful quantum computer running Shor’s algorithm could theoretically break, with hash-based security that resists that attack. It draws on a construction called Binohash, built separately by BitVM creator Robin Linus.

Because the technique works within Bitcoin’s existing script rules, it reached mainnet without a protocol upgrade or a community vote. StarkWare engineer Tomer Giladi turned Levy’s research into the working transaction, which was submitted directly to a mining pool through MARA Slipstream.

The big picture

That narrow reach matters because of how much bitcoin is already exposed. 6.9 million bitcoin, close to a third of the total supply, sit in addresses with public keys visible on-chain, according to research on Bitcoin’s quantum exposure published this spring.

That pool includes an estimated 1 million bitcoin tied to Satoshi Nakamoto’s earliest wallets. A voluntary migration standard called BIP-360 and a detection-based defense proposed by BitMEX Research both aim at that larger problem, and neither had reached developer consensus as of that reporting.

Set against that pool, Wednesday’s transaction is a proof of concept. Grinding the signature cost StarkWare several hundred dollars by its own account, more than the roughly $35 the transaction moved. No outside cryptographer or Bitcoin developer has yet published an independent technical assessment of this specific transaction.

The path from demo to defense

Levy’s code is public on GitHub. StarkWare separately rolled out a three-phase post-quantum roadmap for its own Starknet network in June, a project with its own commercial stake in being seen as ahead on quantum security.

Whether Wednesday’s transaction becomes more than a one-off demonstration depends on grinding costs falling and wallets or custodians actually adopting the method to move exposed coins at scale. Until then, Bitcoin’s largest quantum exposure sits exactly where it did before this transaction was mined.