Why Bitcoin Just Mined Its First Quantum-Proof Transaction This Week

Bitcoin block 964,199 looked unremarkable on the surface: it confirmed standard fee transfers, routed SegWit witness data, and paid out the programmatic block subsidy alongside transaction fees. Tucked inside its payload, however, was a 10,000-satoshi spend that broke with seventeen years of cryptographic convention. Confirmed on August 26, 2026, the transaction represents the first live spend on the Bitcoin mainnet engineered specifically to withstand an attack by a cryptographically relevant quantum computer.

The transaction was executed using Quantum-Safe Bitcoin (QSB), a spending scheme designed by StarkWare Chief Product Officer Avihu Levy and implemented alongside StarkWare engineer Tomer Giladi. Because the transaction script utilized non-standard legacy constructions that ordinary Bitcoin Core relay nodes reject by default, it could not propagate across the public mempool. Instead, the developers bypassed node relay filters entirely by delivering the transaction directly to Bitcoin miner MARA via its Slipstream out-of-band submission service. MARA included the raw transaction directly into block 964,199, proving that quantum-resistant verification can be executed under Bitcoin's existing consensus rules without requiring a soft fork or protocol upgrade.

"A Bitcoin holder can now move coins into a quantum-resistant construction using Bitcoin as it exists today, without changing its consensus rules," David de Paula Santos Silva, founder and CEO of CyberX, observed following the confirmation. Joni Zhuleku, chief research officer at Altcoin Pro, characterized the milestone as an inflection point for network security: "As far as we are aware, this is the first time anyone has actually done this on mainnet instead of just writing a paper about it. For holders, that matters because quantum used to be a someday problem, and now there is a real, working way to protect coins if someone wants to use it today."

StarkWare CEO Eli Ben-Sasson celebrated the execution, asserting that the mechanism demonstrates "Bitcoin has no expiration date". Yet Levy himself struck a more measured tone, cautioning that QSB functions as an emergency tourniquet rather than a structural cure. Creating the single transaction required hours of specialized GPU cluster computation, costing between $150 and $200 in cloud computing resources. The spent output does nothing to rescue the millions of unspent transaction outputs (UTXOs) whose public keys already sit exposed on the public ledger.

Block 964,199 resolved a theoretical question—proving that post-quantum security can exist within legacy Bitcoin Script—while exposing the sheer scale of the engineering, economic, and governance crises confronting the network. Moving toward a truly quantum proof bitcoin requires confronting severe limitations in block space, unmanageable signature sizes, and an unresolved philosophical debate surrounding billions of dollars in dormant coins.

The Threat Vector: Why Shor's Algorithm Dismantles secp256k1

Bitcoin secures sovereign ownership through asymmetric cryptography. Every address capable of receiving and dispersing funds derives its security from the Elliptic Curve Digital Signature Algorithm (ECDSA) or Schnorr signatures, operating over the specific Koblitz curve known as secp256k1.

The curve is defined over the finite field $\mathbb{F}_p$, where $p = 2^{256} - 2^{32} - 977$, governed by the algebraic equation:

$$y^2 = x^3 + 7 \pmod p$$

Ownership of funds centers on the Elliptic Curve Discrete Logarithm Problem (ECDLP). A user generates a private key, which is a cryptographically secure 256-bit scalar integer $k$. The public key $P$ is computed by multiplying $k$ by a standardized base generator point $G$ on the curve:

$$P = k \cdot G$$

Performing elliptic curve point multiplication in the forward direction is computationally trivial for classical microprocessors, requiring mere fractions of a millisecond. Reversing the operation—calculating the private scalar $k$ when given only the public point $P$ and generator $G$—is computationally intractable using classical computers. The best-known classical attack, Pollard's rho algorithm, requires fully exponential time:

$$O(\sqrt{n}) \approx 2^{128} \text{ operations}$$

An attacker executing $2^{128}$ point operations on state-of-the-art classical supercomputers would consume more energy than entire nations produce over decades, rendering classical brute-force key recovery impossible.

Classical Hardness vs. Quantum Decomposition:

Classical (secp256k1):
Private Key (k) ------[Scalar Multiplication: k · G]------> Public Key (P)
Private Key (k) <-----[Pollard's Rho: ~2^128 Ops]---------- Public Key (P) [INTRACTABLE]

Quantum (Shor's Algorithm):
Private Key (k) <-----[Quantum Fourier Transform: O((log n)^3)]-- Public Key (P) [POLYNOMIAL]

This mathematical asymmetry collapses under the physics of quantum computation. In 1994, mathematician Peter Shor formulated a quantum algorithm capable of computing discrete logarithms and prime factorizations in bounded polynomial time. Shor's algorithm converts the discrete logarithm problem into a period-finding challenge over an abelian group.

By exploiting quantum superposition and the Quantum Fourier Transform (QFT), a Cryptographically Relevant Quantum Computer (CRQC) can determine the order $r$ of the group element in polynomial time:

$$O((\log n)^3)$$

For Bitcoin's 256-bit curve, a quantum computer running Shor's algorithm does not evaluate keys one by one. It processes an interference pattern across computational states to isolate the scalar multiple $k$ in roughly $O(256^3)$ steps.

