Seven days. Sixty-two qualifying submissions. One number that escaped the lab and went everywhere: 79%.
Between the launch of StarkWare's Quantum-Safe Bitcoin optimization contest and its close, the estimated cost of the off-chain hash preimage search — the step that lets a Bitcoin holder spend coins using a hash-based "emergency signature" — fell from roughly $320 to $67. The pinning routine moved from 146 million preimages per second to 881 million on a single RTX 4090. A subset-selection step cut the candidate space by more than tenfold. Every submission was re-run on a CPU and validated before it was counted, which is more verification than most leaderboards bother with.
Then there is the number that did not make the headline. The single August 2025 transaction that proved the concept paid 5,179 satoshis in network fees — about $4 at the time. That $4 is not inside the $67. It is not inside the 79%. And it is not the last cost a real user would face.
Context
QSB is not a Bitcoin upgrade. It does not touch consensus rules. It does not require a soft fork. It does not change a line of Bitcoin Core. It is a method, published in April 2025 by Avihu Levy at StarkWare, for constructing a transaction whose signature is replaced by a hash preimage that the network's existing validation rules will still accept. The expensive work happens off-chain, in a brute-force search for a hash that happens to have the shape of a valid Bitcoin signature. Miners must include the result directly; it cannot propagate through the standard mempool.
The contest was co-run by StarkWare, Eigen Labs, and Yukon Research, with $20,000 in cash plus a separate Yukon award. No token. No points. No airdrop. The format is modeled on ECDSA.fail, the public leaderboard where researchers cut the estimated quantum cost of attacking one step of Bitcoin's ECDSA by 86% — an attack-side benchmark, now mirrored on the defensive side. Both contests measure the same thing from opposite ends: the cost of computing a preimage under legacy Bitcoin rules.
StarkWare is explicit that the long-term solution is a soft fork — native quantum-resistant addresses, the BIP-360 and P2QRH family. QSB is positioned as the cheap thing you keep on the shelf in case the shelf is needed before the renovation is finished. That framing is honest, and it also caps the technology's commercial lifespan by design.
Core
Strip the language away and QSB is a proof-of-work scheme wearing a signature's clothing. The binding constraint is not the hardness of a cryptographic primitive. It is the price of the silicon that searches for a preimage whose hash happens to validate under Bitcoin's legacy script rules. In first-principles terms: you are not breaking cryptography, you are buying hashrate until the network agrees with you.
That reframing matters, because the "79% cost reduction" is a GPU-economics result, not a cryptography result. The contest's own hardware assumptions — a hundred RTX 3090s modeled as a cluster — confirm the framing. Cheaper GPUs, or better search heuristics, lower the number. Neither changes the security model.
The cost basis is also incomplete in a way that flatters the result. The $67 estimate covers GPU compute. It does not cover the network fee, which the August transaction showed is real but small. It does not cover the operational cost of getting a miner to include a non-standard transaction directly, bypassing the mempool entirely. And it does not cover the search's dependence on a target whose public key has never been exposed.
That last constraint is the one no optimization contest can fix. QSB protects coins whose public keys have not yet been revealed on-chain. Any address that has ever spent has already exposed its key. By any reasonable measure, that is most of the economically active supply. The protection surface of QSB is therefore a subset of the UTXO set that shrinks through ordinary usage, not through an attacker's action. You cannot optimize your way out of a coverage limit defined by the user's own transaction history.
There is a structural issue on the delivery side, too. Because the transaction cannot propagate through the standard mempool, it must be handed to a miner directly. The protocol will validate it. The miner decides whether to look. Code is law, but man is the loophole. In practice that creates a permissioned lane for a transaction class that is supposed to be a trust-minimized emergency fallback — a permissioned lane is a strange place to put your last-resort exit. For compliance teams operating under MiCA's transfer-of-funds expectations, a lane that bypasses standard propagation is a surveillance gap that will eventually be named.
I have seen this pattern before. In 2020 I built a Python model to stress-test Aave's liquidity pools against a 50% ETH drawdown, and the part that broke first was not the interest-rate curve. It was the operational assumption that someone would always be willing to liquidate at the moment liquidation was needed most. QSB has the same shape of dependency: mathematically valid, operationally contingent.
The AI angle deserves its own paragraph, with a caveat. The contest write-ups reference submissions driven by models named Opus 5, Fable 5.1, and GPT-6 Astra. I could not verify those version names against any public model release schedule I track, so treat them as speculative until a primary source confirms them. The underlying signal — that a meaningful share of marginal optimization work in a cryptography contest is now agentic — is plausible and consequential. If AI tools can search a code-optimization space faster than a human researcher, the next round of these contests will be decided less by cryptographic insight and more by model capability and GPU access. The research agenda shifts from who understands the math to who controls the compute and the model endpoint.
A calibration exercise, in code:
# End-to-end cost sketch, QSB emergency spend
gpu_cost = 67 # contest estimate, compute only
fee_sats = 5179 # August 2025 observed
btc_price = 95000 # assumed
fee_usd = fee_sats / 1e8 * btc_price # ~$4.9
ops_cost = 25 # miner direct-inclusion, unmodeled
total = gpu_cost + fee_usd + ops_cost
print(round(total, 2)) # ~$96.9, before the model misses a variableThe point is not the exact total. The point is that every end-to-end estimate is larger than the headline, and the headline is what the market reads.
Contrarian
Here is the uncomfortable part. The same research that produced a 79% defensive cost cut sits next to ECDSA.fail's 86% offensive cost cut. Both numbers are published. Both are true. Only one of them will trend.
Quantum FUD is a self-reinforcing loop. An optimization contest lowers the cost of defense, the press frames it as Bitcoin quantum-proofed, a skeptical thread points out that attack costs fell further, and the net effect on sentiment is negative. The narrative absorbs the good news and converts it into a reminder that the threat exists. This is not irrational — it is the correct response to a tail risk with no expiry date. It is also why I do not expect QSB to move any price. In a sideways tape, quantum safety is a governance concern for custodians, not a catalyst for spot flows. I keep a running correlation matrix of BTC against Fed funds futures, 10-year real yields, and the dollar index. Quantum research does not appear in it, and it will not until a logical-qubit milestone forces the column into existence.
The more interesting contrarian read is about StarkWare's actual product. QSB's commercial life is bounded by the soft fork it is designed to precede. StarkWare knows this — it says so. What the contest actually buys is brand equity in the Bitcoin infrastructure stack, from a team that built its reputation on ZK-Rollups. Code is law, but man is the loophole — and the loophole now has a GPU and a model endpoint. That is a strategic repositioning, not a product roadmap, and it should be priced as such.
Takeaway
Watch three signals, none of them the 79%. Whether StarkWare publishes a production implementation of QSB, because a benchmark is not a tool. Whether BIP-360 or its cousins enter formal Bitcoin Core discussion, because that is the ceiling on QSB's relevance. And whether a quantum-computing milestone crosses a threshold that turns a slow narrative into a fast one.
The question is not whether emergency quantum insurance gets cheaper. It will. The question is whether cheaper becomes usable — and whether the soft fork arrives first and makes the whole exercise academic. Code is law, but man is the loophole. The soft fork is where the loophole gets closed on purpose.
