Almost every form of digital money leans on the same trick: a math problem that is easy to run forward and painfully hard to run backward. Multiplying two large primes takes a fraction of a second, while pulling those primes back out of the answer would occupy an ordinary computer for longer than the universe has existed. That gap between forward and backward is the reason a bank transfer, a password login, and a signed blockchain transaction can all be trusted at once.
Quantum computers attack that gap directly. A machine built on qubits can run algorithms that classical hardware cannot, and one of them, published by Peter Shor in 1994, collapses exactly the one-way problems that public-key cryptography depends on. For thirty years this stayed comfortably theoretical, because the machines were far too small. The estimates have been moving toward us since, and each new paper tends to lower the bar.
The answer the security world settled on is post-quantum cryptography: swap the vulnerable math for math a quantum computer gains no useful advantage against. The United States National Institute of Standards and Technology finalized its first three post-quantum standards on August 13, 2024, telling administrators to "start integrating them into their systems immediately, because full integration will take time" (source: NIST). For Bitcoin, though, adopting new cryptography has always meant changing the protocol itself, and Bitcoin changes slowly on purpose.
Which is what made August 26, 2026 unusual. A transaction was mined into a Bitcoin block that carried hash-based, quantum-resistant protection, and it did so under the consensus rules that already exist. No soft fork, no hard fork, nothing upgraded.
How quantum computers threaten Bitcoin
Bitcoin signs transactions with ECDSA on the secp256k1 elliptic curve, which binds your keys together: the public one is derived from the private one, and going backward is meant to be impossible. Shor's algorithm reverses that derivation. A large enough quantum computer could read a public key and compute the private key that controls it.
That is the whole threat, and it is worth being precise about what it touches. Shor's result gives efficient quantum algorithms for both prime factorization and discrete logarithms, and it is the discrete-logarithm half that undoes an elliptic-curve key pair (source: Peter Shor). Your public key and private key are the pair that proves ownership, so recovering the private half means recovering the ability to spend. Modern Bitcoin addresses help here, because they publish a hash of the public key rather than the key itself, and the key only becomes visible at the moment you spend. Understanding how a Bitcoin transaction works makes the exposure obvious: the signature and the public key both travel with the spend, in public, for anyone to read.
The second quantum algorithm people cite, Grover's, is a much softer problem. Grover gives a square-root speedup on brute-force search, which halves the effective strength of a hash function rather than breaking it. A 256-bit hash retains roughly 128 bits of security against it, and 128 bits remains far out of reach.
Algorithm | What it targets in Bitcoin | Practical effect |
|---|---|---|
Shor | ECDSA and Schnorr signatures over secp256k1 | Recovers a private key from an exposed public key. This is the real risk. |
Grover | SHA-256, used in mining and in address hashes | Square-root speedup, so 256-bit security becomes roughly 128-bit. Survivable. |
What this means for mining
Bitcoin mining sits on the Grover side of that table, which is why researchers treat it as the calmer half of the question. Mining is a hashing race, and a square-root speedup against SHA-256 would be a meaningful advantage, well short of catastrophic. Difficulty adjustment also absorbs it: if quantum hardware started finding blocks faster, the network would simply raise the target, exactly as it has for every generation of faster mining chips. The signature side has no such shock absorber, which is why it gets all the attention.
Which bitcoin is actually exposed
Exposure depends on whether a public key has ever been published. Coins sitting in an address that has never been spent from are protected by a hash, so Shor's algorithm has nothing to work on yet. Coins in the oldest address format, or in any address spent from before, have already revealed their public keys and are exposed today.
Deloitte's analysis puts the total at "over 4 million BTC (about 25% of all Bitcoins) which are potentially vulnerable to a quantum attack" (source: Deloitte), split between roughly 2 million in the original pay-to-public-key format and around 2.5 million in reused pay-to-public-key-hash addresses. River's breakdown runs higher, at 1.72 million BTC in P2PK addresses plus 4.9 million in reused addresses, for 6.8 million in total (source: River). The two estimates use different cutoffs for what counts as reuse, which is why the numbers differ, and both point at the same two culprits.
