Date: August 2025
The transaction landed on Bitcoin's mainnet with no fanfare. No press release. No coordinated marketing push. Just a single, non-standard transaction that rewired the security assumptions of the world's oldest blockchain — at least for a narrow slice of its supply.
The cost: roughly $100 in cloud GPU compute. The stakes: 7 million BTC that remain exposed to a threat that hasn't materialized yet.
This is the story of how StarkWare researcher Avihu Levy moved Bitcoin from elliptic curve cryptography to hash-based spending conditions — and why the industry's response reveals more about our collective denial than our preparedness.
Context: The Quantum Threat That Refuses to Die
Let me be precise about the threat model, because most coverage of quantum computing and Bitcoin gets this wrong.
Bitcoin addresses in their most common form (P2PKH) do not expose the public key — only a hash of it. This is a critical detail that most casual observers miss. When you receive Bitcoin to a standard address, the public key remains hidden until you spend from that address for the first time. Only at that moment does the public key get revealed on-chain.
This design was originally a privacy feature. It turns out to be a quantum security feature as well.
The threat from a sufficiently powerful quantum computer comes from Shor's algorithm, which can efficiently solve the discrete logarithm problem underlying ECDSA — the signature scheme Bitcoin uses. If an attacker can obtain your public key, they can derive your private key in polynomial time on a fault-tolerant quantum computer. The hash of your public key, however, is protected by the preimage resistance of SHA-256, which is a fundamentally harder problem for quantum attackers.
This is the window QSB exploits. And it's narrower than you think.
Core: The Mechanics of a Quantum-Safe Transaction
I've spent the past week tracing through the technical specifications and the on-chain evidence. Based on my experience auditing DeFi protocols and standardizing blockchain data for institutional reporting, I can tell you this: the QSB construction is elegant, but its applicability is severely constrained.
The Core Mechanism
The QSB (Quantum Safe Bitcoin) construction, developed by StarkWare researcher Avihu Levy, leverages the time window between address creation and first spend. Here's how it works:
- The Time Window: Before a Bitcoin address spends funds for the first time, its public key is hidden behind a SHA-256 hash. This creates a natural barrier: a quantum attacker must first obtain the public key, then run Shor's algorithm to derive the private key. The QSB scheme exploits this window to migrate funds to hash-based spending conditions before the public key is ever revealed.
- Hash-Based Signatures: Instead of relying on ECDSA, the QSB transaction uses a hash-based signature scheme. The mechanism involves repeatedly varying candidate transaction data until a hash is produced that Bitcoin's consensus rules accept as a valid signature format. This shifts the security assumption from elliptic curve cryptography to the difficulty of hash function inversion — a problem quantum computers are significantly less effective at solving.
- Consensus Compatibility: The resulting transaction is valid under Bitcoin's consensus rules. However — and this is a critical caveat — it is non-standard. Under default node policies, it does not propagate through the public mempool. It requires specialized services like MARA's Slipstream to be submitted directly to miners.
The On-Chain Evidence
The first confirmed QSB transaction on Bitcoin's mainnet was processed by MARA, one of the largest Bitcoin mining operations. The transaction was submitted via their Slipstream service, which handles non-standard transactions that would otherwise be ignored by the network's default relay policies.
The cost structure is revealing. During the cloud GPU search phase, the operation cost between $75 and $150. This is roughly 100 times more expensive than a standard Bitcoin transaction, but as an emergency escape hatch, it's acceptable. The mainnet test transaction cost several hundred dollars.
What This Actually Protects
Here's where the narrative diverges from the technical reality. QSB only works for coins whose public keys remain hidden. This means:
- Applicable: Standard P2PKH addresses that have never spent funds
- Not Applicable: Old P2PK outputs where the public key is directly exposed
- Not Applicable: Taproot outputs, which use a different script structure
- Not Applicable: Reused addresses where the public key has already been revealed
The math here is sobering. Approximately 7 million BTC — roughly 33% of the total supply — have exposed public keys. These coins are outside QSB's protection entirely. No amount of clever scripting can help them; they require a protocol-level solution.
StarkWare CEO Eli Ben-Sasson was characteristically direct about this limitation: "This test should not be interpreted as evidence that Bitcoin is ready for quantum computing." He emphasized that "a broader soft fork solution is still needed."
Follow the gas, not the hype. The gas here tells a story of narrow applicability and significant operational friction.
Contrarian: The 7 Million BTC Blind Spot
The market's reaction to this news has been muted — appropriately so, in my assessment. But the lack of attention to the 7 million BTC exposure is itself a data point worth examining.
Let me quantify the risk more precisely. Based on my analysis of Bitcoin's UTXO distribution and address age profiles:
- ~93% of BTC has been mined (approximately 19.5 million BTC)
- ~33% of supply has exposed public keys (approximately 7 million BTC)
- The remaining ~67% benefits from the hash-based protection that QSB exploits
The 7 million BTC with exposed public keys represent a systemic risk that no application-layer solution can address. These coins are vulnerable to a sufficiently powerful quantum computer the moment their public keys are obtained — and for P2PK outputs, the public keys have been visible since 2009.
This is not a hypothetical concern. The Bitcoin Security Alliance — backed by BlackRock, Coinbase, and Strategy, with $15 million in independent funding — was formed specifically to address this threat. The U.S. Treasury has included digital assets in its quantum readiness planning. These are not signals of speculative interest; they are risk management responses.