The threat to Bitcoin is asymmetric: it breaks public-key cryptography, not hashing. The network's proof-of-work consensus relies on SHA-256, while address generation uses Hash160 (SHA-256 followed by RIPEMD-160). Against hash functions, Shor's algorithm is ineffective. Quantum attackers must rely instead on Grover's algorithm, which provides only a quadratic speedup for unstructured database searches:

$$O(N) \longrightarrow O(\sqrt{N})$$

Applying Grover's algorithm against a 256-bit hash function reduces its effective security from 256 bits to 128 bits—a margin that remains mathematically impenetrable to physical hardware. Hash functions remain durable against quantum attacks. The vulnerability resides entirely within the signature schemes that authenticate the movement of unspent coins.

For years, researchers assumed building a quantum system with the millions of physical qubits required to break secp256k1 remained decades away. Classical error rates demanded massive physical-to-logical qubit ratios under standard surface codes. However, hardware roadmaps have accelerated. A research paper published by Google Quantum AI demonstrated that algorithmic optimizations and improved physical-layer error decoding could break elliptic curve keys using fewer than 500,000 physical qubits. As industrial quantum roadmaps advance toward fault tolerance, the theoretical window separating laboratory research from applied cryptanalysis is narrowing rapidly.

Quantifying the Target: The $500 Billion Exposed Ledger

The quantum threat to Bitcoin does not affect every UTXO uniformly. The vulnerability of any specific coin depends on the output script encumbering it and whether the underlying public key has ever been revealed on-chain.

+---------------------------------------------------------------------------------------------------+
| BITCOIN ADDRESS VULNERABILITY MATRIX                                                              |
+--------------------------+-----------------------+-----------------------+------------------------+
| Output Type              | Script Format         | Public Key Visibility | Quantum Vulnerability  |
+--------------------------+-----------------------+-----------------------+------------------------+
| Pay-to-Public-Key (P2PK) | <pubKey> OP_CHECKSIG  | Immediate (On-Chain)  | Critical / Static      |
| Pay-to-Taproot (P2TR)    | OP_1 <32-byte pubKey> | Immediate (On-Chain)  | Critical / Static      |
| Reused P2PKH / P2WPKH    | OP_HASH160 <hash>...  | Revealed on 1st Spend | Critical / Static      |
| Unspent P2PKH / P2WPKH   | OP_HASH160 <hash>...  | Hidden Behind Hash    | Transient (Mempool)    |
| P2SH / P2WSH (Complex)   | OP_HASH160/SHA256...  | Hidden Until Spend    | Script-Dependent       |
+--------------------------+-----------------------+-----------------------+------------------------+

When Satoshi Nakamoto launched Bitcoin in 2009, native address constructions did not rely on Pay-to-PubKey-Hash (P2PKH). Instead, coinbase block rewards and early peer-to-peer transfers were locked using Pay-to-Public-Key (P2PK):

scriptPubKey: <uncompressed_or_compressed_pubKey> OP_CHECKSIG

In P2PK outputs, the raw 65-byte or 33-byte elliptic curve point $P$ is directly embedded within the blockchain's state. A quantum adversary needs no network interaction, no active transaction broadcast, and no privileged access. The attacker can simply read the historical blockchain, run Shor's algorithm against the publicly exposed point $P$, derive the corresponding private scalar $k$, and forge a valid signature to empty the address.

On-chain analysis published by Glassnode and Chaincode Labs indicates that approximately 6.04 million to 6.65 million BTC—nearly 30% of the entire issued Bitcoin supply—sit in outputs where the public key is permanently exposed. At market valuations hovering near $80,000 per coin, this represents roughly $480 billion to $530 billion in capital exposed to direct quantum theft.

Circulating Supply Breakdown (~19.8M BTC Issued):
[===================== 68% Protected Behind Hashes =====================][=== 32% Exposed PubKeys ===]
                                                                          (P2PK, Reused P2PKH, P2TR)
                                                                          ~6.04M to 6.65M BTC at Risk

This exposed capital includes the foundational holdings of the network:

The Nakamoto UTXOs: Between 1.0 million and 1.1 million coins mined by Satoshi Nakamoto across 2009 and 2010 remain stored in early P2PK outputs. These coins have never moved, leaving their unhashed public keys permanently accessible on-chain.
Address Reuse on P2PKH and P2WPKH: Satoshi introduced P2PKH to obscure public keys behind Hash160. When funds are sent to a P2PKH address, only the 20-byte hash is published:

$$\text{Address} = \text{RIPEMD-160}(\text{SHA-256}(P))$$

Because Shor's algorithm cannot invert Hash160, these coins remain protected in cold storage. However, the moment a user spends from a P2PKH address, the spending transaction must reveal the raw public key $P$ inside the scriptSig to satisfy OP_CHECKSIG. If the user reuses that address—receiving additional transactions to the same address or failing to sweep change to a pristine address—the remaining funds lose their hash shield. Millions of coins are currently held in reused addresses.

