Quantum-safe Bitcoin without a fork: what QSB locks, and which boxes it cannot save

Updated September 2026

Most quantum plans for Bitcoin need a soft fork, and a soft fork can take years to agree on. QSB is the exception: a transaction built so that even a machine able to break elliptic curve keys could not redirect it, with no change to the rules. On September 23, 2026, StarkWare reported that a week of open competition had cut the estimated cost of making one by 79%. Here is what QSB does, what it really costs, and why, once a quantum computer exists, it only helps coins whose box is still closed.

What is a quantum-safe Bitcoin transaction?

QSB comes from a paper by StarkWare's Avihu Levy, "Quantum-Safe Bitcoin Transactions Without Softforks", dated April 9, 2026. StarkWare says Levy built it after hours, as a side project. Despite the company's name, it uses no STARK proofs. It adapts Binohash, a February 2026 design by BitVM creator Robin Linus, posted to Delving Bitcoin, for reading transaction data inside Bitcoin Script.

The problem it answers is the one this site calls the short exposure attack. When you spend, your wallet publishes your public key and a signature, and the transaction waits in the mempool until a miner picks it up. A quantum computer that could recover the private key in that window could sign a competing transaction that sends the same coins elsewhere. That race is laid out on long exposure vs short exposure.

QSB makes that forgery worthless. The coins are bound to the transaction by a one-time signature built only from hashes, the kind of signature Shor's algorithm does not help with. An ordinary elliptic curve signature still appears in the process, but the project's README describes it as a vehicle for the puzzle, not something the spend's security depends on.

How does a hash stand in for a signature?

Bitcoin Script cannot read a transaction directly. Binohash and QSB get a fingerprint of it by a side door. The locking script contains a fixed signature. When the coins are spent, the spender works out, off the chain, the public key that would make that signature valid for this exact transaction and supplies it, and the script checks that it fits. That key is unique to the transaction. The script then hashes it and requires the result to happen to parse as a correctly formatted signature.

Almost no hash outputs do. StarkWare puts the odds at about one in 70 trillion for the paper's main design, which uses RIPEMD-160. The lock script of the one mined example uses SHA-256 instead, which the paper puts at roughly twice those odds. The only way to find a transaction that passes is to try variations, changing free fields such as the sequence and lock time numbers, trillions of times over. That search, the first of two done on graphics cards, is called pinning: once a transaction passes, changing anything in it breaks the puzzle.

A second stage, run twice, builds the fingerprint that gets signed. The script holds two pools of 150 dummy signatures, one per round, and an old quirk of legacy multisig checking means each choice of a subset from a pool changes the signature hash of the same transaction. In each round the spender searches for a subset that passes the puzzle again, and the positions of the chosen signatures become a digest of the transaction. The spender then signs that digest with HORS, a Lamport-style one-time signature, by revealing hash preimages that only they know.

Binohash alone was not enough. It used the size of a signature as its proof of work, and the paper explains that a quantum computer could build signatures around an unusually small value, making them short without any grinding. QSB replaced that step with the hash puzzle above, which Shor's algorithm cannot shortcut.

What did the first QSB transaction look like?

The lock went on chain first. A transaction mined in block 958,306 on July 16, 2026 sent 10,000 sats to an output whose locking script is 9,923 bytes long, paying a 30,000 sat fee for the whole 10,125-byte transaction. That output is the QSB box.

The spend came six weeks later. Transaction 305a24ff was mined in block 964,199 on August 26, 2026. It is 1,403 bytes and paid 5,179 sats in fees. It combined the 10,000 sats in the QSB box with an ordinary 39,179 sat input from a bc1q address that had already spent, and sent 44,000 sats to an ordinary bc1q address. StarkWare's announcement put the cost at several hundred dollars, and its challenge post three weeks later said building it took roughly 3,100 GPU-hours on a fleet of about 100 graphics cards, about $320. StarkWare engineer Tomer Giladi carried the work to mainnet.

Three details explain why it looks so unusual:

• It is legacy script. The trick depends on a signature-removal step in old multisig checks and on a quirk in the old way of hashing transactions for signing, both of which SegWit removed, and on ECDSA, which Taproot replaced with Schnorr signatures. So QSB cannot live in a bc1q or bc1p output.
• It is a bare script, not P2SH. The script is far bigger than the 520 bytes a P2SH redeem script may have, so the whole thing sits in the output itself, within the legacy limits of 201 non-push opcodes and 10,000 bytes.
• It is nonstandard. Ordinary nodes do not relay it, so it has to go straight to a miner. The paper names Marathon's Slipstream as one such route, and StarkWare says MARA Slipstream carried the first spend.

What changed in September 2026?

On September 16, StarkWare, Yukon Research and Eigen Labs announced the Quantum-Safe Bitcoin Optimization Challenge, with $20,000 in prizes from StarkWare and a further prize from Yukon. It had two tracks, one for the pinning search and one for the subset search, scored by how many candidates a submitted graphics-card program checks per second.

A week later StarkWare reported interim numbers. On the benchmark RTX 4090, pinning had gone from 146.09 million candidates per second at the baseline to just over 820 million, and subset selection from about 62 million to 623,518,629. There had been 62 promoted submissions, and StarkWare said the leading entries came from developers working with AI coding models. The challenge dashboard, which applies its own measurements and hardware assumptions to the first transaction's cost, put the estimate at about $67, the figure StarkWare reported.

