Insider Brief
- An open optimization challenge has reduced the estimated GPU cost of constructing a quantum-safe Bitcoin transaction from about $320 to roughly $67 in one week, based on its current benchmark records.
- The leading submissions have increased transaction-pinning throughput on an RTX 4090 from about 146 million to more than 820 million verified candidates per second, while subset-selection performance has improved by roughly tenfold.
- The approach can help protect Bitcoin holdings with unexposed public keys under current rules, but transactions remain nonstandard, require direct miner submission and do not replace a broader protocol upgrade for quantum security.
PRESS RELEASE — A quantum-safe Bitcoin transaction now costs about $67 in GPU compute, by the current estimate on the Quantum-Safe Bitcoin Optimization Challenge dashboard.
A month ago, the first quantum-safe Bitcoin transaction was mined on Bitcoin mainnet. Building it took roughly 3,100 GPU-hours and cost about $320. StarkWare, Yukon Research and Eigen Labs then opened the Quantum-Safe Bitcoin Optimization Challenge to see how far outside developers and AI agents could push the number down. One week in, it has fallen by close to 80 percent.
How much faster has the grinding gotten?
Transaction pinning now runs at just over 820 million verified candidates per second on the benchmark RTX 4090, up from 146.09 million at the baseline. Subset selection has gone from about 62 million to 623,518,629, a little over ten times faster. Across both tracks, solvers have landed 62 promoted submissions.
Who is doing this?
There are 23 solvers on the pinning track and 17 on subset selection, working in public, each building on the last verified record.
The solvers are not relying on the same tools. As of September 23, the two records were held by developers running Opus 5 and Fable 5.1, with GPT-6 Astra, GPT-5.6, Grok 4.6 and Kimi close behind on both leaderboards.
The competition is structured so that solvers don’t need to understand the whole system. Each verified improvement resets the floor and is published, so the next entrant begins from the best known solution rather than starting from scratch.
Throughput alone does not determine the outcome. Every submission is re-derived on a CPU reference implementation and checked against the expected result, so a kernel that gains speed by skipping work is rejected. Timing is measured on the platform’s clock, against inputs the solver has not seen.
Why does faster code make the transaction cheaper?
Because the expensive part of a quantum-safe Bitcoin transaction is a brute-force search, and the search happens before anything reaches the network.
The QSB construction puts a hash where Bitcoin expects a signature. It takes a public key derived from the transaction, runs it through RIPEMD-160, and hands the resulting 20 bytes to the script in the slot a signature would normally occupy. Bitcoin requires signatures in a format called DER and checks that format first, so those 20 bytes have to be shaped like a valid DER signature or the script fails. Only about one in 70 trillion hash outputs has that shape. Nothing lets you steer a hash function toward a particular output, so the only way to find one is to change an input, hash it, check the result, and repeat.
That search runs on your own hardware, which is why it never appears in a Bitcoin fee. It shows up as a GPU bill. Double the candidates per second and the same work takes half the GPU-hours. The dashboard’s estimate applies the measured speedups directly to what the August transaction actually cost.
Cheap enough to matter
A construction that costs a few hundred dollars per transaction is a demo. One that costs $67 is closer to something a holder with a large unexposed balance might reach for in an emergency.
Cost is not the only thing standing in the way. QSB transactions are nonstandard, so they do not relay through the ordinary mempool and have to go to a miner directly, and the construction only protects coins whose public key has not yet been exposed. Neither is solved by making the search cheaper. But cost was the barrier an open competition could attack, and a week of it has moved the number further than anything else has.
StarkWare still considers a soft fork the better long-term answer for broad quantum protection on Bitcoin. QSB is what exists under today’s consensus rules while that work continues.
What the estimate does not cover
The benchmark reproduces what the grinding core demands of a GPU, and it builds no Bitcoin transactions of its own, so a speedup here still has to be measured against the production implementation. The $67 is an estimate under stated hardware assumptions, not a price, and it moves every time a solver beats the record.
Quantum computing does not leave hash functions untouched, it just degrades them far less. Grover’s algorithm searches them in roughly the square root of the time a classical machine would need. The QSB paper puts second-preimage security at about 118 bits, falling to about 59 bits under a rough Grover reduction. Shor does far worse to ECDSA and Schnorr, the elliptic-curve schemes Bitcoin uses for signatures, which is why the construction rests on hashes. But 59 bits is a real reduction, and a number worth revisiting as quantum hardware improves.
Why is StarkWare working on Bitcoin’s quantum problem?
Because the quantum problem is not Bitcoin’s alone. Every chain that authenticates with elliptic-curve signatures faces the same exposure. What decides whether a network survives is its crypto agility, meaning how fast it can replace a broken primitive under pressure.
StarkWare’s proof system is hash-based already, so it doesn’t need to be replaced. In June, the company published a three-phase plan for moving Starknet off its remaining elliptic-curve dependencies, starting with BLAKE2 in place of Pedersen hashing and Falcon-512 signatures for consensus. Starknet’s native account abstraction keeps signature logic inside the account contract, which means a wallet can move to a post-quantum scheme without a network-wide fork.
Measuring the threat is the other half. ECDSA.fail, an open challenge run on the same model as this one, spent two months driving down the estimated cost of the arithmetic behind a quantum attack on elliptic-curve cryptography, and cut Google’s March figure by more than half. Seven contributors from StarkWare and the Starknet Foundation are named co-authors on the September paper.
StarkWare is working both sides of the same number, driving down what the attack costs to run and what the defense costs to build. The gap between them is how much time there there is to prepare.
Take a run at it
Week one ran on a separate prize pool, and improvements from that week do not count toward what comes next. If you join now, you are not chasing a leaderboard someone already won. The remaining pools are open, and a 3% improvement qualifies you for the raffle.
There is a lot to attack: combinatorial enumeration, SHA-256 scheduling, secp256k1 scalar multiplication, batch inversion, register pressure, memory traffic, and occupancy. You can tune the existing kernel or throw it out and write your own, as long as you keep the fixed interface.
This effort does not make Bitcoin quantum-safe. It makes one emergency option cheap enough to keep on the shelf, and every new qsb.fast submission lowers the cost of building one.
Benchmark, rules, leaderboard and submission details: qsb.fast
More on StarkWare’s quantum work: quantum.starkware.co
