StarkWare researcher Avihu Levy has published a paper introducing Quantum Safe Bitcoin, or QSB, a design meant to protect Bitcoin against future quantum attacks without changing network consensus or requiring a soft fork. The tradeoff is steep: based on the paper’s estimate, a QSB transaction processed with current cloud GPU resources would cost roughly $75 to $150 per transaction, far above Bitcoin’s current average fee of about $0.3.
Replacing elliptic-curve reliance with a hash-based puzzle
The paper argues that standard Bitcoin transactions rely heavily on the elliptic curve digital signature algorithm, ECDSA. If quantum computers become powerful enough to run Shor’s algorithm at scale, that security model could break down. Levy’s proposal tries to avoid that path entirely. QSB uses a Binohash-based construction that embeds a one-time signature mechanism into Bitcoin Script, creating what the paper describes as a hash-to-signature puzzle.
Under that model, a spender solves the puzzle through pure hash computation rather than elliptic-curve operations. Levy wrote that the design depends on the pre-image resistance of RIPEMD-160, not on elliptic-curve assumptions, which is why it is presented as resistant to attacks using Shor’s algorithm.
Runs under existing script constraints
The main reason QSB has drawn attention is its ability to work within Bitcoin’s current script limitations. The paper contrasts this with proposals such as BIP-360, which would require broad agreement for a protocol-level upgrade and introduce a new output type. QSB, by comparison, is designed to fit within existing legacy script constraints and does not depend on a new consensus change before it can be used.
That makes it unusual among quantum-defense ideas for Bitcoin. It lowers the coordination burden, but it does not remove the practical costs. Those costs are substantial, and the usability tradeoffs are hard to ignore.
Experimental status and major practical limits
Levy also makes clear that QSB is still experimental. Beyond the high transaction cost, the proposal is constrained by existing opcodes and script size limits. It also cannot support major scaling systems such as the Lightning Network in its current form.
For that reason, Levy described QSB as a “last-resort measure”. He added that the computation can be parallelized and scaled across multiple GPUs, so the expense may still be considered practical in an extreme-threat scenario. The paper closes by arguing that if the quantum threat is taken seriously, continued work on Bitcoin defenses remains necessary, while a more efficient and user-friendly protocol-level solution is still the long-term target.