Sat, 29 August 2026
Bitcoin28 August 2026

Quantum-safe bitcoin transaction: what it does and doesn’t

Block 964,199 carried the first bitcoin transaction signed with a quantum-safe signature. No softfork needed — and no, your coins are not safer for it.

Article image for: Quantum-safe bitcoin transaction: what it does and doesn’t

On 26 August 2026, block 964,199 confirmed the first bitcoin transaction authorised by a quantum-safe signature. No softfork was required. StarkWare, which built the method, says so itself: this does not make bitcoin quantum-safe — and that is the single most important sentence in the whole story.

What actually happened

The transaction carries the id 305a24ff…ab07, is 1,403 bytes in size and moved 44,000 satoshi. It had two inputs, of 39,179 and 10,000 satoshi, and paid 5,179 satoshi in fees.

The authorisation did not come from the usual ECDSA signature but from Quantum Safe Bitcoin (QSB), a scheme devised by Avihu Levy at StarkWare. QSB uses a hash-based one-time signature and binds it to one specific transaction. The trick lies in what has to happen next: offchain, sequence and locktime values are ground through until the RIPEMD-160 hash of the whole thing looks like a valid, DER-encoded ECDSA signature. So bitcoin sees something it recognises, while the security rests on the preimage resistance of the hash rather than on elliptic curves.

That search costs time and electricity: according to those involved, several hours and $150 to $200 of compute for this one transaction.

Why ordinary nodes would not relay it

The transaction has a non-standard form. Bitcoin nodes do not relay transactions like that, even though they are valid under the consensus rules. It therefore reached a block via Slipstream, the MARA Pool service that lets you hand a transaction straight to a miner.

That detail is not a footnote. It means the method only works today if a miner is willing to include your transaction — not because the network accepts it, but because one party puts it in.

What it does not do

StarkWare puts it most sharply itself: QSB does not make bitcoin quantum-safe. The protection applies only to coins that have first been moved to such a special output and are then spent from there. Anyone using ordinary ECDSA or Schnorr addresses falls outside it. A public key that is already visible on the chain — which is the case for every address that has ever been spent from — gains nothing from it either.

Levy adds two further limits: the scheme does not scale to the number of users bitcoin expects, and for the Lightning Network it is impractical.

CEO Eli Ben-Sasson describes it as a safety net for as long as protection at the protocol level is still being built. That is a more honest framing than ‘bitcoin is now quantum-safe’, a headline that ran on more than one site this week.

The route that does matter: BIP-360

Protection for everyone runs through the protocol, not through individual transactions. The proposal on the table for that is BIP-360: a softfork that introduces a Pay-to-Merkle-Root output type and strips out the quantum-vulnerable key-path spend of Taproot.

That demands network-wide coordination, which is precisely why it is slow going. A softfork changes the rules for everyone; a transaction like this one changes the rules for nobody.

What this means for your coins

In concrete terms: nothing changes today about what you yourself should do. The split in risk that already applied still applies.

The distinction that counts is whether your public key is visible. At an address that has never been spent from, only a hash of your public key sits on the chain. At an address you have spent from, the public key sits there in plain view. That second group is the vulnerable one in any future quantum attack.

Address reuse is therefore not a matter of tidiness but a choice about risk. That is already true today, quite apart from this news.

And no: a hardware wallet changes none of it. It protects your key against malware on your computer, not against mathematics. Anyone claiming otherwise is selling something.

FAQ

Are my bitcoins quantum-safe now?

No. This transaction protects only the coins that were moved to it and that are spent from there. For the rest of the network, nothing changes.

Should I move my coins now?

No. The method is non-standard, cost $150 to $200 of compute for a single transaction and needed a miner willing to take it directly. There is no wallet today that does this for you.

Does a hardware wallet help against quantum?

No. A hardware wallet keeps your private key away from your computer. A quantum computer that derives the private key from a visible public key has no need of your device.

So when is Q-Day?

There is no date for it, only estimates that sit far apart. We have previously set out how real the threat of Q-Day is and what has to happen before it becomes practical.

Are other chains already doing this?

Sui switched on quantum-resistant signatures in August. That is simpler for a younger chain: bitcoin has to work with rules that have been in place since 2009 and that you cannot simply change.

Sources

Both sources last checked on 29 August 2026. Block height, transaction id, amounts and the StarkWare statements match across both; the date of confirmation (26 August) comes from The Defiant.

Earlier on this subject: Wall Street arms bitcoin against quantum with $15 million.

#bitcoin#quantum#starkware#beveiliging#bip-360