TheBlockRadar
Explainer· Independently researched

Quantum-Resistant Bitcoin Upgrades: Costs and Challenges

Explore quantum-resistant Bitcoin upgrades, their costs, challenges, and how they protect Bitcoin transactions from future quantum threats.

Quantum-Resistant Bitcoin Upgrades: Costs and Challenges

Quantum-resistant Bitcoin upgrades are becoming a transaction-cost problem

Key takeaways

  • StarkWare’s August 2026 quantum-resistant Bitcoin transaction proved a workaround can be mined today, but it took hours, cost roughly $75 to $200 and required direct submission to MARA Pool rather than normal network relay. [2][3]
  • The immediate risk is concentrated in bitcoin whose public keys are already exposed, estimated at about 34% of supply, but no quantum computer has publicly demonstrated the capability to steal those coins. [9]
  • Blockstream’s proposed SHRINCS signatures could preserve roughly three Bitcoin transactions per second, versus an estimated 6.5 under universal Schnorr use, but the design remains unaudited and lacks a completed security proof. [6][7]
  • No quantum-resistant signature upgrade or user migration process is active on Bitcoin mainnet, so the central unresolved issue is not merely cryptography, but moving existing holders without creating a new operational failure point. [6][10]

The cost of keeping a Bitcoin public key hidden

StarkWare, the zero-knowledge technology company, announced in August that it had completed what it called the first quantum-resistant Bitcoin transaction on mainnet. MARA Pool mined the 10,000-satoshi test transaction through its Slipstream direct-submission service. [2][3]

The risk the experiment addresses is real in theory but unpriced in any precise way. If a sufficiently capable quantum computer can derive a private key from an exposed public key, it could forge a valid Bitcoin signature and redirect funds before a legitimate spend confirms.

Bitcoin does not normally reveal the private key controlling coins. Instead, a wallet creates a digital signature that proves it has the key, while publishing enough mathematical material for nodes to check that proof without learning the secret itself.

That system relies principally on elliptic-curve cryptography. Conventional computers cannot feasibly run the mathematics backwards from a public key to its corresponding private key, but Shor’s algorithm is expected to change that assumption on a sufficiently advanced quantum machine. [6]

The relevant window is not necessarily the full lifetime of a coin. For a standard spend, the transaction enters Bitcoin’s public mempool, where it waits to be included in a block, and the signature data becomes visible to anyone monitoring the network.

A hypothetical quantum attacker could then attempt to recover the signing key, create a replacement transaction and offer a miner a higher fee. Google researchers cited by Cointelegraph estimated that, under assumed future hardware conditions, key recovery could theoretically take nine to 12 minutes after exposure. [3]

That is a conditional model, not evidence that such an attacker exists. The hardware required has not been publicly shown, and forecasts of when it might exist range widely. Claims that Bitcoin faces an imminent quantum theft event remain speculation.

Still, the exposure problem is broader than a single ten-minute confirmation window. The Quantum Resistance Index estimates that about 34% of Bitcoin supply sits in outputs with exposed public keys, including coins spent from previously and coins held in older address forms. [9]

For holders and the network, that creates two different problems. A future attacker could target already-exposed keys without waiting for a new transaction, while any holder moving funds under the existing signature system may expose cryptographic material during the move.

What signature grinding changes

StarkWare researcher Avihu Levy’s Quantum Safe Bitcoin, or QSB, scheme tries to narrow the mempool risk without changing Bitcoin’s consensus rules. It does so through a process called signature grinding, which is better understood as an expensive search for an unusually shaped signature.

A conventional Bitcoin wallet signs a transaction, verifies that the signature is valid and broadcasts it. QSB does not accept the first valid result. It generates and tests a very large number of candidate signatures until it finds one meeting an additional condition. [3]

The extra condition is designed so the transaction can be authorized without giving a quantum attacker the usable public-key information that the standard signature path would disclose. QSB combines hash-based one-time signatures with a computational search that binds authorization to a specific transaction. [3]

The important point is that the scheme does not make a quantum computer weaker. It changes the format and timing of what an attacker can see. The defensive asset is reduced exposure, purchased with computation and a nonstandard transaction construction.

