# StarkWare Moves 3.1 Bitcoin in What It Calls the First Quantum-Safe Mainnet Spend

The transaction used hash-based signatures inside existing Bitcoin Script, so it required no soft fork. The same day, Ethereum developers published a draft proposal to retire quantum-vulnerable validator keys.

- Published: 2026-08-27T05:48:48.749Z
- Canonical: https://polylog.news/crypto/2026-08-27/starkware-moves-3-1-bitcoin-in-what-it-calls-the-first-quant
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [crypto.news](https://crypto.news/bitcoin-mines-first-quantum-safe-mainnet-transaction/), [Polylog editors](https://polylog.news), [CoinDesk](https://www.coindesk.com/tech/2026/08/26/ethereum-developers-propose-first-step-to-protect-eth-staking-from-quantum-attacks), [Blockstream Blog](https://blog.blockstream.com/lattice-signatures-for-bitcoin/)

StarkWare confirmed a bitcoin transaction that it says a future quantum computer could not forge, and it accomplished this [without any change to Bitcoin's consensus rules](https://crypto.news/bitcoin-mines-first-quantum-safe-mainnet-transaction/). The company moved 3.1 bitcoin using a scheme called Quantum Safe Bitcoin (QSB), designed by StarkWare chief product officer Avihu Levy. QSB replaces the elliptic-curve signature that normally authorizes a bitcoin spend with a one-time signature built only from hash functions and written in Bitcoin's existing scripting language. Cointelegraph [reported the same result](https://t.me/cointelegraph/71800), calling it the first such transaction on the live network.

The design matters more than the amount moved. Every bitcoin today is protected by elliptic-curve signatures, which a sufficiently powerful quantum computer running Shor's algorithm could break. QSB avoids the need for a soft fork, the network-wide rule change a new signature type would normally require, by shifting the cost to computation instead. Levy's published work relies on extensive off-chain proving, and CoinDesk reported in April that the method costs roughly $75 to $200 per transaction.

On the same day, Ethereum core developers filed a draft Ethereum Improvement Proposal (EIP) that would let validators deposit using quantum-resistant keys and then permanently stop accepting the key format the network uses now, [CoinDesk reported](https://www.coindesk.com/tech/2026/08/26/ethereum-developers-propose-first-step-to-protect-eth-staking-from-quantum-attacks). The draft currently carries a placeholder number, though a repository maintainer suggested it be assigned EIP-8394. It is part of the Lean Consensus effort, which is developing leanXMSS, a hash-based signature scheme for validators.

The replacement candidates are not settled. Blockstream Research [graded the three leading lattice-based signature schemes proposed for Bitcoin](https://blog.blockstream.com/lattice-signatures-for-bitcoin/), Falcon, Dilithium and Hawk, and one of the three was withdrawn before the report was finished.

## What this means

Quantum-resistant cryptography went from a research topic to working code on two major blockchains within a single day. Bitcoin's approach requires no protocol vote, but it charges each user a substantial computation cost, so it will likely be adopted first by parties holding enough value to justify that fee: custodians, exchanges and treasury holders, rather than retail wallet users. Ethereum's approach is cheaper per user, but it requires the entire validator set to migrate and will eventually retire the current aggregated signature format, the mechanism that keeps consensus messages compact. The parties exposed are staking operators and custodians, who will bear the migration cost, and holders of coins in older address formats whose public keys are already visible on the blockchain.

## What to watch

- Whether any custodian or exchange announces support for quantum-safe spending paths, which would show that the cost is acceptable to institutions, not just to researchers.
- Whether the Ethereum draft receives an official EIP number and a target upgrade date, since a scheduled fork is what separates a research direction from a firm commitment.
- The next public cryptanalysis of lattice signature candidates, because another withdrawal like Hawk's would narrow the replacement set for Bitcoin and delay any soft-fork proposal.