Situation | Is the public key visible? | Exposure |
|---|---|---|
P2PK, the 2009-era format | Yes, published in the output itself | Exposed today, permanently |
An address you have spent from before | Yes, revealed by the earlier spend | Exposed today |
A modern address, never spent from | Hidden behind a hash | Protected until you spend |
Any address, during the spend itself | Yes, for as long as the transaction is unconfirmed | Briefly exposed |
That last row is the one people underrate. Deloitte cites calculations under which a quantum computer capable of breaking RSA keys in about eight hours could hack a Bitcoin signature "within 30 minutes", against a block interval of roughly ten minutes (source: Deloitte). Thirty minutes against ten leaves the attacker behind the race, though the margin is uncomfortable, and it narrows every time the hardware improves. This is also the cleanest argument against reusing the same address, a habit that already costs you privacy and quietly adds a quantum exposure on top.
Two practical follow-ons sit behind that table. To see which format you are holding, Legacy, SegWit and Taproot addresses covers how to tell them apart. For the window in the final row, how many confirmations to wait for explains how long a spend stays unconfirmed.
How close is Q-Day?
Nobody can date it, and the range keeps compressing. In 2019 the leading estimate for factoring a 2048-bit RSA key was 20 million noisy qubits running for eight hours. Six years later the same researcher cut that by a factor of twenty, and even that reduced figure is far beyond anything built so far.
The paper that reset expectations is Craig Gidney's, submitted in May 2025, which concluded that "a 2048 bit RSA integer could be factored in less than a week by a quantum computer with less than a million noisy qubits" (source: Craig Gidney). The reduction came from better arithmetic and better error correction rather than from any hardware breakthrough, which is the part worth absorbing: the target moved because the software got smarter, and software tends to keep getting smarter.
Two caveats keep this from being a countdown. RSA-2048 and Bitcoin's secp256k1 are different problems, and an estimate for one translates only roughly to the other; a 2022 University of Sussex study put ECDSA at somewhere between 13 and 300 million qubits for a 1-to-8-hour break (source: River). Every estimate in this field is also counted in millions of qubits, a scale no working machine has come close to. What the trend does establish is a direction, and a direction is enough to plan against. NIST has already told everyone to migrate now, years ahead of any working attack.
What happened on August 26, 2026
At 20:48 UTC on August 26, 2026, a transaction was mined into Bitcoin block 964,199 whose spending conditions rested on hash-based cryptography rather than on elliptic-curve math. It was submitted through MARA's Slipstream service, confirmed by MARA Pool, and it paid an ordinary fee of 5,179 satoshis. The scheme is called Quantum Safe Bitcoin, or QSB.
The claim was put to a Bitcoin Asia audience hours after the block was mined, with a live block-explorer link on the screen behind the stage. "This is the first quantum resistant transaction on Bitcoin mainnet, ever," the slide read, followed by three words in orange: "No soft fork." The same clip carries the point spoken aloud: "It required no soft forks. It required no hard forks. It required no core protocol upgrades. And it's live today." (source: Bitcoin Magazine)
The transaction is public, so none of this has to be taken on trust. Anyone can open it in a block explorer and read the numbers directly:
Field | Value |
|---|---|
Transaction ID | 305a24ffea912b9cf428f29ebf952321c96dab5bab284fc0d0801562f5abab07 |
Block | 964,199, mined 2026-08-26 at 20:48:34 UTC |
Size and weight | 1,403 bytes, 5,282 weight units |
Fee | 5,179 satoshis, at 3.92 sat/vB |
Structure | Two inputs, one output of 44,000 satoshis |
Submission route | MARA Slipstream, mined by MARA Pool |
(source: mempool.space)
One of those two inputs is the interesting one. It spends a 10,000-satoshi output whose locking script an ordinary wallet cannot even classify, because the script is a bare, non-standard construction that matches no recognized address type. That single input is the quantum-safe part; the other input is a normal SegWit spend that paid the fee.
