Avihu Levy, chief product officer at Starkware and a co-author of BIP-360, has published a research paper and open-source implementation for a new scheme called Quantum Safe Bitcoin, or QSB, aiming to make Bitcoin transactions resistant to quantum attacks without changing Bitcoin’s consensus rules. The proposal is notable because it does not require a soft fork, new opcodes, or coordinated network-wide upgrades. Instead, it works within constraints that have existed in Bitcoin for years, using legacy Script rules already accepted by consensus.
A response to Bitcoin’s long-term quantum risk
The threat model addressed by QSB is straightforward but serious. Bitcoin’s dominant signature system, ECDSA over secp256k1, is theoretically vulnerable to Shor’s algorithm if sufficiently capable quantum computers ever become practical. In that scenario, exposed public keys could allow an attacker to derive private keys, forge signatures, and redirect coins. According to the report, this risk applies to outputs and spending paths where the public key becomes visible onchain, including older formats and Taproot keyspend paths.
Levy’s approach is to move the security foundation away from elliptic-curve hardness and toward the pre-image resistance of RIPEMD-160. Unlike elliptic-curve cryptography, which Shor’s algorithm can fundamentally undermine, hash functions are generally considered vulnerable only to the quadratic speedup of Grover’s algorithm. That does not make hashes invulnerable, but it changes the attack economics substantially.
How QSB works within Bitcoin’s existing rules
One of the strongest claims in the paper is that QSB operates entirely within Bitcoin’s existing legacy Script framework, including the traditional limits of 201 opcodes and 10,000 bytes. This is central to the proposal’s appeal: the system does not ask Bitcoin to become something new at the consensus level. Instead, it exploits already-valid script behavior to construct a new type of spend.
QSB builds on earlier work known as Binohash, developed by Robin Linus, but modifies it to address two weaknesses identified in the earlier design. The first issue was a proof-of-work style signature-size puzzle that depended on elliptic-curve properties, making it unsuitable against quantum-capable adversaries. The second was an unresolved sighash flag issue that could potentially let an attacker reuse a valid puzzle signature across different transactions.
To solve this, Levy replaces the older construction with what he calls a hash-to-sig puzzle. In this design, the spender iterates over transaction parameters until the RIPEMD-160 hash of a transaction-derived public key happens to form a valid DER-encoded ECDSA signature. The article puts the probability of that event at roughly 1 in 70 trillion. Because QSB hardcodes SIGHASH_ALL, the earlier sighash-related vulnerability is also removed as part of the redesign.
The scheme also uses two digest rounds and a HORS-style Lamport signature structure, relying on legacy Script behavior such as FindAndDelete to alter the sighash through selected subsets of dummy signatures. The subset that yields a valid DER-encoded signature becomes the digest for a given round, and revealing the associated pre-images completes the spend. In effect, QSB turns Bitcoin’s older script machinery into a way of authenticating spends without depending on elliptic-curve assumptions in the usual way.
Security and cost profile
Levy’s recommended setup, referred to as Config A, is reported to deliver around 118-bit pre-image resistance and 78-bit collision resistance. The article further states that a quantum attacker attempting a second pre-image attack against this configuration would face work on the order of 2^69. Crucially, Shor’s algorithm offers no direct advantage against the scheme because the relevant elliptic-curve assumptions have been removed from the security model of the spend itself.
That said, QSB is not cheap to use. The off-chain computational burden is estimated at approximately $75 to $150 per transaction in cloud GPU costs at current spot pricing. Early testing suggests the workload is highly parallelizable and can be completed in hours across multiple GPUs. According to the report, these GPU systems perform only public computations such as key recovery and hashing, while the spender’s private HORS pre-images remain on a secure device.
Why it is important, but not yet mainstream
The practical significance of QSB lies in its demonstration effect. It shows that Bitcoin may already possess enough scripting flexibility to support an emergency-style post-quantum spending path without waiting for consensus reform. That matters for a community that has long debated whether quantum defense must come from a protocol upgrade, a wallet-layer innovation, or a mixture of both.
Still, the proposal comes with major limitations. QSB transactions are described as consensus-valid but non-standard, meaning they exceed default relay policy and are unlikely to propagate through the network like ordinary payments. Instead, they would need direct submission to a mining pool willing to accept such transactions, with the article citing Marathon’s Slipstream service as one possible route. QSB also does not yet support Lightning Network channels, and the full onchain assembly and broadcast flow is still pending in the open-source implementation.
Levy himself does not present QSB as a universal replacement for normal Bitcoin usage. Rather, he frames it as a last-resort option—a fallback path for protecting funds if quantum risk becomes urgent before broader protocol-level post-quantum solutions are adopted.
Industry reaction and open-source release
The work was released publicly with a research paper, CUDA-accelerated GPU code, a Python pipeline, and complete Bitcoin Scripts in Levy’s GitHub repository. Starkware co-founder Eli Ben-Sasson publicly praised the result, arguing that Bitcoin can be made quantum-safe immediately in a practical sense, even without any protocol modification. Community responses highlighted the engineering creativity behind adapting old Bitcoin script rules to a modern cryptographic threat model.
The article also notes that Levy credited Robin Linus for the foundational Binohash concept and for a key correction that helped shape the eventual cost-security tradeoff. In that sense, QSB is not an isolated invention but part of a broader line of post-quantum experimentation now emerging around Bitcoin infrastructure.
What Bitcoin holders should take from this
For everyday BTC users, QSB should not be mistaken for a wallet feature that can be enabled right now. No mainstream consumer wallet currently offers a one-click “quantum-safe” Bitcoin spending mode based on this design. More importantly, the article emphasizes that there is no quantum computer today known to be capable of breaking Bitcoin’s cryptography at the required scale. Many researchers still place that threat three to ten years away, though opinions vary and forecasts remain uncertain.
Even so, the research reinforces a familiar lesson: the risk window begins when a public key becomes visible onchain. Coins sitting in wallets that have never made an outgoing transaction may have less immediate exposure than funds associated with reused or previously spent addresses. In a future where quantum capabilities cross the relevant threshold, those exposed public keys would become the most obvious targets.
For now, the practical guidance remains conservative. Users should avoid address reuse, watch for post-quantum support from wallet providers, and be prepared to move funds if robust consumer-grade tools become available. QSB does not solve Bitcoin’s post-quantum transition on its own, but it does establish something important: a technically credible path already exists inside Bitcoin’s current rule set, even if turning that path into a usable product will require more engineering, broader support, and time.