Two possible solutions to protect the network from quantum computers
The debate about quantum computers and Bitcoin has become much more concrete this year. Eli Ben-Sasson, co-founder of StarkWare and one of the creators of STARK proof, believes that aggregating signatures using ZK STARK proof is the best way to make Bitcoin resistant to quantum computers, while remaining usable by a larger number of users. According to him, the same view is shared by Adam Back, the founder of Blockstream, although Back has not publicly confirmed this so far.
Ben-Sasson was also in the news in July 2026 for a proposal to increase annual Bitcoin inflation to 4 percent, a proposal that was not supported by the majority of the community. When it comes to Bitcoin’s quantum resistance, its position stands on a much firmer foundation because it is one of the creators of the STARK technology itself, and some well-known Bitcoin researchers support this approach. His Starknet project announced a three-phase plan in early July to make the network resistant to quantum computers.
Before we explain the proposals, it is worth explaining why quantum computers pose a risk to Bitcoin in the first place.
Source: cointelegraph
Why do quantum computers pose a risk to Bitcoin in the first place?
A quantum computer does not work in the same way as a conventional processor or GPU in your computer. Instead of treating the data as sequences of zeros and ones, it uses qubits that can represent multiple states at the same time. For certain mathematical problems, quantum algorithms can theoretically provide a significant computational advantage over classical algorithms, including the problems underlying the cryptography used by Bitcoin today.
Bitcoin uses ECDSA and Schnorr signatures, both based on elliptic curves, to sign transactions. A sufficiently powerful quantum computer could use Shor’s algorithm to calculate the private key from the public key and thus take control of the funds. That’s why the whole discussion about quantum risk for Bitcoin really comes down to a signature issue, not a mining issue.
Mining, or hashrate of the entire network, relies on SHA-256 hashing and ASIC devices, so the situation is different. Grover’s algorithm theoretically allows for a quadratic acceleration of the search for a space of possible values, which is why its effect on hash functions is different from that of Shor’s algorithm on elliptic curve cryptography.
There is also a difference within Bitcoin itself. An address whose public key has never been published on the blockchain is theoretically more resilient, because the ECDSA signature itself does not reveal the key to the attacker in advance. Addresses that have already used up funds, as well as older addresses in a format that directly displays the public key, are more exposed because their public key is already visible to everyone.
The addition of ZK proof alone does not make Bitcoin resistant to quantum computers. ZK proofs are a way to solve the problem that arises when much larger post quantum, or PQ signatures, are added to Bitcoin.
In August 2024, NIST validated the first official post-quantum standards:
- ML-KEM for
- ML-DSA key exchange for digital signatures, derived from CRYSTALS-Dilithium
- SLH-DSA as a backup, hash-based signing scheme
It is the ML-DSA scheme that is most often mentioned today as a candidate for post-quantum Bitcoin signatures, and the current PQ signatures are ten to a hundred times larger than the ECDSA and Schnorr signatures that Bitcoin uses today. Some estimate that this could slow down the network to less than one transaction per second.
Marin Ivezić, author of the PostQuantum.com website and founder of Applied Quantum, calculated that the SegWit upgrade already reduces the impact of large signatures by up to 75 percent. According to his model for the NIST ML-DSA-44 scheme, whose signature is 2,420 bytes, the block capacity would drop to approximately 500 to 700 transactions, compared to 2,500 to 3,000 today.
One of the proposed approaches is to aggregate checks of multiple post-quantum signatures into ZK STARK proof. Such an approach could potentially reduce the amount of data required to verify a larger number of signatures, but its actual effect on the capacity and performance of the Bitcoin network would depend on the specific implementation. Ben-Sasson warns that the absence of aggregation using ZK STARK evidence would be a very unfortunate move because it doesn’t really address the question, can all people really use Bitcoin. This, he says, requires mass scalability, and just increasing the block size is not enough without signature aggregation.
Source: cointelegraph
Increase the size of the block
Increasing the block size is one approach considered in discussions about larger post-quantum signatures, but the community was already divided over a similar proposal in 2017, in a debate known as the block size conflict. Some of these arguments are still valid today: a larger block means that each node has to store, store and check much more data, which makes equipment more expensive and, according to critics, pushes the network towards centralization.