How a quantum-safe bitcoin transaction works without a fork
QSB was published on April 9, 2026 by Avihu Levy at StarkWare, with the claim that Bitcoin transactions "can be made quantum-resistant today, with no softfork or protocol change required" (source: StarkWare). It works by using Bitcoin's existing signature-checking opcodes as machinery while moving the actual security onto hashing, which Shor's algorithm gains nothing against.
The centerpiece is what the authors call a hash-to-signature puzzle, and the idea behind it is genuinely clever. A DER-encoded ECDSA signature has a rigid shape: specific tag bytes, internally consistent length fields, positive integer values. A random 20-byte string happens to satisfy every one of those structural rules roughly once in 70 trillion attempts (source: Quantum Safe Bitcoin). So the locking script takes a public key that the transaction itself determines, hashes it with RIPEMD-160, and then demands that the 20-byte output be a structurally valid signature. Because "this puzzle depends only on the pre-image resistance of RIPEMD-160 (not on any elliptic curve assumption), it is fully resistant to Shor's algorithm" (source: Quantum Safe Bitcoin).
Getting a spend past that puzzle takes three phases, all of them run off-chain on rented GPUs:
Pinning. Search across sequence and locktime values until the resulting public key hashes to something DER-shaped. This ties the spend to one exact set of transaction parameters, and it takes roughly 70 trillion attempts.
Two digest rounds. Search across subsets of dummy signatures, each subset producing a different signature hash and therefore a different derived key, until one of those keys clears the same puzzle. The indices of the chosen subset act as a compact hash-based signature over the transaction.
Assembly. Recover the keys, extract the hash preimages of the one-time signature scheme, and build the final spend.
Change so much as one byte of the transaction and the derived key changes, the hash changes, and the puzzle fails. That is what binds the signature to the specific spend, which is the job an ECDSA signature normally does. The whole construction has to fit inside Bitcoin's tightest legacy limits of 201 opcodes and 10,000 bytes (source: Quantum Safe Bitcoin), and the resulting script is too large for standard relay rules, which is why it reached a miner through Slipstream rather than through the mempool. MARA built Slipstream in early 2024 precisely because "Bitcoin nodes frequently exclude large and non-standard transactions from Bitcoin's mempool, even if these transactions adhere to the Bitcoin network's consensus rules" (source: MARA).
The scheme also has a lineage. It builds on Binohash, Robin Linus's construction that pairs "proof-of-work signature grinding" with a quirk in legacy Bitcoin Script to achieve limited transaction introspection without consensus changes (source: Binohash). Further back sits Ethan Heilman's 2024 proposal for expressing Lamport signatures in Bitcoin Script with no changes at all (source: Bitcoin Development Mailing List). QSB's contribution was replacing the parts of those earlier designs that still rested, quietly, on elliptic-curve assumptions.
What the transaction cost to produce
Producing one QSB spend costs between $75 and $150 in rented cloud GPU time (source: Quantum Safe Bitcoin), with the research paper itself allowing a wider range reaching $200 to cover implementation uncertainty (source: crypto.news). The on-chain fee is almost an afterthought: this transaction paid 5,179 satoshis, a normal fee for its size.
Setting the two side by side shows where the expense actually sits:
Off-chain GPU search $75 to $150 (three searches of ~70 trillion candidates)
On-chain miner fee 5,179 satoshis (1,403 bytes at 3.92 sat/vB)
Ordinary BTC transfer a few hundred satoshis at the same fee rate
So the compute is the cost, and it is several hundred times the cost of an ordinary spend. The searches are also embarrassingly parallel, meaning wall-clock time falls in direct proportion to how many GPUs you rent, so the price is fairly fixed while the waiting is a matter of budget. That economic shape tells you what QSB is for. It prices out everyday payments while staying sensible as a one-time rescue for a large holding, which is exactly how its author describes the intended use.