That purchase is expensive. Levy initially estimated that generating a QSB transaction would require about $75 to $150 of GPU computation. After the mainnet test, StarkWare put the actual cost in the low hundreds of dollars, roughly $150 to $200. [2][3]

It is also slow. StarkWare said producing the transaction took hours of computing. That makes QSB ill-suited to ordinary payments, exchange withdrawals, automated treasury operations or any setting where transaction construction must be predictable and inexpensive. [2][3]

The scheme’s second cost is distribution. Bitcoin nodes generally relay only transactions that meet standard policy rules. QSB transactions are nonstandard under Bitcoin Core’s default relay policy, meaning they do not travel through the ordinary public mempool. [3]

Instead, the sender must arrange private delivery to a miner or mining pool willing to accept the transaction. MARA Pool’s Slipstream service processed the demonstrated transaction, but there is no reliable data showing what share of Bitcoin hash rate accepts QSB transactions. [3][4]

That distinction matters financially. A normal Bitcoin sender pays a network fee into a competitive fee market and can expect broad propagation. A QSB sender must also obtain specialized transaction construction and access to a cooperative mining route.

For that reason, the demonstrated transaction is best described as an emergency mechanism, not a deployed payment rail. It may be relevant to a holder facing a credible near-term threat, but it does not establish routine quantum-safe spending for the market as a whole.

StarkWare itself has not presented it as a substitute for a protocol upgrade. The company’s position is that QSB can provide an interim safety net, while Bitcoin adopts new signature rules through a network-wide change. [2][3]

Why signature size becomes a throughput bill

The more durable proposal under discussion is SHRINCS, a hash-based post-quantum signature scheme developed by Blockstream researchers Jonas Nick and Mikhail Kudinov. Its purpose is different from QSB’s: it would add a quantum-resistant signing option to Bitcoin’s protocol. [6]

The number to understand is 548 bytes. A SHRINCS signature begins at about that size, plus a 48-byte public key, while a current Schnorr signature is 64 bytes. The higher byte count consumes scarce block capacity. [5][7]

Bitcoin throughput is constrained partly by how much transaction data can fit into each block. When signatures expand, fewer transactions fit, all else equal. That is why replacing existing signatures with generic post-quantum standards could sharply reduce transaction capacity.

CoinDesk reported Blockstream’s estimate that universal use of compact Schnorr signatures would support about 6.5 transactions per second. Using NIST-standardized SLH-DSA could reduce that to roughly 0.36 transactions per second. [6]

SHRINCS is designed to land between those outcomes. Blockstream estimates a configuration using roughly 580-byte signatures could support about three transactions per second, a material reduction from Schnorr but far above the cited hash-based standard alternative. [6]

The maths is not as simple as saying a signature nine times larger causes a ninefold throughput decline. Segregated Witness, Bitcoin’s 2017 upgrade, gives signature data a weight discount, so witness bytes consume less block weight than ordinary transaction data. [6][7]

That discount limits the throughput damage but does not eliminate it. If a large share of users eventually adopted post-quantum signatures, blockspace competition could become more acute, affecting transaction fees and the economics of smaller on-chain payments.

SHRINCS saves space by making a trade. Each spend uses a fresh one-time key, and the wallet must reliably remember which keys it has used. Reusing a one-time key could undermine the intended security properties of the system. [6][7]

This is called stateful key management. A wallet operating across a phone, hardware device and backup must keep its record synchronized. Restoring an outdated backup could leave the wallet unable to safely determine which signing paths remain available.

The recovery fallback is also large. Reporting on the proposed Bitcoin Improvement Proposal puts a stateless recovery transaction at about 5,777 bytes, far larger than the normal signature path. That is an operational cost, not merely a cryptographic footnote. [5][7]

SHRINCS therefore shifts part of the security burden to wallet engineering and user backup practices. It may reduce exposure to a future quantum attack while adding a present-day risk of lost state, difficult recovery and larger exceptional transactions.

