When it comes to making Bitcoin quantum-resistant, several different paths suddenly emerged this week, and they are completely different in how they’re carried out. The first one to go viral is also the easiest to understand: Bitcoin’s rules don’t change at all—repeatedly re-compute the signature for a payment until a quantum computer can’t do anything about it, and then hand the transaction straight to the miners for packaging.
The premise is a bit awkward: ordinary nodes simply don’t relay transactions in this format—you have to knock on a mining pool’s door yourself.
This transaction landed in block number 964,199. The scheme was designed by Avihu Levy of StarkWare, and his colleague Tomer Giladi routed it through MARA’s Slipstream channel. I pulled it apart on-chain and checked it: the input protected by the quantum-resistance mechanism is 10,000 sats, which at today’s price comes to less than eight dollars. Levy has explained the principle: the wallet doesn’t accept the first valid signature it computes. Instead, it keeps generating candidate signatures over and over until it finds the one with the right shape—this process consumes several hours of computing power.
Eight dollars, several hours. Pulling this comparison out isn’t meant to mock; it actually shows what this proof demonstrated. Under Bitcoin’s consensus rules today, a spend that does not leak a public key throughout can indeed be packed into the main net.
The scheme’s boundaries are something StarkWare itself describes more honestly than the people who circulated it. The company states clearly that QSB did not make Bitcoin quantum-resistant. It protects only certain transactions. Specifically, it only works for addresses whose public keys have already been exposed on-chain; it can’t save others. CEO Eli Ben-Sasson puts it even more plainly: he still wants Bitcoin to do a soft fork, and he believes it will happen in the end.
The trouble is right here. Bitcoin’s quantum risk isn’t distributed evenly across all coins—it is concentrated only on the subset of addresses whose public keys are already written into blocks. An address that has spent money belongs to this category. As of March 1 of this year, more than one-third of all Bitcoin on the network has already exposed public keys on-chain. These coins won’t become automatically safe just because there’s a new way to spend them. Either the owners actively move them, or they just sit there indefinitely waiting. QSB is a tool prepared for the portion that hasn’t exposed public keys; that’s exactly the group that most needs rescue, but it can’t reach them.
The second path goes after this gap. In the same week, Blockstream’s Jonas Nick formally published BIP for SHRINCS. This is the first quantum-resistant signature scheme specifically tailored by trimming according to Bitcoin’s ledger structure. The foundation is still SHA-256, and it doesn’t rely on any new mathematical assumptions. The cost is made explicit: today a Schnorr signature is 64 bytes; SHRINCS has a minimum of 548 bytes, and in the worst case it can grow to 4,619 bytes. It also requires state: with the same private key, each time you sign the key grows a bit longer. If the device is lost, you need a fallback transaction of more than 5,000 bytes to recover the funds. In the BIP document, there’s also a line that has not been deleted: the security proof hasn’t been completed.
The third path goes even further. In the same week, Blockstream also released an evaluation of lattice-based signatures. Falcon-1024 is the most space-efficient in that category: public key plus signature together totals 3,073 bytes. But the research team itself didn’t recommend deploying it right now, and NIST’s standard text isn’t finalized yet. Their suggested order is: use the hash-based approach first, and only consider a hybrid once the Falcon standard is settled.
Once the routes are laid out, the shared point can’t be hidden. Besides QSB, the other two paths require changing the consensus layer. QSB doesn’t because it bypasses the entire P2P network: nodes don’t recognize such transactions, so miners have to receive and package them separately. Engineering-wise, Bitcoin today isn’t short of answers—it’s short of someone who has the authority to decide for the one-third of coins.