Pay-to-Taproot (P2TR / BIP 341): Activated in November 2021, Taproot modernized Bitcoin's smart contract capabilities and privacy by introducing Schnorr signatures and Merkelized Alternative Script Trees (MAST). Taproot outputs use a 32-byte witness program representing an aggregated public key $Q$:

$$Q = P + h(P || m)G$$

While Taproot conceals alternative script spending paths behind a Merkle root $m$, the primary spending path ("keypath spend") exposes the point $Q$ directly on the blockchain. As Taproot adoption expands across institutional custody, the Lightning Network, and BitVM off-chain protocols, it has inadvertently increased the volume of Bitcoin value bound to quantum-vulnerable public keys.

The Mempool Sniping Window

Even if every user eliminated address reuse and migrated away from P2PK and Taproot, hashed addresses (P2PKH, P2WPKH) still face a critical operational vulnerability: the mempool exposure window.

The Mempool Sniping Race:

1. Honest Sender broadcasts P2PKH/P2WPKH Spend:
   Mempool receives: [TxIn: Reveals Raw Public Key P] --------> Target: Merchant

2. CRQC Interception (Within 10-Minute Window):
   Attacker reads P from Mempool ---> Executes Shor's Algorithm ---> Extracts Private Key k

3. Exploitation via Replace-By-Fee (RBF):
   Attacker crafts Malicious Tx: [Spends same UTXO to Attacker's Address]
   Attacker sets Fee = 1,000 sat/vB (Outbids Honest Tx)

4. Miner Action:
   Miners confirm higher-fee Malicious Tx in Block N.
   Honest Tx is evicted. Funds stolen before initial confirmation.

When an owner initiates a transaction from a secure P2PKH output, the transaction script must provide the unhashed public key $P$ alongside the ECDSA signature. The moment this transaction is broadcast to the peer-to-peer network, it enters the mempool—the decentralized staging area where unconfirmed transactions wait for miners to bundle them into blocks.

During this waiting period—typically ten minutes, but frequently hours during periods of chain congestion—the public key sits in plaintext. A quantum adversary monitoring peer-to-peer gossip traffic could intercept the transaction, extract the exposed public key, compute the private key via Shor's algorithm, generate a competing transaction diverting the funds to an attacker-controlled address, attach a higher transaction fee using Replace-By-Fee (RBF), and broadcast the competing transaction.

Miners, economically incentivized by fee maximization, prioritize the attacker's higher-fee transaction, confirming the theft and invalidating the legitimate spend. Under this mempool attack model, an adversary with a sufficiently low-latency quantum computer threatens the entirety of the network's liquidity, regardless of address hygiene.

Technical Deconstruction: How Block 964,199 Executed QSB

The mainnet transaction confirmed in block 964,199 addressed this public-key exposure window directly. Devised by Avihu Levy, the Quantum-Safe Bitcoin (QSB) framework operates entirely within the constraints of Bitcoin's legacy Script interpreter, avoiding the multi-year political process required to execute a consensus soft fork.

Legacy Bitcoin Script Constraints (BIP 16 P2SH):
├── Maximum Script Size: 10,000 bytes
├── Maximum Stack Element: 520 bytes
├── Maximum Non-Push Opcodes: 201 opcodes
└── Standardness Limits (IsStandard()): Strict mempool policy rules

To achieve quantum resistance without native post-quantum signature opcodes, QSB replaces elliptic curve validation with hash-based proofs. While Shor's algorithm breaks discrete logarithms, it cannot invert cryptographic hash preimages.

QSB builds on two prior concepts: Ethan Heilman's discovery that Lamport signatures could be emulated in Script, and Robin Linus's Binohash framework, which introduced off-chain proof-of-work puzzles to evaluate transaction integrity.

Binohash used an OP_SIZE trick to construct Lamport-style one-time signatures (OTS). However, Binohash relied on the assumption that an attacker could not generate an ECDSA signature with an $r$-value smaller than a specific size bound. Under Shor's algorithm, a quantum adversary can compute the discrete logarithm of $r = 1$, defeating Binohash's structural security.

Levy solved this vulnerability by introducing a hash-to-signature puzzle. In QSB, transaction authorization does not rely on demonstrating knowledge of a secret scalar $k$. Instead, the spending script hashes an ephemeral public key using OP_RIPEMD160 and interprets the 20-byte output as a DER-encoded ECDSA signature:

QSB Verification Path in Script:
Candidate Input ---> OP_RIPEMD160 ---> [20-byte Output] ---> Evaluated as DER-encoded Signature

A standard Distinguished Encoding Rules (DER) signature consists of structural header bytes, length tags, and two integers: $r$ and $s$. A random 20-byte string generated by a cryptographic hash function will almost never match the structural formatting required by Bitcoin's strict DER verification rules (SCRIPT_VERIFY_DERSIG).

