Key highlights:
- StarkWare cut the estimated GPU computing cost of its Quantum-Safe Bitcoin (QSB) construction 79% from $320 to $67
- QSB uses hash-based cryptography instead of ECDSA/Schnorr signatures to protect against Shor’s algorithm attacks on quantum computers
- No quantum computer capable of attacking Bitcoin exists today, but 6.9M BTC ($586B) sits in legacy/reused addresses with exposed public keys
Bitcoin’s potential quantum-security problem just became significantly cheaper to address after StarkWare cut the estimated computing cost of its experimental Quantum-Safe Bitcoin (QSB) construction by about 79%.
The estimated cost has fallen from roughly $320 to about $67 following a week-long optimization challenge involving StarkWare, Yukon Research and Eigen Labs.
The reduction does not mean Bitcoin is now quantum-safe or that a quantum computer capable of breaking the network exists.
Instead, it shows how optimization can sharply reduce the computing resources required for one potential defense mechanism.
Bitcoin’s quantum defense just got cheaper, from $320 to $67
According to the Starkware blog, the work targets a long-term concern for Bitcoin developers.
A sufficiently powerful quantum computer could use Shor’s algorithm to attack the elliptic-curve cryptography behind Bitcoin’s ECDSA and Schnorr signatures, potentially allowing an attacker to derive private keys from exposed public keys.
No machine capable of carrying out such an attack against Bitcoin exists today. Researchers, however, increasingly view quantum security as a migration problem that needs to be addressed before the technology becomes practical.
StarkWare’s QSB construction offers one possible defense under Bitcoin’s existing consensus rules. It uses hash-based cryptography instead of the elliptic-curve signatures normally used to authorize transactions, allowing eligible coins to be moved without requiring a Bitcoin soft fork.
The first QSB transaction reached Bitcoin mainnet on Aug. 26 through MARA’s Slipstream service. Producing it required about 3,100 GPU-hours, with StarkWare estimating the computing cost at around $320.
The optimization challenge began Sept. 16, with more than $20,000 in prizes offered to developers who could improve two computationally intensive parts of the process: transaction pinning, which searches for a valid commitment, and subset selection, which identifies the appropriate combination of components
On an RTX 4090 benchmark, pinning throughput increased from about 146 million verified candidates per second to more than 820 million, while subset selection rose from roughly 62 million to more than 623 million candidates per second.
StarkWare now estimates the GPU computing cost of producing a QSB transaction at about $67.
The figure remains a benchmark rather than a demonstrated production cost, as it covers GPU computation but excludes Bitcoin network fees. Another QSB transaction has also yet to be mined at the lower cost.
Notably, the construction relies on a computationally intensive search because QSB places a hash where Bitcoin normally expects a signature.
Developers repeatedly modify an input, calculate its hash, and check whether the result meets Bitcoin’s required format. Faster computation therefore directly reduces the resources needed to produce the transaction.
Despite the lower cost, QSB still has limitations, as its transactions are nonstandard and do not ordinarily relay through Bitcoin’s mempool, meaning they must be delivered directly to a miner.
The method also applies only to coins whose public keys have not already been exposed in ways that could leave them vulnerable to quantum attacks.
The development comes as researchers continue to examine both the cost of defending against and carrying out potential quantum attacks.
Recent research has reduced estimates for parts of the computational workload involved in attacking Bitcoin and Ethereum, although such work does not mean either network can currently be broken.
For Bitcoin, the debate remains focused on how quickly the network should prepare for a threat that does not yet exist but could eventually challenge its current cryptographic foundations.
Is Bitcoin ready for the quantum computing threat?
Overall, Bitcoin developers are already beginning to plan for the possibility that quantum computing could eventually threaten the cryptography securing the network.
Proposals including BIP-360 and BIP-361 are being developed to address vulnerabilities in existing Taproot, ECDSA, and Schnorr-based spending.
Both remain draft proposals rather than adopted Bitcoin upgrades, while the SHRINCS proposal for hash-based signatures is still experimental.
The challenge extends beyond selecting a new signature system. Wallets, hardware devices, exchanges, and custody providers would need to support new cryptography, while users would have to move vulnerable coins.
Dormant or lost Bitcoin could create an additional problem if their owners cannot participate in a future migration.
Ledger CTO Charles Guillemet has described the issue as a migration challenge rather than an immediate quantum crisis.
He has also noted risks with stateful signatures such as SHRINCS, where incorrectly tracking signing information or restoring an outdated wallet backup could expose funds to forgery.
European financial authorities are also assessing the potential risk. An assessment cited by CryptoQuant estimates that about 6.9 million Bitcoin, worth roughly $586 billion, may be more exposed because they sit in legacy or reused addresses with publicly visible keys.
The European Commission has urged member states to begin post-quantum transitions by the end of 2026, underscoring the possibility that the migration could take years.
Source:: Quantum-Safe Bitcoin Transactions Get 79% Cheaper as StarkWare Optimizes Experimental Tech