StarkWare put a quantum-safe bitcoin spend on mainnet, and priced it at $75 to $150

Fitting inside 201 non-push opcodes and 10,000 bytes of legacy Script ^[4] is the load-bearing engineering choice here, because it routes around the slowest component of Bitcoin, which is agreement. The price of the detour is that expenses a soft fork would have spread across the network instead land on the individual spender, as $75 to $150 of off-chain computation per transaction on Crypto Briefing's estimate ^[15].

Set that against balance size. At the top of the quoted range, a single transaction costs 1.5 percent of a $10,000 position and 0.0015 percent of a $10 million one ^[14]. The same dollar figure is either a wealth tax or a rounding error depending on whose coins are moving, which is why the source calls it impractical for small amounts ^[10] and tolerable for seven- and eight-figure wallets ^[11]. The range itself spans a factor of two ^[16], which is what a cost estimate looks like before anyone has run the thing at volume.

The confirmation path deserves more attention than the cryptography. QSB transactions are nonstandard and will not be relayed by ordinary nodes in the usual way ^[5], so this one reached a miner through MARA Slipstream, a service built to carry nonstandard transactions past mempool relay constraints ^[7]. The signature scheme no longer leans on secp256k1 ^[6][3], but the spend does lean on a commercial route to hashpower. A holder buying quantum insurance is therefore buying two things at once, and only one of them is mathematics.

On the mathematics, the claim is a number rather than a guarantee of longevity: roughly 118-bit second pre-image resistance ^[12], built on Lamport-style hash-based signatures over RIPEMD-160 ^[3]. That replaces a weakness with a known shape, Shor's algorithm against elliptic curves ^[6], with a margin that has to hold for as long as the coins sit still.

StarkWare is running both tracks, and says so. Its June 2026 post-quantum roadmap for Starknet included collaborative work on BIP 360, a proposal for quantum-resistant address formats ^[13], which is the consensus route QSB was designed to avoid needing. Chief executive Eli Ben-Sasson described QSB itself as a "passion project" showing holders can protect assets now, at a cost, without waiting for protocol changes ^[8]. That is not the language of a product line, and the two-track behaviour reads as a company treating the no-fork path as cover for people who cannot wait rather than a substitute for the fork. The useful detail is that Avihu Levy, StarkWare's general manager of applications, published the concept with an open-source implementation in April 2026, with a colleague contributing and Robin Linus's Binohash work informing the design ^[2][9]. Cutting the overhead and making these transactions relay-compatible is now an engineering agenda anyone can pick up ^[17], which is the difference between a roadmap and a single transaction ID.