The probability that a random 20-byte hash output strictly conforms to the DER encoding constraints of an ECDSA signature is roughly:

$$P_{\text{valid}} \approx 2^{-46} \approx \frac{1}{70,368,744,177,664}$$

This tiny probability creates a proof-of-work verification puzzle. To spend a QSB-encumbered output, the legitimate owner cannot simply sign the transaction. Instead, the owner must conduct an off-chain computational search across millions of parameter permutations—grinding the transaction's nSequence and nLockTime fields—until discovering a candidate state whose RIPEMD-160 hash produces a validly formatted DER signature:

Off-Chain Grinding Loop:
repeat:
    nSequence++
    candidate_hash = RIPEMD160(SHA256(TxData || nSequence))
until IsValidDERSignatureStructure(candidate_hash) == TRUE
// Requires ~2^46 hash evaluations (~70.4 trillion iterations)

Because this puzzle relies entirely on the second-preimage resistance of RIPEMD-160 and SHA-256, Shor's algorithm offers no mathematical shortcut. A quantum computer attacking the spend gains only the quadratic speedup offered by Grover's algorithm.

Under a pure Shor attack model, QSB provides roughly 118 bits of second-preimage resistance. When accounting for Grover's algorithm, the effective security margin drops to approximately 59 to 69 bits. While lower than standard cryptographic targets, searching a $2^{59}$ space remains computationally intensive, preventing immediate key extraction in the mempool.

To bind this hash-to-signature puzzle to the specific destination address, QSB integrates a Hash to Obtain Random Subsets (HORS) construction—a variant of Lamport one-time signatures. The sender generates an array of secret random preimages and publishes their hashes within the locking script. Spending requires revealing a subset of these preimages determined by the hash of the transaction data. Once revealed, these preimages cannot be reused, making QSB strictly a one-time spending mechanism.

Bypassing the Mempool: The MARA Slipstream Route

While QSB executes entirely within the consensus validation logic of Bitcoin's virtual machine, it violates several standardness policies enforced by Bitcoin Core nodes.

Bitcoin maintains a strict division between consensus rules and node policy rules:

Consensus Rules (Enforced by all validating nodes):
- Invalid scripts cause block rejection (Chain Split risk)
- Max block weight: 4,000,000 weight units
- Max legacy script size: 10,000 bytes

Policy Rules / IsStandard() (Enforced by default mempool relay):
- Scripts exceeding 1,650 bytes are rejected from relay
- Non-standard opcode sequences are dropped
- Bare multisig is restricted to 3 keys
- Protects nodes from memory exhaustion and DoS attacks

Because QSB embeds extensive one-time signature validation logic, complex byte arrays, and legacy script manipulation quirks (including the historical FindAndDelete behavior in OP_CHECKMULTISIG), its transaction payload exceeds the MAX_STANDARD_TX_WEIGHT and standard script size limits enforced by modern nodes.

If broadcast across the standard P2P network, honest nodes running Bitcoin Core would classify the transaction as non-standard and drop it immediately.

To confirm the transaction in block 964,199, StarkWare delivered the raw, signed hex payload directly to the infrastructure team at MARA via MARA Slipstream. Slipstream provides a direct ingestion interface for non-standard transactions, permitting users to submit complex scripts directly to the mining pool's template generator. MARA evaluated the transaction, collected an out-of-band processing fee, placed the non-standard transaction directly into its candidate block template, and committed it to the ledger when its miners found the valid proof-of-work hash.

Practical Constraints: Why QSB Remains a Temporary Escape Hatch

The successful mining of block 964,199 demonstrated that quantum-resistant transactions can function on Bitcoin today. However, an engineering assessment reveals that QSB cannot serve as a scalable, long-term defense for the wider network.

Operational Friction Points of QSB:
├── Economic Expense: ~$75 - $200 in GPU cloud compute per single output spend
├── Time Latency: Hours of off-chain hashing required prior to broadcast
├── Bandwidth Bloat: Consumes massive legacy script payload per transaction
├── Centralization Trap: Relies on private miner deals (e.g., Slipstream), bypassing P2P mempool
└── Retrospective Ineffectiveness: Cannot secure UTXOs with pre-exposed public keys

1. The Computational and Financial Cost

Standard Bitcoin transactions require negligible computational overhead: a local CPU verifies or creates an ECDSA or Schnorr signature in microseconds, costing fractions of a cent in electricity.

In contrast, QSB forces the spender to act as a mini-miner. Grinding through $2^{46}$ iterations across modern Nvidia H100 or RTX 4090 GPU clusters demands sustained power consumption. Levy's public benchmarks show that generating the single spend confirmed in block 964,199 required several hours of GPU computation, running an optimized CUDA pipeline that cost between $150 and $200 in cloud compute.

For institutional treasuries moving millions of dollars in cold storage, a $200 computing surcharge represents a negligible insurance expense. But for routine commerce, peer-to-peer transfers, and micro-transactions, such computational overhead is unworkable.

2. Transaction Throughput and Block Space Degradation

Bitcoin's block weight limit caps capacity at 4,000,000 weight units (approximately 1 MB to 2 MB of real data under standard transaction profiles). A standard Taproot spend consumes roughly 154 virtual bytes (vB), while a legacy P2PKH spend uses roughly 148 vB.

