Avihu Levy, Chief Product Officer at Starkware and co-author of BIP-360, published a complete research paper and open-source implementation on April 9, 2026, demonstrating quantum-safe Bitcoin transactions using only existing protocol rules. The scheme, called Quantum Safe Bitcoin (QSB), requires no soft fork, no community vote, and no new opcodes. It operates entirely within Bitcoin's 201-opcode and 10,000-byte script limits, making it the first known method to secure Bitcoin transactions against Shor's algorithm without altering the protocol.
Breakthrough: Quantum Safety Without Protocol Changes
Bitcoin's current ECDSA signature scheme over the secp256k1 elliptic curve is fully vulnerable to Shor's algorithm on a sufficiently powerful quantum computer. An attacker could recover private keys from any exposed public key, forge signatures, and redirect funds — threatening P2PK outputs, legacy addresses, and Taproot key-spend paths. Levy's scheme breaks this dependency at the transaction level. Instead of relying on elliptic curve security, QSB builds its security on the preimage resistance of RIPEMD-160, a hash function that quantum computers can only attack using Grover's algorithm, which offers only quadratic speedup rather than full break. A 160-bit hash retains about 80 bits of preimage resistance against a quantum adversary, providing a comfortable margin.
QSB modifies an earlier scheme called Binohash by Robin Linus, fixing two issues that made Binohash insecure against quantum attacks. The first was a proof-of-work puzzle in signature size that depended on finding small elliptic curve r-values — something Shor's algorithm cracks effortlessly. The second was an unresolved sighash flag vulnerability that could allow an attacker to reuse a valid puzzle signature across different transactions.
Technical Mechanism: Hash-to-Sig Puzzle Based on RIPEMD-160
QSB replaces the signature-size puzzle with what Levy calls a 'Hash-to-Sig' puzzle: the sender iterates through transaction parameters until the RIPEMD-160 hash of a derived public key produces a valid DER-encoded ECDSA signature — an event with a probability of about 1 in 70 trillion. Because the puzzle uses a hardcoded SIGHASH_ALL flag, the sighash vulnerability is eliminated as a side effect. The sender then performs two digest rounds using a HORS-style Lamport signature structure, selecting subsets of dummy signatures that alter the transaction's sighash via an older script mechanism called FindAndDelete. Each subset produces a different hash output. The subset that produces a valid DER-encoded signature becomes the digest for that round. Revealing the corresponding preimages in the witness finalizes the quantum-safe output.
Levy's recommended configuration, 'Config A,' operates within the 201-opcode limit, achieving approximately 118 bits of preimage resistance and 78 bits of collision resistance. A quantum attacker using Grover's algorithm against this configuration would face roughly 2^69 computational work for a second-preimage attack. Shor's algorithm offers no advantage since no elliptic curve assumptions remain to be broken. Off-chain computation costs between $75 and $150 per transaction in cloud GPU time at current spot prices. The work is highly parallelizable and has been completed in a few hours on multiple GPUs in early tests. The GPU farm processes only public computations (key recovery and hashing); private HORS preimages never leave the payer's secure device.
Practical Limitations and Community Response
QSB transactions are consensus-valid but non-standard, exceeding default relay policies. They require direct submission to a mining pool that accepts non-standard transactions (e.g., Marathon's Slipstream service). The scheme does not yet cover Lightning Network channels. Full off-chain compilation and broadcast remain to be completed in the open-source implementation. Levy describes the scheme as a 'last-resort measure,' not a general replacement for standard Bitcoin usage. Starkware co-founder Eli Ben-Sasson publicly endorsed the work, stating, 'THIS IS HUGE. Bitcoin is quantum-safe TODAY. Even if a quantum computer were to emerge that cracks conventional Bitcoin signatures, this shows a practical way to create secure Bitcoin transactions. WITHOUT CHANGING THE BITCOIN PROTOCOL!' Taproot expert Eric Wall commented, 'Starkware has some of the best hackers in the world. It's beautiful to see hackers using their skills for good.'
What It Means for Ordinary Bitcoin Holders
No quantum computer currently exists that can break Bitcoin's cryptography; most researchers estimate that threat is at least 3 to 10 years away. However, the clock starts ticking once a public key appears on the blockchain — which happens every time a user spends from an address. Bitcoin in a wallet that has never made an outgoing transaction is less at risk; Bitcoin parked on a reused or already-used address is another story. Moving funds before that window closes is more important than moving them after. QSB is not yet integrated into any consumer wallet. Users cannot open a standard wallet and activate a quantum-safe setting today. What Levy has delivered is the cryptographic proof that the path exists — built on rules already in Bitcoin, with computational cost roughly equal to the price of a plane ticket. What remains is technical implementation, adoption, and time. For anyone holding BTC, the takeaway is straightforward: watch for post-quantum support from your wallet provider, avoid address reuse, and move funds to a quantum-safe address once that option becomes available in mainstream software. The tools to protect those bitcoins are being built right now.