The numbers kept moving. On September 28, 2026, the challenge dashboard showed an estimated $61 for a simulated fleet of 100 RTX 3090 cards. The single-card records on the benchmark RTX 4090 stood at 1,008,206,828 candidates per second for pinning, about 6.9 times the baseline, and 708,411,009 for subset selection, about 11.4 times. The dashboard's page data lists both tracks as closing on October 7; the organizers' posts give no end date.

Read those figures with the caveats their publishers attach. StarkWare stresses that the figure rests on assumed hardware and should not be read as a price. The benchmark builds no real transactions, so the speedups still have to be measured in the working tool. CoinDesk noted on September 24 that the faster code had not been shown preparing another mined transaction, and that applying the speedups shown on the contest site to its cost breakdown gave about $83 by CoinDesk's own arithmetic. As of September 28, only one QSB spend is publicly known.

Which boxes can QSB protect?

Once a quantum computer exists, only closed ones. StarkWare states the limit plainly in all three of its posts: QSB does not help coins whose public key has already been exposed.

Think of what the attacker needs. Against a closed box, a 1, 3 or bc1q address that has never spent, the attacker sees only a hash and has nothing to feed Shor's algorithm until you spend. If those coins sit in a QSB lock, the later spend out of the lock is bound by a hash-based signature, and the mempool race has nothing to win.

Against an open box, the attacker does not wait for you. The key is already on the chain because the address spent before, was reused, holds an old P2PK output or is a Taproot bc1p address. An attacker with a working machine could derive the private key and move the coins first. No transaction you build afterwards, QSB included, can take that back.

Before that machine exists, the picture is different. Getting coins into a QSB lock is itself an ordinary signed spend from your current address, and it reveals your public key like any other spend. Because the new output is nonstandard, that transaction also has to go straight to a miner. Today the revealed key is harmless, because no machine can use it, so coins in an open box can still be moved, into a QSB lock or simply to a fresh address that has never spent. That is why QSB is a tool to set up before the threat arrives. StarkWare pitches it as an emergency option for holders whose balance is still unexposed. A move made after a capable machine exists would depend on that direct path to a miner, and the paper notes that even a privately mined spend could be at risk if other miners were tempted to rewrite the block.

Taproot cannot host the lock at all, because the trick relies on ECDSA and legacy quirks that Taproot left behind. The paper adds that Taproot would not help anyway: every Taproot output can also be spent through its key path, so an attacker able to compute that key could spend it whatever scripts sit in its tree. That is the same reason Taproot opens the box on arrival.

QSB is a stronger lock for coins whose box is still closed when the threat arrives. It cannot close a box that is already open.

A QSB box is also a different kind of box. Its entire 9,923-byte script is visible from the moment it is funded. What it shows are mostly hash commitments, whose preimages stay secret until the spend, plus fixed signatures that are public by design. A quantum computer could break those signatures, but the paper finds that gains an attacker nothing, because the lock's security rests on the hashes.

How strong is it against a quantum computer?

Strong against Shor's algorithm, thinner against Grover's. Shor breaks elliptic curve keys, and QSB's security does not rest on one. Grover's algorithm speeds up brute-force search against hashes, roughly halving the bits of preimage resistance.

The paper's recommended configuration gives about 118 bits of second-preimage resistance and about 78 bits of collision resistance, and says the first falls to roughly half under Grover. The project's README and StarkWare put that at about 59 bits. Those figures assume RIPEMD-160 as the puzzle hash. The mined transaction's script uses SHA-256, a variant the paper's own table puts at about 115 bits of preimage resistance. The paper argues the practical picture is better than the halving suggests, because Grover's search spreads poorly across many machines and would need large reversible circuits for the hashing and key recovery involved.

The paper also notes that a 160-bit hash keeps about 80 bits of preimage resistance against a quantum attacker. For comparison, 160 bits is the size of the hash behind 1 and 3 addresses and single-key bc1q addresses, the hash that keeps a closed box closed today.

Why is it a last resort and not the fix?

The paper itself calls QSB a last-resort measure and gives the reasons: neither the grinding bill nor the on-chain cost of such large transactions scales to every user and every transaction, the transactions are nonstandard, building them is more complex than a normal spend, and it does not yet cover Lightning channels. Each spend needs its own grinding run.

One practical point works in its favor. The graphics-card search uses only public data, the locking script and an unsigned transaction template, so it can be handed to rented hardware without trusting it. The one-time signature secrets stay on the spender's own device.

StarkWare is clear about where it stands. "This effort does not make Bitcoin quantum-safe," its September 23 post says, and the company still prefers a soft fork as the long-term answer. That road runs through proposals such as BIP-360, whose new output type protects against long exposure attacks, and through the argument over what the first post-quantum output type should look like, covered in P2TRv2 vs P2MR. QSB covers the mempool race that BIP-360 alone does not, but at a cost measured in GPU-hours per spend.

What should you do now?

• Nothing urgent. No quantum computer can break secp256k1 today. QSB exists as a fallback, and a working fallback is reassuring news, not a warning.
• Keep your boxes closed. Coins in addresses that have never spent keep every future option open, QSB included. Avoid address reuse, and if you consolidate, move the whole balance to a fresh address.
• Do not try it with real savings. QSB needs experimental tooling, a nonstandard script and a direct path to a miner. A mistake in any of those can strand coins.
• Watch three things. A second mined QSB transaction at the lower cost, the contest's final results, and progress on a soft fork. This page will be updated when any of them moves.