QSB scripts push the outer boundary of Bitcoin's legacy script limits, approaching the hard consensus ceiling of 10,000 bytes per script. If the global Bitcoin economy attempted to migrate routine transactional volume to QSB:

A single block could accommodate only a few dozen transactions instead of 2,500 to 4,000.
Network transaction throughput would collapse from roughly 7 transactions per second (tps) to less than 0.1 tps.
Fee rates would climb drastically as users competed for the limited byte space permitted under legacy script execution limits.

3. Degradation of Censorship Resistance

A core attribute of Bitcoin is permissionless transaction relay: any user running a standard node can broadcast a valid transaction to peers, confident it will propagate globally and enter miners' mempools without subjective gatekeeping.

Because QSB transactions violate standardness rules, they depend entirely on direct private arrangements with mining pools. Routing transactions through centralized miner APIs creates significant censorship vulnerabilities. Mining pools operating direct-ingestion pipelines are easily subjected to jurisdictional regulatory pressure, Know-Your-Customer (KYC) requirements, and transaction filtering. A post-quantum defense that cannot traverse the public peer-to-peer network cannot preserve Bitcoin's censorship-resistant guarantees.

4. Zero Retrospective Protection

QSB protects an output only if the funds are moved into a QSB construction before an adversary mounts a quantum attack. It provides no protection for coins whose public keys are already visible on the ledger. If an adversary deployed a CRQC today, they could immediately steal the 1.1 million Satoshi coins, the entirety of unmigrated P2PK outputs, and all reused address balances without interacting with QSB scripts. QSB provides an escape route for vigilant holders, but it does not fix the underlying protocol vulnerability.

Protocol-Level Solutions: The Push for Native Consensus Upgrades

Because script-level workarounds cannot scale, protocol developers, researchers, and cryptography teams are advancing architectural proposals to establish a native quantum proof bitcoin framework. These proposals fall into three primary categories: output-type modernizations, post-quantum signature schemes, and zero-knowledge proof aggregation.

Architectural Pathways to a Quantum Proof Bitcoin:
├── Output Modernization: BIP 360 (Pay-to-Merkle-Root / P2MR)
├── Compact Hash Signatures: Blockstream SHRINCS (Stateful + Stateless Fallback)
├── Script Enhancements: OP_CAT Activation (Script-level Lamport / Winternitz OTS)
└── Cryptographic Replacements: NIST Standardization (ML-DSA, FN-DSA, SLH-DSA)

BIP 360: Pay-to-Merkle-Root (P2MR)

One of the most prominent consensus proposals currently under formal review in the Bitcoin Improvement Proposal repository is BIP 360, co-authored by Hunter Beast, Ethan Heilman, and Isabel Foxen Duke.

BIP 360 addresses the quantum vulnerability introduced by Taproot (P2TR). Taproot currently allows two spending paths:

The Keypath Spend: The sender signs using the aggregated internal Schnorr key $Q$. This path offers optimal efficiency and privacy, but exposes an elliptic curve public point, making it vulnerable to Shor's algorithm.
The Scriptpath Spend: The sender reveals an alternative script from a Merkle tree, satisfying specific spending conditions committed to in the Tapscript root.

Taproot (BIP 341) Output:
Output Key: Q = P + hash(P||m)G
├── Keypath Spend: Signs with Q directly (VULNERABLE to Shor's Algorithm)
└── Scriptpath Spend: Proves script inclusion in Merkle root m

BIP 360 (Pay-to-Merkle-Root / P2MR) Output:
Output: Explicit commitment to Merkle Root m ONLY
└── Scriptpath Spend: Keypath spend is completely disabled at consensus level.
    (Immune to static key harvesting; leaves room for PQ signature scripts)

BIP 360 introduces a new native output type: Pay-to-Merkle-Root (P2MR). P2MR retains the structural flexibility of Taproot's Merkle trees while permanently disabling the keypath spend.

Because the output commits directly to the Merkle root $m$ via a quantum-secure hash function (SHA-256), no public key is exposed on-chain while the funds remain unspent. Even if a user's address is known publicly, an adversary with a CRQC cannot compute a discrete logarithm, because no elliptic curve point exists within the scriptPubKey.

P2MR functions as a transitional bridge. It allows users to store funds in a tree structure that is completely safe from static quantum key recovery, while protocol engineers work to finalize which post-quantum signature schemes will eventually authenticate the scriptpath spend.

The NIST Post-Quantum Standards and the Byte-Budget Crisis

The fundamental challenge in upgrading Bitcoin's signature scheme lies in block space economics. In August 2024, the U.S. National Institute of Standards and Technology (NIST) finalized its first set of post-quantum cryptographic standards:

FIPS 204: Module-Lattice-Based Digital Signature Standard (ML-DSA, derived from CRYSTALS-Dilithium).
FIPS 205: Stateless Hash-Based Digital Signature Standard (SLH-DSA, derived from SPHINCS+).
FIPS 206 (Draft): Fast-Fourier Lattice-Based Digital Signature Standard (FN-DSA, derived from Falcon).

