Estimated Cost of a Quantum-Safe Bitcoin Transaction Falls 82% to $59

The estimated computing bill for a specialised quantum-resistant Bitcoin transaction has dropped by 82% to $59, according to results from a public optimisation contest reported by CryptoSlate.

Figures from the Quantum-Safe Bitcoin Optimization Challenge put the projected cost at roughly $320 when StarkWare carried out its first mainnet demonstration in August. Faster graphics-processing code brought that down to $67 by September, and to $59 as of 13 October.

Faster GPU searches

StarkWare ran the challenge jointly with Yukon Research and Eigen Labs. Entrants leaned on AI-assisted coding tools to speed up the heavy computational searches these transactions depend on.

In the latest benchmark, an Nvidia RTX 4090 graphics card got through more than 1 billion verified candidates a second. At the start of the contest, the comparable figure was about 146 million.

StarkWare has said it is now aiming to bring the computing cost below $10.

The appeal is that holders could gain a layer of protection against a future quantum computer without first waiting for Bitcoin's base protocol to change, a process that requires broad agreement across the network.

How the scheme works

The approach, known as Quantum-Safe Bitcoin (QSB), pairs hash-based cryptography with a computational puzzle. Together these guard specially prepared coins against attacks on the conventional digital signatures that Bitcoin relies on today.

It draws on work by Avihu Levy of StarkWare, who showed in August that a quantum-resistant way of spending coins could operate within Bitcoin's current consensus rules. Because the demanding calculations are done off-chain before a coin is spent, the method could act as a stopgap while developers weigh deeper changes to the network's cryptography.

Hash-based constructions are generally regarded as sturdier against quantum attack than elliptic-curve signatures, because the best-known quantum algorithms offer only a limited speed-up against hash functions.

Why the timing matters

Concern over the issue has sharpened this year. Google Quantum AI said in March that a sufficiently advanced quantum machine could crack the elliptic-curve cryptography securing Bitcoin with far fewer resources than earlier work had suggested. Under its stated hardware assumptions, some attacks could in theory finish within minutes using under 500,000 physical qubits, roughly a twentyfold improvement on previous estimates.

No publicly demonstrated quantum computer comes close to that capability.

A separate Glassnode study found that around 6.04 million BTC, equal to 30.2% of the supply issued at the time, sat in outputs whose public keys were already visible on-chain. That total breaks down as follows:

• 1.92 million BTC exposed by the structure of the addresses holding it
• 4.12 million BTC exposed through habits such as reusing addresses or having spent from them before

Caveats and what comes next

The $59 headline needs careful reading. It is an estimate tied to particular hardware and derived from simulated GPU workloads, not the cost of a transaction actually completed in production. Network fees would come on top, and parts of the computation still rest on provisional assumptions.

The scheme also has a structural limit. It shields only eligible coins whose standard public keys remain concealed until the coins are transferred into purpose-built outputs. Coins with keys already exposed would remain at risk if a capable quantum attacker emerged before their owners migrated.

Getting such transactions confirmed is another hurdle. They satisfy Bitcoin's consensus rules but are turned away under standard relay policies, so they have to be sent straight to miners prepared to include them. During the August demonstration, that path was provided by Slipstream, a service run by the North American miner MARA.

StarkWare itself still favours a wider protocol upgrade as the long-term answer. Before QSB can work as a credible fallback, researchers will need to show the latest savings holding up in full, end-to-end transactions, and to secure dependable access to miners.

The milestones to watch are whether the sub-$10 target is reached, and whether a complete transaction at the reduced cost is carried out on the live network.

Photo: IBM Research / Wikimedia Commons (CC BY 2.0)