StarkWare says it carried out the first quantum-resistant Bitcoin transaction on August 26. That same day, Blockstream researchers published a Bitcoin Improvement Proposal for SHRINCS, a quantum-secure signature scheme.
Two moves. Both push Bitcoin from abstract worry toward real defenses against quantum computing, which scientists agree could eventually reverse-engineer private keys from public keys and enable theft at scale. Neither closes the door. StarkWare itself said Bitcoin still needs a protocol-level upgrade to be fully quantum-safe. The SHRINCS proposal carries its own caveat: a formal security proof is not yet finished.
The StarkWare method came from Avihu Levy, head of the company’s applications division. It zeroes in on a narrow window of exposure. While a Bitcoin transaction sits in the mempool awaiting confirmation, it reveals mathematical material a future quantum computer could exploit to forge a signature and drain funds. Levy’s answer is signature grinding. The system rejects the first valid signature and churns through millions of candidates until it lands on one whose shape does not leak public key material to quantum attackers. The cost is time. A single transaction can demand hours of computing.
A problem, though. Bitcoin’s network relays only transactions written in formats it recognizes. This one is odd enough that ordinary nodes would drop it. Rather than enter the public queue, the transaction went directly to a miner. MARA mined it through its Slipstream service, StarkWare said.
Levy still backs a permanent protocol fork to make Bitcoin quantum-safe. Eli Ben-Sasson, StarkWare’s CEO, agrees. He called Levy’s method a stopgap that can shield the network until that fork lands. “Avihu’s breakthrough is important because it gives the psychological reassurance which we need and which the asset itself needs,” Ben-Sasson said in The Block. “I’ve said before that crypto is behaving like passengers on the Titanic. What Avihu has illustrated is that there are lifeboats. That is not a reason to relax. It is a reason to build more of them, and to build them now.”
The SHRINCS BIP hit GitHub the same day. It takes a different route to the same threat. Blockstream researchers Jonas Nick and Mikhail Kudinov unveiled the scheme in December 2025 and published the opcode proposal in May. SHRINCS is a hash-based post-quantum signature scheme. Minimum size: 548 bytes plus a 48-byte public key. It can grow as large as 4,619 bytes. Roughly nine times the heft of the Schnorr signatures Bitcoin uses today.
The hit to blockspace is softer than that ratio suggests. Under SegWit, signature data sits in the witness and consumes a quarter as much blockspace as other transaction data, so the larger signature does not require a proportional block-size increase. Blockstream estimates Bitcoin could sustain roughly 3 transactions per second with SHRINCS, comparable to current throughput. NIST-endorsed lattice-based signatures would slow the network to about 0.5 TPS by the same estimates. Hash-based SPHINCS+ would drop it to 0.36 TPS.
Jonas Nick called SHRINCS “the first concrete proposal for a post-quantum signature scheme designed specifically for Bitcoin” in a post on X. He added a qualifier. “SHRINCS is not intended to be Bitcoin’s ‘final’ signature scheme, and it is not optimal along every axis. I do think it is a very good trade-off among the options we have now.”
The BIP itself flags open issues. “a security proof is TODO.” The scheme is stateful: each signature draws on a fresh one-time key stored on the signing device, and signatures grow by 16 bytes with every use. Lose the device and you need a stateless fallback transaction running roughly 5,777 bytes. Keys generated with hypertree pruning will not work with implementations that lack it. Import across mismatched versions and funds may vanish.
Yoon Auh, founder of BOLTS Technologies, said the statefulness and fallback rules add “complexity and fragility” to maximize throughput. “In Bitcoin, every new consensus rule becomes a permanent maintenance obligation, and every wallet-side assumption becomes a possible user failure mode,” Auh said.
SHRINCS has already signed real transactions on Blockstream’s Liquid sidechain, tested in March. Marin Ivezic, author of PostQuantum.com and founder of Applied Quantum, rated it “the strongest answer yet to going post-quantum without wrecking Bitcoin’s block economics.” He noted it has not been audited and lacks the years of public cryptanalysis behind NIST signatures.
“The binding constraint in Bitcoin’s quantum migration isn’t cryptography, it’s governance,” Ivezic said. “Between BIP-360, BIP-361, SHRINCS and STARKs, the engineering menu is filling up fast. What Bitcoin lacks is a mechanism for choosing from it before the clock runs out.”
StarkWare unveiled what it called crypto’s strongest post-quantum roadmap for StarkNet on June 30. The two Aug. 26 developments are separate efforts, and neither source establishes a direct technical link between them.