While these algorithms provide mathematical security against both Shor's and Grover's algorithms, integrating them into Bitcoin exposes severe physical constraints.

+---------------------------------------------------------------------------------------------------+
| SIGNATURE SIZE AND COMPUTATIONAL RESOURCE COMPARISON                                              |
+--------------------------+-----------------------+-----------------------+------------------------+
| Signature Scheme         | Public Key Size       | Signature Size        | Cryptographic Base     |
+--------------------------+-----------------------+-----------------------+------------------------+
| Classical ECDSA          | 33 bytes (compressed) | ~71-72 bytes          | secp256k1 (ECDLP)      |
| Classical Schnorr        | 32 bytes (x-only)     | 64 bytes              | secp256k1 (ECDLP)      |
| NIST ML-DSA-44           | 1,312 bytes           | 2,420 bytes           | Module Learning w/ Errors |
| NIST FN-DSA-512 (Falcon) | 897 bytes             | 666 bytes             | NTRU Lattices          |
| NIST SLH-DSA-SHA2-128s   | 32 bytes              | 7,856 bytes           | Hash Preimage / Trees  |
| Blockstream SHRINCS (Stateful)| ~64 bytes         | 324 bytes             | SHA-256 Preimage       |
+--------------------------+-----------------------+-----------------------+------------------------+

A standard Schnorr public key and signature require 32 bytes and 64 bytes respectively—consuming a mere 96 bytes of witness data.

If Bitcoin Core adopted ML-DSA-44 via a soft fork, every single spend would inject 3,732 bytes of cryptographic overhead into the block. Under Bitcoin's current 4 MB block weight limit, a block could hold a maximum of approximately 1,000 transactions, even if no other transaction data were included.

FN-DSA (Falcon) offers smaller footprints (roughly 1.5 KB total for key and signature), but its mathematical operations require complex double-precision floating-point arithmetic during signature generation. Implementing non-constant-time floating-point operations within decentralized consensus engines introduces significant side-channel risks, timing vulnerabilities, and non-deterministic execution bugs across different operating systems and CPU architectures.

Stateless hash-based signatures like SLH-DSA (SPHINCS+) avoid new, unproven lattice-based mathematical assumptions by relying entirely on symmetric hash functions. However, their signature sizes range from 7.8 KB to more than 40 KB per spend, making them completely incompatible with Bitcoin's throughput constraints without a substantial, controversial increase in block weight.

Blockstream's SHRINCS: Compact Hash Signatures on Liquid

To resolve this signature size dilemma, Blockstream researchers Mikhail Kudinov and Jonas Nick introduced SHRINCS (Short Hash-Based Signatures), a scheme optimized specifically for blockchain systems where every byte directly dictates transaction fees.

In March 2026, Blockstream successfully deployed and confirmed the first SHRINCS-signed transaction on the Liquid Network, a federated production sidechain of Bitcoin.

SHRINCS abandons lattice assumptions, rooting its security entirely in the preimage resistance of SHA-256. The scheme operates using a stateful signature model:

The Stateful Fast-Path: In normal operation, SHRINCS produces a signature of just 324 bytes—more than seven times smaller than NIST's ML-DSA standard. It achieves this by tracking an incremental internal state, maintaining an off-chain "signature budget" that manages how many times a key can sign before requiring renewal. Subsequent signatures under the same key budget add only 16 bytes each.
The Stateless Safety Fallback: The primary risk of stateful schemes is wallet backup corruption: if a user restores a seed phrase on a secondary device without synchronizing the internal signature index, reusing a state index compromises security. SHRINCS solves this by integrating a stateless fallback path producing a larger signature (3 KB to 8 KB). If state synchronization is lost, the user can spend via the fallback path, ensuring that private keys cannot be compromised by index desynchronization.

The Liquid deployment confirmed five production transactions authenticated via SHRINCS using the Simplicity smart contract language. It proved that hash-based post-quantum cryptography can be compressed into dimensions viable for UTXO-based blockchains, establishing a concrete design template for an eventual Bitcoin soft fork.

SHRINCS Dual-Path Architecture:

                 +--------------------------------------------+
                 |            User Initiates Spend            |
                 +--------------------------------------------+
                                        |
                   Is Wallet State Synchronized?
                                        |
                    +-------------------+-------------------+
                    | YES                                   | NO
                    v                                       v
        +-----------------------+               +-----------------------+
        |   Stateful Fast-Path  |               |   Stateless Fallback  |
        | - Size: 324 bytes     |               | - Size: 3,000-8,000 B |
        | - Minimal Fee Impact  |               | - Recovers Lost State |
        | - Uses SHA-256 Hashes |               | - Protects from Thefts|
        +-----------------------+               +-----------------------+

The OP_CAT Renaissance and Native One-Time Signatures

Parallel to dedicated signature opcodes, developer momentum has gathered around restoring the OP_CAT opcode via BIP 347 / BIP 420.

Satoshi Nakamoto disabled OP_CAT in 2010 due to concerns that recursive concatenation could allow malicious scripts to generate exponential memory buffers on node hardware, triggering denial-of-service vulnerabilities. Modern proposals restore OP_CAT with an explicit 520-byte maximum stack limit, eliminating the historical memory exhaustion risk.

