An open software challenge has cut the estimated GPU-computing cost of building a quantum-safe Bitcoin transaction to about $67, down from roughly $320 a month ago, according to StarkWare and its partners.
The Quantum-Safe Bitcoin Optimization Challenge, run by StarkWare, Yukon Research and Eigen Labs, asks developers and AI systems to make a specialized brute-force search faster. The search is used to construct a transaction that can operate under Bitcoin’s current consensus rules while avoiding the elliptic-curve signatures that a sufficiently capable quantum computer could break.
The first such transaction was mined on Bitcoin’s main network last month. Producing it required about 3,100 GPU-hours and carried an estimated computing cost of $320. One week after the public challenge opened, the dashboard estimated that cost had fallen by close to 80%.
The improvement comes from faster code, not a change to Bitcoin itself. The costly work occurs before a transaction reaches the network, when a computer repeatedly changes an input, calculates a hash and checks whether the output has a required form.
Quantum-Safe Bitcoin
The construction places a hash output where Bitcoin expects a signature. Bitcoin first checks whether a signature follows the required DER encoding format, a longstanding set of rules for representing cryptographic signatures. A 20-byte hash output must therefore happen to resemble a valid DER signature before the transaction can proceed.
Only about one out of every 70 trillion hash outputs has the necessary structure, according to the challenge materials. Because hash functions cannot be directed toward a desired output, participants must test vast numbers of possibilities until they find one that works.
The transaction-pinning benchmark now processes more than 820 million verified candidates a second on an Nvidia RTX 4090 graphics card, up from a baseline of about 146 million candidates per second. In a separate subset-selection task, performance rose from about 62 million candidates per second to more than 623 million.
The challenge had recorded 62 promoted submissions as of Sept. 23. Twenty-three solvers were participating in the pinning track and 17 in subset selection. The public leaderboard showed records held by developers using Opus 5 and Fable 5.1, with systems including GPT-6 Astra, GPT-5.6, Grok 4.6 and Kimi also near the top.
Each verified improvement is published, allowing later entrants to build from the current best result. But participants cannot simply report a faster figure. The platform re-derives each submission through a CPU-based reference implementation and tests it against expected outputs, rejecting code that gains speed by omitting required calculations. It also measures performance against inputs the submitter has not seen.
The resulting cost estimate is not a Bitcoin fee and does not reflect the price of submitting a transaction to the network. It represents the estimated electricity and computing expense of running the search on the benchmark hardware.
Importantly, the transactions are nonstandard, meaning they do not circulate through Bitcoin’s normal transaction relay network and must be sent directly to a miner. They can protect only coins whose public keys have not already been exposed.
StarkWare said it considers a Bitcoin soft fork, or a backward-compatible protocol upgrade, the better long-term route for broad protection. The challenge instead focuses on an emergency option that can work under current rules.
The need for quantum-safe Bitcoin arises because quantum computers pose a particular risk to Bitcoin’s ECDSA and Schnorr signature systems. Shor’s algorithm could, in principle, use a large quantum machine to derive private keys from exposed public keys. The challenge construction relies on hashes, which are affected less severely by known quantum algorithms.
Still, the quantum-safe bitcoin challenge materials estimate that the construction’s second-preimage security could fall from about 118 bits to about 59 bits under a rough application of Grover’s algorithm, which speeds up hash searching. That leaves a substantial security margin today, but one that would need reassessment as quantum hardware develops.
