The estimated cost of preparing a quantum-resistant Bitcoin transaction has fallen from about $320 to $66 after a weeklong optimization challenge run by StarkWare, a 79 percent reduction that makes the experimental emergency fallback meaningfully more practical for large holders. The result, published on September 23, came out of the Quantum-Safe Bitcoin Optimization Challenge, in which participants used AI-assisted coding to cut the GPU computation needed to build the transaction by roughly a factor of five.
The design behind the number is the Quantum-Safe Bitcoin construction, or QSB, published in April by StarkWare researcher Avihu Levy. It adds hash-based protection against quantum attacks to Bitcoin without changing the protocol’s consensus rules. Levy described it at the time as a last resort measure, given its costs, its complexity and its limited applicability. The first such transaction on mainnet, prepared in August, required roughly 3,100 GPU-hours across about 100 GPUs and cost about $320 in compute, excluding Bitcoin network fees.
What QSB actually does
Bitcoin signatures rely on elliptic curve cryptography, which a sufficiently powerful quantum computer running Shor’s algorithm could break. That matters most for coins whose public keys are already visible on the blockchain, because a quantum attacker could in principle derive the private key and spend the coins. An estimated several million BTC sit in such outputs, including early Satoshi-era coins.
QSB works around the problem for one specific case: coins whose public key has not yet been exposed. It lets a holder prove ownership through a hash preimage rather than a signature, so the quantum-vulnerable key never appears on chain. The construction uses hash-based proofs that are believed to resist quantum attack, and it does all of this without a fork. No miner, node or wallet has to agree to anything for an individual holder to use it.
The tradeoff is that the proof generation is expensive. The preimage work involves brute-force computation that scales with the security target, which is where the GPU bill comes from. At $320 per transaction, the construction was a curiosity. StarkWare’s own framing was blunt: a few hundred dollars per transaction is a demo, not a tool.
The numbers, before and after
| Metric | August mainnet demo | After challenge |
|---|---|---|
| Estimated compute cost | About $320 | $66 |
| GPU time | About 3,100 GPU-hours | Roughly five times faster |
| Hardware used | About 100 GPUs | Optimized single-run code |
| Cost reduction | Baseline | 79 percent |
The drop did not come from new cryptography. It came from engineering. Challenge participants rewrote the proof generation code with AI assistance, cutting wasted computation and squeezing more out of the same hardware. StarkWare wrote in its September 23 update that contest participants using AI tools made the computation about five times faster, and the project’s public dashboard now shows the estimated cost at $66.
“A construction that costs a few hundred dollars per transaction is a demo. One that costs $67 is closer to something a holder with a large unexposed balance might reach for in an emergency.” – StarkWare blog, September 23, 2026
What the money buys, and what it does not
The cheaper figure changes the practical calculus for one narrow group: holders of large balances whose public keys have never been exposed. For them, QSB becomes a plausible insurance policy rather than a research artifact. A whale waking up to news of a quantum breakthrough could, in principle, spend through a QSB construction at a cost measured in tens of dollars rather than hundreds.
But two hard limits remain, and neither is touched by cheaper computation. First, QSB transactions are nonstandard, so they do not relay through the ordinary mempool. They have to go to a miner directly, which introduces its own operational and trust questions. Second, the construction only protects coins whose public key has not yet been exposed. For the long list of old, exposed outputs, including many of the oldest coins in existence, QSB offers nothing.
StarkWare acknowledged both points in its update, noting that neither is solved by making the search cheaper. Cost was simply the barrier an open competition could attack, and a week of it moved the number further than anything else had.
The soft fork question is still open
StarkWare continues to argue that a soft fork is the better long-term answer for broad quantum protection on Bitcoin. A consensus rule change could in theory add quantum-resistant signature verification for everyone, rather than leaving each holder to build an expensive workaround. The trouble is that Bitcoin’s governance makes any consensus change slow and contentious, and there is no agreement on which post-quantum scheme to adopt, or on what to do about already-exposed coins that cannot be saved by any new rule.
That debate has picked up during 2026 as quantum computing milestones accumulated. Proposals under discussion in the developer community include phasing out vulnerable output types and burn addresses for stranded coins, but none has come close to activation. In the meantime, constructions like QSB sit in the gap: not a protocol solution, but available today to whoever needs it.
Why the AI angle matters beyond Bitcoin
The other thing the week demonstrated is the speed AI-assisted optimization can deliver on narrow, well-defined engineering problems. A 79 percent cost reduction in seven days is not the result of a theory breakthrough. It is the result of many contributors, armed with code-generating tools, attacking a single measurable target. StarkWare ran the challenge as an open competition, and the collective output beat anything its own team had achieved previously.
That pattern, open problems plus AI coding plus a leaderboard, is becoming a repeatable research method. It does not replace the need for someone to define the problem correctly, and cryptographic engineering carries risks that ordinary performance tuning does not, since a subtle bug in a proof system can be catastrophic. But as a demonstration of how quickly fixed-target optimization now moves, the QSB result stands out.
CoinDesk, which reported the result, noted that the $66 figure has not yet been demonstrated in another transaction actually mined on Bitcoin. The next test is whether independent implementations reproduce the number, and whether anyone is willing to pay even $66 for protection they may never need. For now, the honest summary is that quantum-safe Bitcoin moved from theoretical to merely impractical, which is more progress than the field had managed in the preceding months.
How the challenge worked
The optimization challenge was open to outside contributors, who attacked the problem from different angles over a single week. Some focused on the hash computation itself, finding faster ways to run the preimage search on GPU hardware. Others looked at memory access patterns, parallelization strategy and code-level bottlenecks that had gone unexamined in the original implementation. The contributions were measured against a shared dashboard, so progress was visible in near real time and participants could build on each other’s gains rather than duplicating work.
StarkWare framed the exercise as a test of whether an open competition could move a number that its own team had treated as roughly fixed. The answer was yes, and by a wide margin. The company said the search for further reductions continues, and the dashboard remains live, meaning the $66 figure may not be the floor.
How real is the quantum threat to Bitcoin
Estimates for when a quantum computer could actually break Bitcoin’s signatures vary widely, and credible researchers put practical cryptographically-relevant quantum machines years or decades away. But the Bitcoin ecosystem has a specific structural problem: it cannot patch quickly. Old address formats expose public keys on chain the moment coins are spent from them, and a large stock of coins from the network’s earliest years have exposed keys permanently. Any migration to quantum-resistant signatures would require a consensus change across a notoriously conservative developer and miner community.
That asymmetry, slow threat clock but even slower defense clock, is why emergency constructions attract research money and attention despite the distant timeline. A holder with millions of dollars in an old output does not need the threat to arrive tomorrow to want a plan. They need the plan to exist before the threat does, and constructions like QSB are the closest thing to one that works without changing the protocol.
The counterargument, voiced by several cryptographers during the year, is that tools like this can create false confidence. A holder who spends through QSB once still has to manage keys, verify the construction is implemented correctly and get the nonstandard transaction to a miner willing to include it. Any mistake along that chain can be as costly as the original quantum risk. StarkWare’s own blog post leans toward the protocol-level fix for exactly this reason, calling QSB a last resort rather than a recommendation.