A paper published in April 9 by StarkWare's Chief Product Officer outlines a method to make Bitcoin transactions quantum-safe using existing consensus rules. A single protective transaction costs roughly $200, and it is deployable right now.
Key Takeaways
QSB uses hash-based cryptography resistant to Shor’s algorithm – no soft fork needed.
Standard Bitcoin transactions have effectively zero security against a quantum computer.
Single protective transaction costs ~$200 due to larger signature data size.
Works within existing Bitcoin scripts – deployable today without network consensus.
BIP-360 offers a future efficient alternative but requires a soft fork.
The Problem QSB Is Solving
Standard Bitcoin transactions use ECDSA, a signature scheme whose security rests on the mathematical difficulty of solving elliptic curve problems. Classical computers cannot crack it in any practical timeframe. A quantum computer running Shor’s algorithm can. The algorithm reverses the signature process, deriving private keys from public keys and unlocking any wallet whose public key has been exposed on-chain.
Every Bitcoin transaction that has ever broadcast a public key is theoretically vulnerable to a sufficiently powerful quantum computer, for which even Grayscale said that blockchains must be ready. The paper puts the security gap in precise terms: roughly 118 bits of protection against Shor’s algorithm for QSB transactions, compared to effectively zero for standard ones. That is not a small difference. It is the entire difference between a protected wallet and an empty one.
The quantum threat to Bitcoin is not new. The inability to fix it through normal channels is the actual problem, and that is what QSB addresses.
Why “No Soft Fork” Is the Real Breakthrough
Bitcoin governance moves slowly by design. Any proposal requiring a network-wide upgrade must achieve broad consensus across developers, miners, and node operators, a process that takes years and frequently fails. BIP-360, the long-term quantum-resistant proposal that StarkWare co-authored and which was merged in February 2026, requires exactly that kind of soft fork, according to CoinDesk reprot. It will eventually offer a more data-efficient solution. It is not available today.
QSB bypasses that bottleneck entirely. The scheme uses hash-based cryptography, specifically Winternitz One-Time Signatures, which is natively resistant to Shor’s algorithm and compatible with existing Bitcoin script rules. No network upgrade. No consensus required. No waiting for governance to move.
A holder with significant Bitcoin exposure can execute a protective transaction today using the open-source QSB repository published alongside the paper. The protection is real, the code is available, and the Bitcoin network does not need to do anything to support it.
The Cost and What It Means
The tradeoff is size and price. Quantum-safe signatures are substantially larger in data than standard ECDSA signatures, enough to push the cost of a single protective transaction to approximately $200 at current fee conditions. That creates an immediate two-tier reality. For a holder with $10 million in Bitcoin, $200 is insurance priced at a rounding error. For a holder with $1,000, it is a 20% fee on the entire position.
QSB is not a retail solution. It is an emergency fallback for holders who cannot afford to wait for BIP-360 to move through Bitcoin’s governance process, and who have reason to believe the quantum timeline is shorter than the soft fork timeline. StarkWare is pursuing both tracks simultaneously: the deployable high-cost solution now, the efficient network-wide solution through BIP-360 later. The two are not in competition. They are covering different parts of the same risk window.
That window is open right now. BIP-360 has no confirmed activation date. QSB exists today. For any holder doing a quantum risk calculation, that gap between what is available now and what requires network consensus to become available is exactly the period QSB was designed for.
Where It Stands
The project is early stage and the paper is explicit about that. The open-source repository is published and the cryptographic framework is documented, but QSB has not been stress-tested at production scale. If the review process surfaces vulnerabilities in the WOTS implementation, the $200 cost figure becomes academic. Early stage in cryptographic research means the foundation is credible, not that the building is finished.
What exists today is a deployable proof of concept with a sound cryptographic basis, published by StarkWare’s Chief Product Officer, open-sourced for peer review, and compatible with the Bitcoin network as it currently operates. The significance is not that QSB solves Bitcoin’s quantum problem, it does not. It is that QSB proves the problem can be partially addressed without network consensus, which changes the risk calculation for any large holder who assumed they had no options until BIP-360 cleared governance.
The 118-bit security floor QSB provides is not perfect. It is 118 bits better than zero.