The uncomfortable truth is this: QSB provides an escape hatch for perhaps 60-70% of Bitcoin's supply, but the remaining 30-40% requires a soft fork. And soft forks in Bitcoin are not technical problems — they are political ones.
DeFi efficiency is math, not marketing. The math here says that Bitcoin's quantum readiness is incomplete, and the missing piece requires consensus-level coordination that has historically proven difficult to achieve.
The Institutional Signal
The formation of the Bitcoin Security Alliance deserves more attention than it has received. BlackRock, Coinbase, and Strategy committing $15 million to quantum safety research is not charity — it's risk management.
From my experience working with institutional clients on the ETF approval process, I can tell you that these firms think in terms of fiduciary duty. They are not betting on quantum computers arriving next year. They are building the infrastructure to demonstrate to regulators and clients that they have addressed a known systemic risk.
The independent funding model is particularly notable. Rather than creating a centralized pool that could raise regulatory concerns, the alliance members are funding independent research efforts. This structure avoids the compliance issues that a centralized fund might face while still coordinating on standards and best practices.
This institutional involvement creates a new dynamic. When BlackRock's ETF clients ask about quantum risk, BlackRock can point to the alliance's work. When the Treasury Department evaluates digital asset risks, it can reference the alliance's research. The narrative is being built, and QSB is a proof point within that narrative.
The Migration Economics
Let me address the cost structure more directly, because it reveals something important about the adoption curve.
At $75-150 per transaction, QSB migration is not viable for small holders. A wallet with $100 worth of Bitcoin cannot justify spending $100 to migrate to a quantum-safe condition. This creates a tiered security landscape:
- Large holders: Can afford migration costs and have the technical expertise to execute QSB transactions
- Small holders: Cannot justify the cost and may not have the technical capability
- Institutional holders: Can build dedicated infrastructure for quantum-safe migration
This is not a criticism of the QSB approach — it's a recognition of its positioning. QSB is an emergency escape hatch, not a universal solution. It's designed for the scenario where a quantum threat becomes imminent and large holders need to move quickly.
The 7 million BTC with exposed public keys face a different calculus entirely. For these coins, no migration path exists at the application layer. The only solutions are:
- A soft fork that enables quantum-safe signatures for all outputs
- Accepting the risk and hoping quantum computers don't arrive before the coins are spent
- Moving to other chains that already have quantum-resistant signatures
Each option has significant costs and trade-offs. And none of them are being discussed with the urgency the risk warrants.
What the Data Doesn't Tell Us
There are several critical unknowns that the QSB test does not resolve:
The Timeline Question: When will a fault-tolerant quantum computer capable of running Shor's algorithm at scale exist? Estimates range from 10 to 30 years, but the uncertainty is enormous. IBM and Google are making progress, but the leap from current quantum processors to fault-tolerant machines is not linear.
The Hash Function Question: QSB relies on the preimage resistance of SHA-256. While hash functions are more resistant to quantum attacks than elliptic curve cryptography, they are not immune. Grover's algorithm provides a quadratic speedup for brute-force attacks, which effectively halves the security level of hash functions. Bitcoin's SHA-256 is currently considered safe, but this assumption needs continuous validation.
The Coordination Question: Even if a soft fork solution is proposed, Bitcoin's governance process makes implementation uncertain. The Taproot activation took years of discussion and signaling. A quantum emergency would require faster coordination than Bitcoin's historical norms suggest is possible.
Quantify the manipulation — or in this case, quantify the uncertainty. The data supports a clear conclusion: QSB is a meaningful technical milestone, but it is not the solution to Bitcoin's quantum problem. It is a bridge, not a destination.
The Takeaway: Watch the Signals, Not the Headlines
The QSB test is a data point, not a narrative. It tells us that application-layer quantum safety is possible for a subset of Bitcoin's supply. It does not tell us that Bitcoin is quantum-ready.
The signals I'm watching over the next 12-24 months:
- Quantum Computing Milestones: If IBM or Google announces a quantum processor with over 1,000 logical qubits, the threat timeline compresses dramatically. This would trigger panic migration and a surge in QSB demand.
- QSB Standardization: If the Bitcoin Security Alliance or a BIP proposal moves QSB from non-standard to standard transaction status, wallet integration becomes feasible. This would lower migration costs and expand the protection coverage.
- Soft Fork Discussions: The real solution to the 7 million BTC exposure requires protocol-level changes. Watch the Bitcoin developer mailing lists for quantum safety proposals.
- Institutional Product Launches: If BlackRock or Coinbase launches quantum-safe custody products, it signals that institutional risk management has fully incorporated the quantum threat.
The data doesn't lie, but it also doesn't predict. What it does is give us a clear picture of the current state: Bitcoin has a partial quantum safety solution, a significant exposed supply, and a coordination problem that no amount of clever scripting can solve.
The next chapter of this story will be written in governance forums and BIP discussions, not in transaction scripts. And that's where the data will tell us whether Bitcoin can solve its quantum problem before the problem solves Bitcoin.
Data doesn't lie, but it also doesn't predict. The next signal will come from the governance layer, not the application layer. And that's where I'll be watching.