StarkWare Researcher Proposes Quantum-Safe Bitcoin Without a Soft Fork

Bitcoin relies on elliptic-curve signatures to authorize spending, leaving coins potentially exposed if a sufficiently powerful quantum computer uses Shor’s algorithm to derive private keys. The risk is greatest for addresses whose public keys are already visible and during the confirmation window after a holder broadcasts a transaction. Coinbase’s quantum advisory council estimated in June 2026 that roughly 7 million BTC could be vulnerable because of exposed public keys and address reuse, sharpening calls for a network-wide migration.

On Aug. 26, StarkWare said its Quantum-Safe Bitcoin (QSB) transaction was confirmed in mainnet block 964,199, spending a 10,000-satoshi output. The test took hours of computation and cost about $150 to $200; because the format is nonstandard, it was submitted directly to MARA Pool through Slipstream. QSB, proposed by StarkWare researcher Avihu Levy in April, combines hash-based one-time signatures with “signature grinding.” StarkWare said the method protects individual transactions but not already-exposed public keys, and still favors a protocol-level soft fork for comprehensive protection.

A sufficiently powerful quantum computer could eventually break the elliptic-curve signatures protecting Bitcoin, putting coins at risk once their public keys are exposed. That prospect has pushed developers to seek an upgrade well before such machines become practical. Blockstream’s SHRINCS design uses post-quantum signatures while seeking to prevent their much larger data footprint from displacing ordinary transactions, a central obstacle facing earlier proposals.

Blockstream published the SHRINCS Bitcoin Improvement Proposal in August 2026 after testing the mechanism on its Liquid sidechain. The proposal separates bulky post-quantum signature data in a way intended to preserve Bitcoin’s regular transaction capacity. The trade-off is higher data and verification overhead, along with added implementation complexity. SHRINCS must still undergo technical review and win broad developer and community support before any activation path can be considered.

Bitcoin relies on elliptic-curve cryptography to authenticate wallet transactions. A sufficiently powerful quantum computer could derive private keys from exposed public keys, allowing an attacker to forge signatures and seize funds. The risk is not immediate, but migration is complex because blockchains must distinguish legitimate owners from attackers after conventional signatures fail. Coinbase’s quantum advisory council said in June 2026 that about 7 million bitcoin could eventually be exposed if holders do not move assets to quantum-safe addresses.

On July 15, 2026, Project Eleven unveiled a post-quantum zero-knowledge proof developed with Jim Posen, lead maintainer of the open-source Binius proof system. The method uses BIP-32 wallet derivation to prove control of key material above an address without revealing it, potentially authorizing recovery into a quantum-safe wallet. On an M5 MacBook Air, the prototype generated a proof in 243 milliseconds using four cores and verified it in 40 milliseconds, with 2.1 GB of peak proving memory. It supports P2PKH, P2WPKH and P2SH-P2WPKH addresses, but remains unaudited and requires protocol-level integration.

Bitcoin’s current Elliptic Curve Digital Signature Algorithm, or ECDSA, could eventually be vulnerable to quantum computers, requiring the adoption of post-quantum signatures approved by the U.S. National Institute of Standards and Technology. But the new signatures are 10 to 100 times larger than those now in use. Adding them directly would cause blockchain data to surge, undermine decentralization and sharply reduce transaction speeds, leaving the Bitcoin network with a difficult trade-off between quantum security and operational efficiency.

In July 2026, a StarkWare co-founder said a better approach would be to use ZK-STARKs to aggregate multiple post-quantum signatures into a single proof instead of expanding block capacity from the current 4MB to 32–64 MiB. That same month, StarkWare also unveiled a three-stage upgrade plan for Starknet and began studying a fork-free solution with estimated computational costs of $75–$150 per transaction to protect against quantum-security threats.

Quantum computers could eventually use Shor’s algorithm to break the elliptic-curve cryptography used by most blockchains, threatening wallet private keys and transaction verification. The proof layer of Ethereum Layer 2 network Starknet uses hash-based STARKs, giving it a foundation for quantum resistance. Legacy contracts and components connecting Starknet to Ethereum still require upgrades, however, making the work critical to the long-term security of assets.