This contradiction has already been brought to the surface this year. In February, BIP-360 was merged into the official repository, defining Bitcoin’s first quantum-resistant address type. In April, Jameson Lopp and five other developers published BIP-361, setting a five-year sunset period for old signature types. Coins that haven’t been moved by the deadline will no longer be recognized by the network as spendable, including the batch widely believed to be Satoshi’s. Adam Back is explicitly against forced freezing; he argues that quantum-resistant functionality should be made an optional feature now, so people can move their own coins. The most accurate summary came from Marin Ivezic, who works on post-quantum security; he said the true constraint for Bitcoin’s quantum migration isn’t cryptography—it’s governance.
I agree with that judgment, and this week’s news provides a perfect footnote. Cryptographers have finished the multiple-choice part: QSB is what can already be used; SHRINCS is what can be brought into the protocol; and Falcon is the option that saves space. The remaining controversy no longer belongs to technical selection—it’s whether to set a deadline for the coins owned by some people. Bitcoin’s governance structure is capable of adding features—Taproot is proof of that. But when it comes to taking away rights, it has never succeeded. The original design was meant to block exactly this kind of thing.
This judgment can be falsified. Over the next few months, if BIP-360 or SHRINCS enters substantial activation discussions and rejects the kind of signaling schedule Taproot used that year, the governance bottleneck might not be as stuck as I imagine. Another signal could be even more direct on-chain: if large addresses that haven’t moved in more than ten years—and whose public keys are already exposed—start relocating in bulk, then the debate about freezing versus not freezing will automatically be downgraded. Neither of these has happened yet.
And there’s no need to be scared by this week alone. The market’s starting point for quantum anxiety is late March and June. Google Quantum AI improved the resource estimation for Shor’s algorithm on elliptic curves by an order of magnitude, and Justin Drake’s long write-up spread it widely in the community. Resource estimation improvement is not the same as actually building machines—the former only shifts the timetable forward a bit. #Bitcoin is now 79,891, and overall this week it’s still moving upward, basically unrelated to the quantum timeline. The value of $BTC is still running along with macro factors and the ETF schedule.
If you want to do something for yourself these days, you can check whether the commonly used address you control has spent funds on-chain. If it has, that means the public key is already exposed, and later—no matter which path Bitcoin chooses—the addresses that will need to be moved proactively are exactly this kind. It’s still far from that day, but knowing which side you’re on is more useful than remembering which week someone proposed which scheme.
The premise is a bit awkward: ordinary nodes simply don’t relay transactions in this format—you have to knock on a mining pool’s door yourself.
This transaction landed in block number 964,199. The scheme was designed by Avihu Levy of StarkWare, and his colleague Tomer Giladi routed it through MARA’s Slipstream channel. I pulled it apart on-chain and checked it: the input protected by the quantum-resistance mechanism is 10,000 sats, which at today’s price comes to less than eight dollars. Levy has explained the principle: the wallet doesn’t accept the first valid signature it computes. Instead, it keeps generating candidate signatures over and over until it finds the one with the right shape—this process consumes several hours of computing power.
Eight dollars, several hours. Pulling this comparison out isn’t meant to mock; it actually shows what this proof demonstrated. Under Bitcoin’s consensus rules today, a spend that does not leak a public key throughout can indeed be packed into the main net.
The scheme’s boundaries are something StarkWare itself describes more honestly than the people who circulated it. The company states clearly that QSB did not make Bitcoin quantum-resistant. It protects only certain transactions. Specifically, it only works for addresses whose public keys have already been exposed on-chain; it can’t save others. CEO Eli Ben-Sasson puts it even more plainly: he still wants Bitcoin to do a soft fork, and he believes it will happen in the end.
The trouble is right here. Bitcoin’s quantum risk isn’t distributed evenly across all coins—it is concentrated only on the subset of addresses whose public keys are already written into blocks. An address that has spent money belongs to this category. As of March 1 of this year, more than one-third of all Bitcoin on the network has already exposed public keys on-chain. These coins won’t become automatically safe just because there’s a new way to spend them. Either the owners actively move them, or they just sit there indefinitely waiting. QSB is a tool prepared for the portion that hasn’t exposed public keys; that’s exactly the group that most needs rescue, but it can’t reach them.
