Open challenge cuts GPU cost of a quantum-safe bitcoin spend to about $67
Serguey Asael Shinder2 min readA quantum-safe Bitcoin transaction built with the QSB construction now costs about $67 in GPU compute, down from about $320, according to StarkWare, which reports the result of the first week of the Quantum-Safe Bitcoin Optimization Challenge it runs with Yukon Research and Eigen Labs. The first such transaction was mined on mainnet about a month ago and took roughly 3,100 GPU-hours to build.
The cost is a brute-force search, not a fee. QSB puts a hash where Bitcoin expects a signature: it derives a public key from the transaction, hashes it with RIPEMD-160, and places the 20 bytes in the signature slot. Because Bitcoin checks that a signature is DER-encoded before anything else, those bytes must happen to look like a valid DER signature - which, per StarkWare, only about one hash output in 70 trillion does. The only way to find one is to vary the input and hash again, on your own hardware, before anything reaches the network.
The challenge attacks that search in public. Each verified improvement becomes the new baseline for everyone else, and every submission is re-derived on a CPU reference implementation so that a kernel which skips work is rejected. After a week, transaction pinning runs at just over 820 million verified candidates per second on the benchmark RTX 4090, up from 146 million, and subset selection is a little over ten times faster, with 62 accepted submissions from 23 and 17 solvers on the two tracks. StarkWare notes that the leading entries on 23 September were produced by developers working with AI coding models.
What it means
The number moves QSB from demonstration toward emergency tool. At a few hundred dollars per spend, protecting coins this way was a stunt; at tens of dollars it becomes a plausible option for a holder with a large balance whose public key has never been exposed on-chain.
StarkWare is explicit about the limits, and they matter more than the headline. QSB transactions are nonstandard, so they do not relay through the normal mempool and must be sent to a miner directly. The construction protects only coins whose public key is still hidden. The $67 is an estimate from a benchmark under stated hardware assumptions, not a price. And the hash it relies on weakens under Grover's algorithm - the QSB paper puts second-preimage security at about 118 bits, roughly 59 under a Grover reduction. The company itself still considers a soft fork the better long-term answer; QSB is what exists under today's rules while that debate continues.