The upgrade is not ready to price as certainty

Blockstream tested SHRINCS transactions on Liquid, its separate sidechain, in March. That is useful implementation evidence, but Liquid is not Bitcoin mainnet and does not answer whether Bitcoin’s users, businesses, miners and node operators will activate the proposal. [6][7]

The proposal would require a soft fork, meaning a rule change that old nodes can generally tolerate while upgraded nodes enforce new conditions. In Bitcoin, technical feasibility does not automatically produce activation, and consensus processes can take years. [6]

The proposal also explicitly remains unfinished. Its formal security proof is pending, the reference implementation has not received a formal audit and it is not intended for production use. Those limits make near-term deployment forecasts speculative. [6][7]

BIP-360, a separate Pay-to-Merkle-Root proposal, has been merged into Bitcoin’s repository and tested on testnet, according to QubitChain and CryptoTimes reporting. It has not been activated on mainnet and is not itself a complete quantum-resistant migration. [12][13]

The missing migration path is the harder commercial issue. Bitcoin needs a way for owners of existing outputs, including vulnerable exposed-key outputs, to move into quantum-resistant conditions before an attacker can exploit the old cryptography.

There is no established user toolset or agreed protocol for that transition. Any forced deadline, coin-freezing proposal or migration incentive would create difficult questions about dormant coins, lost keys, exchange operations and the legitimacy of changing spendability rules. [10]

Hash-based schemes such as SHRINCS may ultimately function as a bridge rather than a permanent answer. Their appeal is reliance on SHA-256, a hash function Bitcoin already uses, but their size and statefulness remain meaningful constraints. [6][11]

For now, Bitcoin has a demonstrated high-cost workaround and an early protocol candidate with measurable throughput and wallet-management trade-offs. Neither is a mainnet quantum upgrade, and neither establishes when a quantum threat will become economically actionable.

Frequently Asked Questions

What are quantum-resistant Bitcoin upgrades?

Quantum-resistant Bitcoin upgrades are proposed changes to Bitcoin’s cryptographic signatures aimed at protecting coins from future quantum computers that could derive private keys from exposed public keys. These upgrades often involve new signature schemes, such as hash-based signatures, designed to withstand quantum attacks but have not yet been activated on the mainnet.

How do quantum-resistant Bitcoin transactions work?

One approach, demonstrated by StarkWare in August 2026, uses a method called signature grinding to generate special signatures that do not expose usable public-key information to quantum attackers. These transactions combine hash-based one-time signatures with computationally intensive searches for signatures meeting specific criteria, and must be submitted directly to miners rather than broadcast through the normal mempool.

What are the costs of quantum-safe Bitcoin transactions?

StarkWare’s quantum-safe transactions currently require several hours to generate and cost roughly $75 to $200 in transaction fees. They are resource-intensive and not practical for everyday use, limiting their current feasibility to high-net-worth holders and requiring direct submission to specialized mining pools.

What challenges exist for upgrading Bitcoin to be quantum-resistant?

The main challenges include the lack of an active upgrade or user migration process on Bitcoin mainnet, the complexity of moving existing holders without creating new operational risks, and the significant increase in signature sizes and computational costs associated with quantum-resistant schemes. Additionally, no quantum-resistant signature method has completed security proofs or achieved widespread miner acceptance.

How does signature grinding improve Bitcoin's quantum resistance?

Signature grinding improves quantum resistance by generating many candidate signatures and selecting one that meets an extra condition designed to prevent quantum attackers from extracting usable public-key information. This process reduces the risk of key exposure during the transaction confirmation window but is computationally expensive and currently impractical for broad use.

How we researched this

This article was assembled from 5 published articles, 13 cited references.

Nothing here is based on hands-on testing. Where a figure or finding appears, it belongs to the source cited beside it, and the writing says so rather than implying otherwise. Every source is listed below so you can check it.

Sources

Ethereum Technical Developments and Price Outlook Explained

Ethereum Technical Developments and Price Outlook Explained

Explore Ethereum technical developments, staking upgrades, and the realistic price outlook for 2026 in this detailed analysis.

Bitcoin Bull Market Signals and Price Rally Analysis

Bitcoin Bull Market Signals and Price Rally Analysis

Explore Bitcoin bull market signals, ETF inflows, and price rally factors shaping the current market conditions and potential trends.

Bitcoin-Backed Mortgages and Crypto Credit Lines Explained

Bitcoin-Backed Mortgages and Crypto Credit Lines Explained

Learn how Bitcoin-backed mortgages and crypto credit lines work, their collateral needs, risks, and custody details for U.S. borrowers.

Bitcoin ETF Institutional Investment Trends and Market

Bitcoin ETF Institutional Investment Trends and Market

Explore Bitcoin ETF institutional investment trends, key products, and how institutions navigate crypto exposure and market risks.