As quantum computing threats loom, the Bitcoin community gains a groundbreaking defense. Avihu Levy, Chief Product Officer at Starkware and co-author of BIP-360, published a complete research paper and open-source implementation of Quantum Safe Bitcoin (QSB) on April 9, 2026. The scheme makes new Bitcoin transactions resistant to quantum attacks without any consensus changes, requiring no softfork, no community coordination, and no new opcodes. It operates entirely within Bitcoin’s existing script constraints of 201 opcodes and 10,000 bytes.
How QSB Replaces Elliptic Curve Security with Hash Preimage Resistance
Bitcoin's current signature scheme, ECDSA on secp256k1, is fully vulnerable to Shor's algorithm on a sufficiently powerful quantum computer. An attacker could recover private keys from any exposed public key, forge signatures, and redirect funds. P2PK outputs, legacy addresses, and Taproot key spend paths are all at risk the moment a public key appears on-chain.
QSB breaks that dependency at the transaction level. Instead of relying on elliptic curve hardness, QSB bases security on the preimage resistance of RIPEMD-160, a hash function that quantum computers can only attack with Grover's algorithm, which provides quadratic speedup but no total break. A 160-bit hash retains approximately 80 bits of preimage resistance against a quantum adversary, leaving ample margin. The construction modifies an earlier scheme called Binohash (by Robin Linus) and fixes two problems that made Binohash insecure against quantum attacks. First, Binohash’s signature-sized proof-of-work puzzle relied on finding small elliptic curve r values, which Shor’s algorithm trivially breaks. Second, an unresolved vulnerability in the Sighash flag could allow an attacker to reuse a valid puzzle signature across different transactions.
QSB replaces the signature-sized puzzle with what Levy calls a “hash-to-sig” puzzle. The spender iterates over transaction parameters until the RIPEMD-160 hash of a derived public key produces a valid DER-encoded ECDSA signature. This event occurs with a probability of roughly 1 in 70 trillion. Because the puzzle uses a hard-coded SIGHASH_ALL flag, the Sighash vulnerability is eliminated as a side effect.
The spender then performs two rounds of digesting using an HORS-style Lamport signature structure, selecting subsets of dummy signatures that modify the transaction’s sighash through a legacy script mechanism called FindAndDelete. Each subset yields a different hash output. The subset that produces a valid DER-encoded signature becomes the digest for that round. Revealing the corresponding preimages in the witness completes the quantum-safe spend.
Performance, Cost, and Limitations
The recommended configuration, Config A, fits within the 201-opcode limit and achieves approximately 118 bits of preimage resistance and 78 bits of collision resistance. A quantum adversary running Grover's algorithm against this configuration faces roughly 2^69 work for a second preimage attack. Shor's algorithm offers no advantage because no elliptic curve assumptions remain to break.
Off-chain computation costs between $75 and $150 per transaction in GPU cloud time at spot prices. The work is highly parallel and completed in hours across multiple GPUs in early testing. The GPU farm handles only public computations, including key recovery and hashing; private HORS preimages never leave the spender’s secure device.
Real limitations exist. QSB transactions are valid under consensus but non-standard, exceeding default relay policies. They require direct submission to a mining pool that accepts non-standard transactions, such as Marathon’s Slipstream service. The scheme does not yet cover Lightning Network channels. Full on-chain assembly and broadcast are still pending in the open-source implementation. Levy describes the scheme as a last-resort measure, not a general replacement for standard Bitcoin usage.
Community Reaction
Starkware co-founder Eli Ben-Sasson publicly endorsed the work, stating: “THIS IS HUGE. Bitcoin is quantum-safe TODAY. Even if a quantum computer capable of breaking conventional Bitcoin signatures appeared, this shows a practical way to create secure Bitcoin transactions. WITHOUT CHANGING THE BITCOIN PROTOCOL!” Taproot expert Eric Wall added: “Starkware has some of the best hackers on the planet. It is wonderful to see hackers using their skills for good.”
The full paper, GPU-accelerated CUDA code, Python pipeline, and complete Bitcoin scripts are available on Levy’s GitHub repository. The news follows a recent prototype by Lightning Labs CTO Olaoluwa Osuntokun to protect Bitcoin wallets from quantum risk.
What This Means for Regular Bitcoin Holders
For everyday Bitcoin (BTC) holders, the practical takeaway is straightforward. No quantum computer today can break Bitcoin’s cryptography, and most researchers place the threat at least three to ten years out. But the clock starts ticking the moment a public key appears on the blockchain, which happens every time a user spends from an address.
Bitcoin held in a wallet that has never made an outgoing transaction is less exposed. Bitcoin sitting in a reused or already-used address is another story. When quantum computing reaches the threshold, those exposed public keys will become targets. Moving funds before that window closes is more important than after.
QSB is not yet included in any consumer wallet. Users cannot today open a standard wallet and toggle on quantum-safe settings. What Levy has contributed is the cryptographic proof that the path exists, built from rules already within Bitcoin, with a GPU computing cost roughly equivalent to an airplane ticket. The remaining work is engineering, adoption, and time. For anyone holding BTC, the actions are simple: watch for post-quantum compatibility from wallet providers, avoid reusing addresses, and move funds to a quantum-safe address when that option becomes available in mainstream software. The tools to secure those bitcoins are being built right now.