How much of the quantum problem this solves
QSB gives Bitcoin an escape route that works today, under today's rules, for coins deliberately placed behind it. Against an attacker running Shor's algorithm it holds roughly 118-bit security, falling to roughly 59-bit against one running Grover's (source: Quantum Safe Bitcoin). Those are measured numbers, not hopeful ones. What it leaves in place is most of the problem.
"QSB is not a cure for Bitcoin's quantum problem," read one of the closing slides, before laying out four constraints. It is opt-in, so only coins moved into a deliberately prepared QSB output gain anything. It is non-standard and costly today, needing off-chain computation and a miner-direct submission route. It is an emergency spending path rather than a network-wide migration. And it is still maturing, with testing, review and operational hardening ahead of it. An earlier slide in the same talk reached for a blunter image: "It means we've built a parachute. A doomsday bunker." (source: Bitcoin Magazine)
The exclusions matter as much as the constraints. QSB protects coins you move into it and does nothing for Taproot outputs, Lightning channels, or any public key that has already been exposed (source: crypto.news). Coins also have to enter a QSB output through an ordinary transaction first, which means passing through the vulnerable format on the way in. Bitcoin analyst Daniel Batten called the broader framing that QSB "makes Bitcoin quantum-safe" an overstatement (source: crypto.news), and the people who built it agree. StarkWare's chief executive Eli Ben-Sasson framed the result as reassurance rather than resolution: "What today's successful transaction offers Bitcoin is a reassurance that holdings can be protected before that happens" (source: crypto.news).
The protocol-level fix Bitcoin is still building
The durable answer is a consensus change that gives Bitcoin native quantum-resistant addresses, and that work is already underway as BIP-360. Authored by Hunter Beast, Ethan Heilman and Isabel Foxen Duke, it defines a Pay-to-Merkle-Root output that behaves almost identically to Taproot while removing the part Shor's algorithm could attack.
P2MR outputs "operate with nearly the same functionality as P2TR (Pay-to-Taproot) outputs, but with the key path spend removed" (source: BIP 360), which closes the door Shor's algorithm would walk through. The proposal carries Draft status as a consensus soft fork, so activation is still some way off. It is also deliberately partial, and the authors say so plainly: P2MR defends against long exposure attacks, meaning keys left visible for longer than a spend requires, while defending keys sitting in the mempool "may require the introduction of post-quantum signatures in Bitcoin" (source: BIP 360), which they intend to propose separately. Anyone unfamiliar with how a consensus change reaches activation will find soft forks and hard forks useful background on why it takes years.
QSB, available now | BIP-360, in draft | |
|---|---|---|
Requires consensus change | No | Yes, a soft fork |
Who it protects | Only coins deliberately moved into a QSB output | Anyone using the new address type |
Cost per use | $75 to $150 in GPU compute, plus the miner fee | An ordinary transaction fee |
How a transaction reaches a miner | Direct submission, since the script is non-standard | Normal relay |
Best described as | An emergency exit | The migration |
Even once a soft fork activates, moving the network takes time. River cites a University of Kent estimate that migrating vulnerable coins would take 76 days if every byte of blockspace went to it, or roughly two years at a quarter of blockspace (source: River). That gap between activation and completion is exactly the window an emergency tool like QSB is built for.
What this means for the bitcoin you hold
For almost every reader, the correct response to this news is interest rather than action. QSB is a specialist instrument priced for large, exposed holdings, and paying $150 in compute to protect a wallet worth less than that would be a poor trade (source: Quantum Safe Bitcoin). What the announcement should change is your address hygiene, which costs nothing and helps immediately.
Four things are worth doing, none of them urgent:
Stop reusing addresses. Generate a fresh receiving address for every payment. Modern wallets do this by default, and it keeps your public keys hidden until the moment you spend.
Move off legacy formats. If you hold coins in a very old P2PK output or an address you have spent from repeatedly, consolidating into a fresh modern address puts a hash back in front of your public key.
Watch BIP-360, not the headlines. Activation of a quantum-resistant address type is the event that actually matters for ordinary holders.
Keep the basics tight. Quantum computing is a distant risk, while phishing and lost seed phrases take coins every week. The Bitcoin security checklist covers the threats that are live today.