The second path goes after this gap. In the same week, Blockstream’s Jonas Nick formally published BIP for SHRINCS. This is the first quantum-resistant signature scheme specifically tailored by trimming according to Bitcoin’s ledger structure. The foundation is still SHA-256, and it doesn’t rely on any new mathematical assumptions. The cost is made explicit: today a Schnorr signature is 64 bytes; SHRINCS has a minimum of 548 bytes, and in the worst case it can grow to 4,619 bytes. It also requires state: with the same private key, each time you sign the key grows a bit longer. If the device is lost, you need a fallback transaction of more than 5,000 bytes to recover the funds. In the BIP document, there’s also a line that has not been deleted: the security proof hasn’t been completed.
The third path goes even further. In the same week, Blockstream also released an evaluation of lattice-based signatures. Falcon-1024 is the most space-efficient in that category: public key plus signature together totals 3,073 bytes. But the research team itself didn’t recommend deploying it right now, and NIST’s standard text isn’t finalized yet. Their suggested order is: use the hash-based approach first, and only consider a hybrid once the Falcon standard is settled.
Once the routes are laid out, the shared point can’t be hidden. Besides QSB, the other two paths require changing the consensus layer. QSB doesn’t because it bypasses the entire P2P network: nodes don’t recognize such transactions, so miners have to receive and package them separately. Engineering-wise, Bitcoin today isn’t short of answers—it’s short of someone who has the authority to decide for the one-third of coins.
This contradiction has already been brought to the surface this year. In February, BIP-360 was merged into the official repository, defining Bitcoin’s first quantum-resistant address type. In April, Jameson Lopp and five other developers published BIP-361, setting a five-year sunset period for old signature types. Coins that haven’t been moved by the deadline will no longer be recognized by the network as spendable, including the batch widely believed to be Satoshi’s. Adam Back is explicitly against forced freezing; he argues that quantum-resistant functionality should be made an optional feature now, so people can move their own coins. The most accurate summary came from Marin Ivezic, who works on post-quantum security; he said the true constraint for Bitcoin’s quantum migration isn’t cryptography—it’s governance.
I agree with that judgment, and this week’s news provides a perfect footnote. Cryptographers have finished the multiple-choice part: QSB is what can already be used; SHRINCS is what can be brought into the protocol; and Falcon is the option that saves space. The remaining controversy no longer belongs to technical selection—it’s whether to set a deadline for the coins owned by some people. Bitcoin’s governance structure is capable of adding features—Taproot is proof of that. But when it comes to taking away rights, it has never succeeded. The original design was meant to block exactly this kind of thing.
This judgment can be falsified. Over the next few months, if BIP-360 or SHRINCS enters substantial activation discussions and rejects the kind of signaling schedule Taproot used that year, the governance bottleneck might not be as stuck as I imagine. Another signal could be even more direct on-chain: if large addresses that haven’t moved in more than ten years—and whose public keys are already exposed—start relocating in bulk, then the debate about freezing versus not freezing will automatically be downgraded. Neither of these has happened yet.
And there’s no need to be scared by this week alone. The market’s starting point for quantum anxiety is late March and June. Google Quantum AI improved the resource estimation for Shor’s algorithm on elliptic curves by an order of magnitude, and Justin Drake’s long write-up spread it widely in the community. Resource estimation improvement is not the same as actually building machines—the former only shifts the timetable forward a bit. #Bitcoin is now 79,891, and overall this week it’s still moving upward, basically unrelated to the quantum timeline. The value of $BTC is still running along with macro factors and the ETF schedule.
If you want to do something for yourself these days, you can check whether the commonly used address you control has spent funds on-chain. If it has, that means the public key is already exposed, and later—no matter which path Bitcoin chooses—the addresses that will need to be moved proactively are exactly this kind. It’s still far from that day, but knowing which side you’re on is more useful than remembering which week someone proposed which scheme.