On June 30, 2026, StarkWare unveiled a three-phase roadmap. Phase one will replace Pedersen with BLAKE2, with the operating system configuration hash expected to reach mainnet in early July and the remaining work taking about two months. Phase two will take roughly another month to provide migration tools for legacy contracts. Phase three will address bridging and data availability, with its timetable depending on Ethereum.

Bitcoin uses elliptic-curve cryptography to protect assets and communications, but sufficiently powerful quantum computers could eventually break its current encryption. Experts say the more immediate danger is a “harvest now, decrypt later” strategy, in which attackers intercept and store large volumes of encrypted communications today, then recover sensitive historical data once the technology matures. The threat extends beyond wallet private keys.

Security experts and an early-stage venture investor have recently warned that historical communications and infrastructure data across the Bitcoin ecosystem may already be targets for quantum attacks. Ethereum has begun work on a post-quantum migration, but as of this report, neither Bitcoin nor related companies had publicly committed to specific safeguards, disclosed investment amounts or set completion dates. The upgrade timetable and division of responsibility therefore remain unclear.

Major blockchains including Bitcoin use elliptic-curve cryptography to secure transactions. If a large-scale quantum computer could run Shor's algorithm, it might derive private keys for older wallets whose public keys have been exposed on-chain. Unlike newer wallets, Pre-BIP32 addresses from the Satoshi era cannot be upgraded automatically. That has put about 1.1 million BTC in the spotlight, with their security also affecting market confidence.

AmericanFortress unveiled a post-quantum signature proposal on May 21, 2026. It plans to use a backward-compatible soft fork to freeze older assets before verifying ownership with zero-knowledge proofs. The company said the approach could protect Satoshi Nakamoto's roughly 1.1 million BTC and nearly 5 million dormant BTC. It also completed an $8 million seed round on May 5, co-led by institutions including SAVA Digital Asset Fund.

Bitcoin, with a market capitalization of about $1.3 trillion, relies on elliptic-curve cryptography to secure transactions. If large-scale quantum computers become viable, exposed public keys could potentially be used to derive private keys. Bitcoin developers have therefore proposed BIP-360, adding a quantum-resistant migration to the network’s long-term technical roadmap to reduce the potential risk to existing assets.

Proposed in 2025, BIP-360 introduces Pay-to-Merkle-Root (P2MR), which removes Taproot’s public-key spending path and instead locks scripts with a Merkle root, allowing keys to remain hidden until funds are spent. The proposal remains a draft, with no mainnet activation date, and does not yet introduce a complete post-quantum signature scheme. It nevertheless establishes a foundation for future upgrades.

If quantum computers were to break Bitcoin's ECDSA signatures, funds held at older addresses whose public keys have been exposed could be stolen. These include addresses attributed to Satoshi Nakamoto, who is estimated to hold about 1.1 million BTC. The dispute centers on whether the community should preemptively freeze vulnerable legacy coins: doing so could prevent theft but might also permanently deprive their original owners of access.

Paradigm partner Dan Robinson unveiled PACTs on May 1, 2026. The proposal would let holders use BIP-322 signatures and OpenTimestamps to create private, timestamped proof of control without moving their BTC. If Bitcoin later freezes vulnerable addresses through a soft fork, holders could recover their assets using quantum-resistant STARK proofs. The proof must be created before a quantum attack or freeze, however, and the proposal has not yet been implemented.

Bitcoin relies on elliptic-curve digital signatures to secure asset ownership, but powerful quantum computers could eventually derive private keys from public keys that have already been exposed. ARK Invest and Bitcoin financial services provider Unchained therefore studied advances in quantum technology and potential paths for Bitcoin to adopt quantum-resistant cryptography, an issue with implications for long-term asset security and consensus on network upgrades.

On March 11, 2026, ARK Invest and Unchained published the “Bitcoin and Quantum Computing” white paper, estimating that 34.6%, or about 6.9 million BTC, is theoretically at risk. That includes about 1.7 million BTC believed to be lost and roughly 5.2 million BTC that could be moved to more secure addresses. The report said the threat would emerge in stages and was not urgent in the near term, leaving the community time to deploy quantum-resistant solutions.