There is also a reasonable case for doing nothing at all. The timeline is genuinely uncertain, the tooling is young, the protocol fix is being built by people who have been thinking about it for years, and address hygiene alone removes most individual exposure. A holder who changes only their receiving-address habit and then waits has made a defensible choice.
Where your coins live changes who handles this. On BloFin, bitcoin sits in exchange-controlled wallets, and BloFin lists BTC/USDT and BTC/USDC on spot, with BTC perpetuals quoted against both USDT and USDC, so the address formats and key handling behind those balances are BloFin's responsibility. The steps above apply to the coins you keep in your own wallet, where holding it yourself means holding the key-management job too. Splitting a holding across both is how a lot of people end up managing the tradeoff between control and convenience.
Frequently asked questions
Was this really the first quantum-resistant Bitcoin transaction?
It is the first one known to have been mined on Bitcoin mainnet, and StarkWare makes that claim directly. The underlying idea has history: Ethan Heilman proposed a way in 2024 to write Lamport signatures in Bitcoin Script without protocol changes, and Robin Linus published the Binohash construction that QSB builds on. Those were designs on paper. August 26, 2026 is the date one of them cleared a real block.
Do I need to move my bitcoin into a QSB output?
For most holders, no. Each QSB spend costs $75 to $150 in GPU compute plus a miner fee, and requires submitting a non-standard transaction directly to a mining pool. That math favors very large, already-exposed holdings and works against everyone else. Generating a fresh receiving address for every payment gives ordinary holders most of the available protection at zero cost.
Is bitcoin held on an exchange affected?
Exchange-held bitcoin sits in wallets the exchange controls, so decisions about address formats, key rotation and eventual migration to quantum-resistant outputs belong to the venue rather than to you. That removes a job from your plate and adds a counterparty. The exposure question for those coins becomes a question about the exchange's engineering, and the exposure question for coins in your own wallet stays yours.
Could a quantum computer mine bitcoin faster?
Only modestly. Mining is a hashing contest, and the relevant quantum algorithm is Grover's, which offers a square-root speedup, well short of the wholesale break Shor's algorithm delivers against signatures. Against SHA-256 that leaves roughly 128 bits of effective security, which remains impractical. Difficulty adjustment would also absorb any real gain by raising the target for everyone.
Which cryptocurrencies are quantum-proof today?
Several projects market themselves on post-quantum signature schemes, and a handful genuinely implement them. Treat the label carefully, because a quantum-resistant signature scheme protects new transactions while doing nothing for coins already sitting behind exposed keys, and the migration problem applies to every chain. NIST's standardized algorithms, published in August 2024, are the reference point worth checking any such claim against.
What happens to lost coins and Satoshi's coins?
They are among the most exposed. River estimates roughly 1.6 million BTC are lost, alongside Satoshi's estimated holdings of 968,000 BTC (source: River), much of it in the original P2PK format with public keys published in the open. Nobody can move those coins to safety, because moving them requires the keys. Whether the network should freeze them before an attacker reaches them is an open and genuinely contentious debate.
Does a soft fork mean my coins move automatically?
No. A soft fork adds a new address type; it never relocates existing coins. Migration happens one transaction at a time, wallet by wallet, as holders choose to spend into the new format. That is why estimates of a full migration run to months or years even after activation, and why the gap between a fix existing and a fix being adopted is the part worth watching.
Researched and written by the BloFin Academy editorial team with AI-assisted drafting. Primary sources include the Quantum Safe Bitcoin repository and paper by Avihu Levy at StarkWare, mempool.space, NIST, and Craig Gidney's 2025 arXiv paper on quantum factoring. All facts independently verified against cited documentation current as of August 2026.
This article is for educational purposes and is not financial advice. Cryptocurrency prices are volatile and you can lose money trading digital assets. Nothing here is a recommendation to buy, sell, or hold any asset, and the security practices described are general education rather than a guarantee of safety. Do your own research and consider your own circumstances before acting.