StarkWare, the Israeli company behind the StarkNet Ethereum scaling network and the zero-knowledge STARK proof technology, said on Wednesday that it completed the first quantum-safe Bitcoin transaction confirmed on the mainnet, moving coins into a hash-based structure designed to protect against attacks that could exploit Shor’s algorithm. The company said the demonstration matters not only for Bitcoin, but also for other major blockchains that rely on elliptic-curve signatures and face a similar risk.

Why the issue has drawn attention

The underlying threat is straightforward. If a Bitcoin public key is exposed in public records, a sufficiently powerful quantum computer running Shor’s algorithm could potentially derive the corresponding private key and attempt to steal the funds.

According to Glassnode Research, 6.04 million BTC, or 30.2% of the cryptocurrency’s total supply, is quantum-exposed at rest. Of that amount, 1.92 million BTC are structurally exposed because of the output type, while 4.12 million BTC are operationally exposed because of practices such as address reuse and custody behavior.

Glassnode’s measure applies to coins whose public keys are already known before they are spent. A separate risk emerges when a hidden public key is revealed during the spending process.

There is currently no quantum machine capable of carrying out such an attack. Still, in 2026, Google researchers estimated that breaking Bitcoin’s secp256k1 curve would require either 1,200 logical qubits and 90 million Toffoli gates, or 1,450 logical qubits and 70 million gates. A simulation based on a superconducting architecture suggested that fewer than half a million physical qubits could be enough. The question extends beyond crypto: the U.S. National Institute of Standards and Technology published its first finalized post-quantum cryptography standards in August 2024, part of a wider effort to migrate industries off cryptosystems that large quantum computers could eventually break.

How StarkWare’s approach works

StarkWare’s demonstration addresses the problem that, in a standard Bitcoin payment, the private key can be exposed during transmission. In that case, a quantum attacker could potentially compute the key before the transaction is confirmed and outrun the original payment.

Avihu Levy, general manager of applications at StarkWare, created Quantum-Safe Bitcoin, or QSB, to address this weakness without changing Bitcoin’s consensus protocol. The method is based on Binohash and converts the quantum-vulnerable part of the protocol into a hash-to-signature puzzle that depends on RIPEMD-160’s pre-image resistance rather than elliptic-curve assumptions that Shor’s algorithm can break. Hash-based cryptography is one of the oldest post-quantum techniques, and the standardized post-quantum signature schemes already include hash-based designs.

Before broadcasting the transaction, the sender performs resource-intensive computation off-chain. Using Levy’s proposed setup, QSB is theoretically able to provide about 118 bits of second pre-image resistance against Shor’s threat model. A quantum attacker would still benefit from the quadratic speedup associated with Grover’s algorithm, but would not gain the exponential advantage that Shor’s algorithm offers against elliptic-curve cryptography.

Levy’s work became public in April 2026, and StarkWare engineer Tomer Giladi played a key role in deploying the first mainnet transaction using the method.

The limitations of the test

The approach has practical constraints. In Levy’s research, the cost of off-chain GPU computation needed to produce a transaction is about $75 to $200, while the study abstract says the amount could be a few hundred dollars. Depending on GPU availability, the computation may take several hours.

QSB transactions can also be treated as nonstandard under Bitcoin relay policy, which means they cannot move through the normal mempool route. For that reason, StarkWare sent its transaction directly to a miner, and MARA, one of the largest publicly traded Bitcoin mining companies, included it through the Slipstream service, which the firm operates to accept transactions directly rather than through the public mempool.

The company also stressed that QSB does not protect the 6.04 million BTC that Glassnode identified as already exposed. If an attacker has enough time to observe a public key and later derive the private key, the attack can happen without waiting for the relevant transaction. QSB is intended as a way to secure protected coins, not to solve the entire Bitcoin quantum-risk problem.

Why StarkWare still wants a soft fork

Levy and StarkWare CEO Eli Ben-Sasson, a co-inventor of the STARK proofs that underpin the company’s technology, say the long-term solution remains a protocol-level upgrade. BIP 360 proposes Pay-to-Merkle-Root, or P2MR, as a new output type designed to help users migrate away from quantum-vulnerable signature paths. BIP 361 proposes a phased sunset for legacy ECDSA and Schnorr signatures. It also says that more than 34% of all bitcoin had revealed a public key on-chain as of March 1, 2026.

Bitcoin Improvement Proposals are the design documents for changing the protocol, and activating either one as a soft fork would require broad agreement among developers, miners, and users, a bar that has historically made contested upgrades slow and rare.

Ben-Sasson described StarkWare’s demonstration as a temporary buffer rather than a permanent fix.

“Avihu’s breakthrough is important because it gives the psychological reassurance which we need and which the asset itself needs.”

He has previously compared the crypto industry’s response to the threat to passengers on the Titanic. After Wednesday’s test, he said the demonstration showed that “there are lifeboats.”

Bitcoin traded near $78,620 as the news circulated.