Restoring OP_CAT enables transaction introspection and native data concatenation directly on the stack. In doing so, it allows Bitcoin Script to verify Lamport signatures and Winternitz One-Time Signatures (W-OTS+) natively:

Script Verification with OP_CAT:
Stack Input: <signature_chunks>
OP_CAT Operations: Concatenates and hashes message digests dynamically
Verification: Hashes preimages and confirms parity against pubKey hash in a single script run

With OP_CAT, Bitcoin avoids the governance hurdle of standardizing on a single, specific post-quantum algorithm at the consensus layer. Instead, developers can deploy Winternitz signatures directly inside custom script spending paths. This localizes the data costs: only users opting into post-quantum scripts pay the fee overhead of larger witness payloads, allowing cryptographic algorithms to evolve without necessitating repeated soft forks.

The Immutability Crisis: BIP 361 and the Satoshi Coin Dilemma

While cryptographic research can secure future transactions, it cannot evade Bitcoin's most fraught governance challenge: what should the network do with outputs that are never migrated?

This governance dilemma is addressed in BIP 361, a proposal that outlines a phased deprecation schedule for legacy, quantum-vulnerable cryptographic signatures.

BIP 361 Migration Timeline:
├── Phase 1 (Soft Fork Activation): Native post-quantum output types (e.g., P2MR) are enabled.
│                                   Wallets begin voluntary user migration to PQ outputs.
├── Phase 2 (Sunrise Window):       Both legacy and PQ outputs remain spendable.
│                                   Exchanges, custodians, and users sweep cold storage.
└── Phase 3 (Consensus Sunset):     Legacy unmigrated outputs (P2PK, exposed pubkeys) are frozen.
                                    Nodes reject classical ECDSA spends from exposed keys.

Under BIP 361, the network would activate a post-quantum soft fork (such as BIP 360) and initiate a multi-year migration countdown—a sunrise window lasting between five and ten years. During this window:

Wallets, custodians, and exchanges would systematically migrate client funds into post-quantum outputs.
At the expiration of the deadline, a secondary consensus rule would activate, rendering all unmigrated outputs whose public keys are exposed on-chain permanently unspendable.

BIP 361 forces a confrontation between two foundational philosophies that underpin Bitcoin's value proposition:

+---------------------------------------------------------------------------------------------------+
| THE CORE GOVERNANCE SCHISM: PROTOCOL UPGRADE VS. ABSOLUTE IMMUTABILITY                            |
+-----------------------------------+---------------------------------------------------------------+
| The Pragmatic Defense Position    | The Orthodox Immutability Position                            |
+-----------------------------------+---------------------------------------------------------------+
| - A sudden, uncontrolled quantum  | - Bitcoin's value rests on invariant ledger immutability.     |
|   theft of 1.1M Satoshi coins     | - Freezing unspent outputs violates the non-confiscation      |
|   would destroy market confidence |   social contract, creating a dangerous legal precedent.      |
|   and crash purchasing power.     |                                                               |
| - Adversaries would weaponize     | - If a majority can freeze dormant coins, Bitcoin ceases to   |
|   stolen billions to finance      |   be a decentralized, censorship-resistant bearer asset.      |
|   sustained 51% mining attacks.   |                                                               |
| - Protecting network solvency     | - Users bear personal responsibility: if a key is weak,      |
|   supersedes lost keys.           |   its loss is the natural consequence of protocol mechanics.  |
+-----------------------------------+---------------------------------------------------------------+

The pragmatic argument focuses on systemic risk. If an intelligence agency or rogue actor operates a functional CRQC in secret, they will not announce their achievement. They will quietly sweep the 1.1 million coins associated with Satoshi Nakamoto, alongside early institutional and individual P2PK balances.

Dumping hundreds of thousands of newly minted, stolen coins onto global order books would crush Bitcoin's spot price, trigger systemic cascading liquidations across lending protocols and derivative markets, and destroy the monetary thesis of digital gold. Furthermore, an attacker controlling tens of billions of dollars in stolen liquidity could easily fund massive, sustained 51% attacks against SHA-256 mining by acquiring hash power or bribing pool operators.

The orthodox immutability argument views the freezing of any output as protocol-level failure. In the view of protocol purists, Bitcoin's primary value proposition is that no council, no miner majority, and no developer consensus can alter an individual's private property rights without their valid cryptographic consent.

Freezing unspent outputs would establish a precedent that the ledger can be curated and dormant wealth redistributed or destroyed by social coordination. If the network burns Satoshi's coins to prevent theft, it sacrifices the foundational premise that distinguishes Bitcoin from sovereign fiat currency: absolute, algorithmic predictability immune to human discretion.

Escaping the Fork: Zero-Knowledge Proofs of Seed Knowledge

To avoid the political paralysis of BIP 361, alternative non-invasive migration strategies are emerging. One approach, explored in prototype research by Lightning Labs CTO Olaoluwa Osuntokun, uses zero-knowledge proofs to construct a "quantum escape hatch".