In recent months, Blockstream Research has been testing hash-based hash-based post-quantum signature schemes for Bitcoin, under the names SHRINCS and SHRIMPS. Their daily signatures are approximately five times larger than today’s Bitcoin signatures, and they can grow up to 40 times if the user loses access to the wallet and needs to recover it. SHRINCS has already been demonstrated for signing transactions on the Liquid network, while its possible application on the Bitcoin network remains a subject of development and discussion, but development is still in its early stages, with open questions around complexity and practical use.
Ivezic believes that increasing capacity is a simple engineering solution, but a difficult issue of community management, and that there is simply no time for lengthy discussions about it.
Source: cointelegraph
Aggregation of signatures using ZK STARK evidence
A ZK proof is a mathematical way for someone to prove that they know or possess something, without revealing the details themselves. For Bitcoin, this would mean that it is possible to prove that the entire set of transactions in the block is correctly signed, without the need to write each individual signature separately into the block.
Generating ZK evidence for one block technically only needs to be done once, although due to security redundancy it is better to make additional copies. According to Ben-Sasson’s estimation, the equipment needed to generate such evidence could be cheaper than the equipment used for commercial mining. Checking ZK proof is much simpler and can be done on almost any device, including Raspberry Pi.
The specifications of Lean Ethereum provide for proof-generating equipment that costs less than $100,000 and can work in an ordinary household. According to Ben-Sasson, earlier Bitcoin developers like Greg Maxwell and Mike Hearn have always been sympathetic to ZK STARK evidence because they are post quantum resistant and do not require a trusted setup. He also claims that Luke Dashjr and Adam Back are increasingly open to this technology, although the two usually disagree on everything. Neither Back nor Dashjr have commented publicly on this so far.
Justin Drake, a researcher at the Ethereum Foundation, is publicly advocating for Bitcoin to adopt the same proof-of-evidence aggregation technology as Lean Ethereum, in order to become an industry-wide standard. For now, there is no consensus among the Bitcoin community to accept such an approach
Source: cointelegraph
Bitcoin's Transition Plan
While the debate over STARK evidence and block size continues, Bitcoin also received its first formal proposal to defend itself against quantum computers in February 2026. The BIP-360 proposes a new address type called Pay to Merkle Root (P2MR), structurally similar to Taproot, but without the key-to-key spending option that is vulnerable to quantum computers. The proposal was previously called Pay to Quantum Resistant Hash, and it was renamed in the final version. It is compatible with the Lightning network, BitVM, and multisig settings.
BIP-360 was followed in April 2026 by BIP-361, called Post Quantum Migration and Legacy Signature Sunset. It is a three-phase plan to phase out the old ECDSA and Schnorr signatures:
- the first phase, three years after the activation of the new address type, would block new payments to the old, vulnerable addresses
- the second phase, two years later, at the consensus level, would cancel ECDSA and Schnorr spending from all UTXOs considered vulnerable
- the third, still unagreed phase, should allow owners of frozen coins to prove ownership by means of ZK proof associated with a seed phrase, and thus regain access to funds
Inclusion in the BIPs repository only means that the proposal has met formal editorial criteria, not that it has been accepted by the community or that activation is near. The proposal did not go without resistance: Tadge Dryja, a Bitcoin developer and co-author of the Lightning network, believes that the plan in this form is not sustainable because it links the activation of quantum-resistant addresses with the shutdown of old addresses, which, according to him, could permanently endanger funds before a quantum attack even occurs.
According to the authors of BIP-361, including Jameson Lopp of Casa, on March 1, 2026, more than 34 percent of all Bitcoins were located at addresses whose public key is already visible on the blockchain, which theoretically makes these coins the first target in the event of a quantum attack. Ethan Heilman, co-author of both proposals, estimates that a full migration of Bitcoin to quantum resilience would take seven years from the time the community reaches an agreement. BIP-360, meanwhile, is being tested on the Bitcoin Quantum testnet, which was launched in early 2026 by BTQ Technologies.
Source: cointelegraph
OP_CAT and other technical options.
