Developers Cut Quantum-Safe Bitcoin Transaction Cost Below $70
Surprisingly, the most expensive step in creating a quantum-resistant Bitcoin transaction occurs off-chain and doesn’t reflect in transaction fees. This process, typically run on a graphics card, recently saw its cost plummet from approximately $320 to about $66 within a single week of open competition. This reduction is based on the Quantum-Safe Bitcoin Optimization Challenge dashboard, transforming what was once a demonstration into a potentially practical tool.
Developer Achievements
A month ago, the first quantum-safe Bitcoin (QSB) transaction processed on the mainnet. This initial transaction required roughly 3,100 GPU-hours and cost around $320. To reduce this figure, StarkWare, Yukon Research, and Eigen Labs launched a challenge, inviting external developers and AI coding agents to optimize the process. Within one week, the cost decreased by nearly 80 percent.
It’s important to note that the developers showcased a compute-cost estimate, not a deployed system. The $66 figure is a simulated value coming from benchmark records, applying measured GPU speedups to the cost of the August transaction. This estimate changes as new records happen. No network-wide migration was tested; this achievement focuses solely on making one specific emergency solution more affordable.
The Costly Element: Guessing a Hash
QSB employs an ingenious method: it replaces the expected signature in a Bitcoin transaction with a hash. A public key from the transaction is processed through RIPEMD-160, and the resulting 20 bytes are placed where a signature would normally go. Bitcoin requires signatures to conform to a specific DER format, so these 20 bytes must mimic a valid DER signature to avoid script failure.
Only about one in 70 trillion hash outputs naturally matches this specific shape.
Hash functions are not steerable toward a target. The process involves repeatedly changing an input, hashing it, and checking the result. This is akin to a postal service that only accepts letters weighing a precise, highly improbable amount, forcing you to continuously reshape your letter until it meets the requirement. This “reshaping” accounts for the GPU expenditure. Doubling the candidates processed per second effectively halves the required hours, making the transaction cheaper through faster code.
Key Performance Metrics
These figures represent measured throughput on benchmark hardware, with the dollar cost being a simulated estimate based on stated assumptions, according to the challenge dashboard:
- Estimated GPU construction cost: Reduced from approximately $320 to about $66 in one week.
- Transaction pinning on an RTX 4090: Improved from 146.09 million to over 820 million verified candidates per second.
- Subset selection: Increased from about 62 million to 623,518,629 per second, a tenfold improvement.
- 62 promoted submissions from 40 solvers across two tracks.
- Second-preimage security: Approximately 118 bits, reducing to about 59 bits under a Grover reduction, as per the QSB paper.
Each submission is re-derived using a CPU reference implementation and verified against the expected outcome, ensuring that kernels designed to skip work are rejected. Timing runs are conducted using the platform’s internal clock with unseen inputs to the solver.
The Significance of Hashes and 59 Bits
Shor’s algorithm poses a threat to Bitcoin’s existing elliptic-curve ECDSA and Schnorr signatures, which is why QSB utilizes hashing. While Grover’s algorithm also impacts hash functions, its effect is far less severe, speeding up searches by roughly the square root of classical time. Consequently, 118 bits of security are reduced to about 59 bits under a rough Grover reduction.
This remaining security is not insignificant and warrants re-evaluation as hardware advances. For instance, QuEra’s planned Libra system aims for 256-plus logical qubits with cloud access by 2028. However, this is a vendor roadmap, not a currently rentable machine.
Impact of the Cost Reduction
The challenge successfully tackled the one barrier an open competition could address, significantly lowering the cost.
However, other issues persist. QSB transactions are nonstandard, meaning they do not relay through the typical mempool and must be sent directly to a miner. Additionally, this construction only protects coins whose public keys have not yet been exposed. A lower grinding cost does not resolve these issues. StarkWare still advocates for a soft fork as a superior long-term solution and is independently working to transition Starknet toward hash-based hashing and Falcon-512 signatures. Notably, QSB does not incorporate any NIST standards, FIPS 204, or FIPS 205, indicating a distinct approach.
Therefore, this development does not render Bitcoin fully quantum-safe. Instead, it makes an emergency option financially viable. While the cost is a moving target, it is currently cheaper than many people’s weekly grocery expenses.