Zero-Knowledge Seed Escape Hatch:

1. User holds vulnerable legacy address (Derived from BIP 32/39/44 seed phrase).
2. Quantum adversary steals or targets exposed ECDSA key.
3. User generates ZK-STARK Proof off-chain:
   - Proves mathematical derivation of the address from the original BIP-39 mnemonic seed.
   - Proves this knowledge WITHOUT revealing the private key or mnemonic on-chain.
4. Bitcoin script verifies the ZK-STARK proof (inherently post-quantum via hash functions).
5. Output is swept directly to a new post-quantum address, bypassing classical ECDSA validation.

Because ZK-STARKs rely strictly on collision-resistant hash functions rather than elliptic curve pairings, the proof itself is entirely quantum-safe.

If integrated into Bitcoin's script engine, a user whose address is compromised could broadcast a succinct STARK proof demonstrating that they possess the root entropy from which the original wallet was derived.

The protocol could prioritize this root-entropy authorization over a classical signature, enabling legitimate owners to recover vulnerable funds even if an adversary has derived the raw elliptic curve private key via Shor's algorithm.

Architectural Timeline: What to Watch for Next

The mining of the first quantum-safe spend in block 964,199 marks a fundamental shift in Bitcoin's lifecycle. The conversation has transitioned from academic speculation about theoretical quantum machines to active engineering implementations on the production ledger.

Consensus Roadmap & Technical Milestones:
┌──────────────────────────────────────────────────────────────────────────────────┐
│ PHASE 1: Mainnet Experimentation (Active)                                        │
│ • Proof-of-concept hash spends confirmed in Block 964,199 (QSB via Slipstream)  │
│ • Production sidechain deployment of SHRINCS on Blockstream Liquid (March 2026)  │
└─────────────────────────┬────────────────────────────────────────────────────────┘
                          │
┌─────────────────────────▼────────────────────────────────────────────────────────┐
│ PHASE 2: Script and Output Modernization (Next 12–24 Months)                     │
│ • BIP 347 / BIP 420 (OP_CAT) debate reaches activation consensus                │
│ • BIP 360 (Pay-to-Merkle-Root / P2MR) drafted for Signet and Testnet4 deployment │
│ • Wallet software (Sparrow, Core, Electrum) eliminates remaining address reuse   │
└─────────────────────────┬────────────────────────────────────────────────────────┘
                          │
┌─────────────────────────▼────────────────────────────────────────────────────────┐
│ PHASE 3: Signature Scheme Formalization & Soft Fork (2–5 Year Horizon)           │
│ • Consensus selection of a primary PQ signature algorithm (Compact Lattice /     │
│   Hash-based stateful construction like SHRINCS)                                 │
│ • Activation of native PQ Tapscript spending opcodes                             │
│ • Introduction of Mempool Anti-Sniping rules for transient P2PKH transactions    │
└─────────────────────────┬────────────────────────────────────────────────────────┘
                          │
┌─────────────────────────▼────────────────────────────────────────────────────────┐
│ PHASE 4: The Legacy Sunset Resolution (Long-Term Transition Window)              │
│ • Formal ecosystem evaluation of BIP 361 migration deadlines                    │
│ • Resolution of dormant UTXO handling (Satoshi coins, unmigrated P2PK outputs)   │
│ • Transition of entire circulating market cap to verified quantum-proof storage  │
└──────────────────────────────────────────────────────────────────────────────────┘

The roadmap ahead centers on distinct technical milestones:

The OP_CAT Activation Gate: Widespread adoption of post-quantum one-time signatures depends heavily on whether the Bitcoin Core community rallies around activating OP_CAT. If activated, developers can roll out script-level Lamport and Winternitz signature modules immediately, establishing decentralized post-quantum protections without waiting for a unified signature soft fork.
P2MR Integration on Testnet: Advancing BIP 360 onto public signet networks will allow custody providers, institutions, and wallet developers to test Pay-to-Merkle-Root outputs alongside Lightning implementations, ensuring that disabling the keypath spend does not disrupt layer-2 payment routing.
Mempool Relay Modernization: To prevent quantum transactions from remaining dependent on private mining arrangements like MARA Slipstream, developers must refine Bitcoin Core's IsStandard() policy limits. Establishing safe, bounded relay policies for post-quantum proofs is essential to ensure that emergency migrations can traverse the public peer-to-peer network.
Resolution of the Dormant UTXO Consensus: The community must confront the game theory surrounding unmigrated outputs. Debates over BIP 361 will define whether Bitcoin prioritizes programmatic immutability above all else, or implements consensus-enforced deadlines to prevent catastrophic, destabilizing coin theft.

Block 964,199 demonstrated that Bitcoin possesses the cryptographic flexibility to defend itself using tools already available inside its legacy code. Moving from an expensive, non-standard emergency hack toward an efficient, scalable, and universally protected quantum proof bitcoin is the defining engineering challenge of the network's second decade. The cryptographic clock is running, and the transition from theoretical research to practical network defense has officially begun.