Bitcoin Quantum Prototypes Work Without Changing the Protocol

What Happened

On April 10, two Bitcoin developers published working implementations addressing different aspects of the post-quantum problem — neither requiring changes to Bitcoin's existing protocol. Lightning Labs CTO Olaoluwa Osuntokun posted a zk-STARK-based prototype to the Bitcoin developer mailing list.

StarkWare's Avihu Levy published QSB. Both are proofs of concept demonstrating that quantum-safe Bitcoin transactions are buildable with existing infrastructure.

The technical path to quantum-safe Bitcoin now has working code. The governance path does not.

Osuntokun's zk-STARK Prototype

Osuntokun's design targets a specific emergency scenario: what happens to Taproot-address coin holders if Bitcoin's network disables Taproot key-path spending as a quantum defense? Taproot addresses expose public keys by default. If the network needed to close that spending path, holders would need an alternative way to prove ownership and migrate — without revealing their private key in the process.

A zero-knowledge proof lets a prover demonstrate knowledge of a secret without revealing it. Osuntokun used zk-STARKs — post-quantum secure, unlike zk-SNARKs which rely on elliptic-curve pairings — to construct an ownership proof that works even if the standard Taproot spending path is closed.

The prototype is a rescue mechanism: a path for exposed-address coin holders to prove their keys and migrate to a quantum-safe format under adversarial conditions.

Levy's QSB: No Protocol Changes Required

Levy took a different approach. Rather than designing a new address type requiring a Bitcoin upgrade, he constructed a quantum-safe transaction scheme entirely within Bitcoin's existing legacy script operations. Bitcoin Script has a specific, limited set of opcodes. Levy demonstrated those opcodes, as they already exist on mainnet, are sufficient to construct a transaction that does not rely on elliptic-curve signatures for security.

QSB is deployable today — not easily, not efficiently at scale, and not in a form that would work broadly without engineering work. But the cryptographic possibility is demonstrated using the current network. No governance debate, no activation threshold, no coordination required for the underlying proof.

What This Means for You

Neither prototype changes your immediate security posture. They are not production tools. What they change is the framing of the governance problem. The argument that Bitcoin cannot respond to quantum threats because the technical solutions require too many changes gets harder to sustain when individual developers produce working implementations within days of a paper triggering community concern.

The bottleneck is not cryptographic capability. It is coordinating a decentralized network of operators, miners, wallet developers, and node runners around a shared migration timeline — before the threat window closes. The prototypes sharpen the urgency of that coordination problem by proving the technical path is not the limiting factor.

What to Watch

Watch for peer review and community response to both implementations on the Bitcoin developer mailing list. Watch for whether Blockstream's Liquid network post-quantum experiments produce published results that can inform the mainnet conversation. The next milestone that matters is moving from individual proofs of concept to a coordinated multi-team review process — the same kind of process Ethereum has had running for eight years.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.