Given how conservative the Bitcoin community is, One approach being considered to enable the more advanced functionalities required for ZK proofs is the reintroduction of OP_CAT. According to Ben-Sasson, with OP_CAT it becomes possible to add STARK proofs, aggregation, and post quantum resistance.
OP_CAT caused a lot of interest from the community a year or two ago, but it seems that this interest has subsided a bit lately, although in Bitcoin governance things can change without notice. There are also more speculative proposals, such as OP_STARK_VERIFY, which would add an opcode to more efficiently verify STARK proof directly in a Bitcoin script, and BitZip, Ethan Heilman’s proposal to aggregate signatures and public keys into a single STARK proof.
Heilman explained earlier this year that there are two main directions for solving the problem. The first is to add a series of general opcodes to Bitcoin to build something like a ZK rollup within the network itself, and the second is to directly support the STARK evidence at the Bitcoin consensus level. As an alternative, he also mentions less demanding aggregation schemes, such as CISA, or Cross Input Signature Aggregation.
Source: cointelegraph
How realistic is it that all this will happen?
According to Ivezic, the obstacle is not cryptography but the management of the Bitcoin network. He says that Ben-Sasson’s cryptography is very solid, based solely on hash assumptions, without a trusted setup, and thousands of signatures can be squeezed into one small piece of evidence. The problem, he adds, is everything that surrounds this cryptography.
Bitcoin Script cannot currently verify STARK proof, as well as the production verifier presents a much larger consensus change than a narrow, specialized opcode for hash signatures. Ivezic adds that given that even a small opcode like OP_CAT has been under discussion for years, he estimates that the discussion about a STARK proof verifier on Bitcoin’s base layer could only become topical during the 2030s.
In comparison, Ethereum is aiming for a transition to post quantum cryptography by 2029, and Solana is also testing the addition of post quantum signatures. Starknet’s three-phase plan has the advantage of relying on account abstraction, a technology that allows you to upgrade cryptography without each user manually transferring funds to a new account. According to Ben-Sasson, the post-quantum transition for Solana and Ethereum could be “extremely difficult” because of this, while Starknet, he says, already has built-in account abstraction and smart wallets, so the infrastructure is easy to upgrade.
Source: cointelegraph
How close is the so-called Q-day?
The question that most readers are asking themselves at this point is how urgent all this really is. In March 2026, Google published a paper according to which less than 500,000 physical qubits could be enough to crack the cryptography that protects Bitcoin and Ethereum, which is about 20 times less than previous estimates. According to Google researchers, a sufficiently powerful quantum computer could calculate a single Bitcoin private key in about nine minutes, but such a computer does not exist for now.
Justin Drake, one of the co-authors of the paper, estimates a 10 percent chance that a quantum computer will calculate the private key for secp256k1 ECDSA from the exposed public key by 2032.
For comparison, Google’s currently most powerful chip Willow has 105 qubits, while IBM’s Condor has exceeded 1,121 qubits, although the number of qubits alone does not say much because quality and error rate are equally important. A real attack on Bitcoin cryptography requires so-called logical qubits, i.e. qubits with error correction, and there are only about a hundred of them in the best systems today. The difference between existing machines and what would be needed is still measured in hundreds of times.
Experts’ estimates still vary widely: some speak of the early 2030s, others of the mid-century, and the estimates themselves have been rapidly shortening in recent months. The UK’s NCSC has set deadlines for migration to post-quantum cryptography for 2028, 2031 and 2035, while federal agencies in the US aim to complete the transition by 2035. Bitcoin and Ethereum, in this sense, are only part of a wider wave of preparations involving governments, banks and national cybersecurity agencies.
Source: cointelegraph
Bitcoin community is just building a deal
Bitcoin today is not exposed to a quantum attack because a computer powerful enough to crack ECDSA signatures does not even exist in the laboratory yet. What is really happening is that developers, researchers, and companies like BTQ Technologies are testing multiple technical directions in parallel: larger blocks, STARK aggregation, new address formats, and plans to shut down old signatures.
The debate over BIP-360 and BIP-361 shows that there is no agreement on a final solution yet, as well as an agreement on whether old, vulnerable coins should be frozen at some point. Only one thing is clear for now: the topic of Bitcoin’s quantum resilience has moved from a theoretical discussion to a concrete engineering and political process within the community.