StarkWare's AI Coding Contest Cuts a Quantum-Safe Bitcoin Transaction From $320 to $66

TL;DR

On September 16, StarkWare, Yukon Research and Eigen Labs opened the Quantum-Safe Bitcoin Optimization Challenge, a public leaderboard for the GPU brute-force search behind a quantum-resistant Bitcoin transaction, with a prize pool above $20,000 and an explicit invitation to AI agents. One week later, StarkWare's September 23 update counts 62 promoted submissions across two tracks, a 6x faster pinning kernel, a 10x faster subset search, and an estimated cost per transaction down from about $320 to $66. Every row on the leaderboard names the model the solver ran, and the top three pinning entries on the evening of September 23 were two GPT-6 Astra runs and one Opus 5 run. The $66 is an estimate under stated assumptions, and a stricter reading of the dashboard's own numbers lands nearer $83.

The $320 transaction

Bitcoin signs with ECDSA and Schnorr, both elliptic-curve schemes, and Shor's algorithm on a large enough quantum computer breaks both. StarkWare researcher Avihu Levy's Quantum-Safe Bitcoin (QSB) design, published in April, sidesteps the curve without a soft fork: it puts a hash where Bitcoin expects a signature, so the coins end up protected by a hash function, which quantum computers weaken rather than break. The catch is that a hash with the right shape has to be found by brute force, on your own GPUs, before anything touches the network.

On August 26 StarkWare mined the first QSB transaction on mainnet, with engineering from Tomer Giladi, handed straight to a miner through MARA's Slipstream because ordinary nodes will not relay a transaction shaped like this, per Cointelegraph. The public repo had estimated $75 to $150 in cloud GPU compute. The real thing took roughly 3,100 GPU-hours and about $320, which is the kind of estimate anyone who has ever priced a cloud GPU job will recognize.

Why a hash search is the whole bill

The mechanism deserves one paragraph because the entire contest hangs on it. QSB takes a public key derived from the transaction, hashes it with RIPEMD-160, and drops the resulting 20 bytes into the slot where a signature would go. Bitcoin checks that a signature is in DER format before it does anything else, so those 20 bytes must happen to parse as a valid DER signature or the script fails. StarkWare puts the odds at about one in 70 trillion hash outputs, roughly 2^46 tries. Nothing lets you steer a hash toward a shape, so the only move is: change an input, hash, check, repeat. Think of it as rolling a 70-trillion-sided die until it lands on a face that looks like a signature. You cannot load the die; you can only roll faster.

The construction needs that search more than once. The repo describes a pinning search over (sequence, locktime) pairs plus two "digest rounds" that search subsets of dummy signatures, each around 2^46 candidates. Those are the challenge's two tracks, transaction pinning and subset selection. Since the search runs on your hardware rather than on the network, it never appears as a Bitcoin fee. It appears as a GPU invoice, and doubling candidates per second halves the invoice.

One week, 62 promoted submissions

StarkWare's numbers as of September 23: transaction pinning went from 146.09 million verified candidates per second on the benchmark RTX 4090 to just over 820 million, and subset selection from about 62 million to 623,518,629, a little over 10x. Across both tracks, 23 solvers on pinning and 17 on subset selection landed 62 promoted submissions. The leaderboard has since moved again. By 20:43 UTC on September 23 the pinning record stood at 881,273,403 candidates per second, a 6x gain over baseline, with 34 promoted pinning submissions from 24 solvers.

The shape of the curve is the interesting part. The pinning record crawled from 146 million to 249 million over the opening day, then a solver logged as running Kimi K3 posted a single submission at 644.5 million on the evening of September 16, a 270.66% jump that is still the largest on the board. Everything since has been sanding: 27 further promotions of between 0.45% and 20.81% each, adding up to another 37% over six days. That is exactly how the contest is built to behave, because each verified improvement is published and becomes the new floor, so the next entrant starts from the best known kernel rather than from scratch.

Who is doing the grinding

Every leaderboard row carries the model its solver ran. StarkWare's update says the two records on September 23 were held by developers running Anthropic's Opus 5 and Fable 5.1, with OpenAI's GPT-6 Astra and GPT-5.6, xAI's Grok 4.6 and Moonshot's Kimi close behind. By the time the post was a few hours old, two GPT-6 Astra submissions had taken the pinning record from the Opus 5 run at 826.9 million, first to 850.9 million and then to 881.3 million. The subset record, at 623.5 million, still belonged to the Fable 5.1 run when we checked. Writing a blog post about a live leaderboard has an obvious hazard, and yes, this article has the same one.

Counting the 32 promoted pinning runs visible on the board gives a rough census of which agents people bring to a CUDA problem: 15 logged an OpenAI model (six GPT-6 Astra, five GPT-5.6 Sol, one GPT-5, three unspecified GPT), ten logged Anthropic (eight Opus 5, two Fable 5.1), three DeepSeek-V4 variants, two Grok, one Kimi K3 and one Muse Spark 1.3. Model labels are whatever the solver entered, so treat this as self-report, not telemetry. One solver, ercumentyildirim, accounts for five Opus 5 promotions on their own, two of them tagged as running two Opus 5 instances at once.

The part you can copy

The contest design matters more to a builder than the Bitcoin angle. Yukon is a platform for exactly this kind of "open-frontier" challenge, where a researcher posts a benchmark and a network of humans and agents attacks it. Its roster includes ECDSA.fail (smaller quantum circuits against elliptic-curve signatures), cuda.fast (speculative decoding for Qwen 3.8 Flash Next), MLX.fast (open-model inference on Apple silicon) and SNARK.fast. StarkWare says ECDSA.fail, run on the same model over two months, cut Google's March estimate for the arithmetic behind a quantum attack on elliptic curves by more than half.

Three mechanics carry the QSB challenge:

• Verification is adversarial to speed. Every submission is re-derived on a CPU reference implementation and checked against the expected result, so a kernel that gets faster by skipping work is rejected. Timing runs on the platform's clock against inputs the solver never saw, which closes the two ways an agent usually "wins" a benchmark.
• The floor ratchets. A promoted kernel is published, and the next solver starts from it. Nobody needs to understand the full system; they need to find one more percent in SHA-256 scheduling, secp256k1 scalar multiplication, batch inversion, register pressure, memory traffic or occupancy, which is StarkWare's own list of open targets.
• Prizes are windowed. Week one ran on its own pool (Crypto Briefing reported $2,000 of the $20,000-plus total) and does not count toward what comes next. A 3% improvement now qualifies you for the raffle, and you can tune the existing kernel or throw it away, as long as the interface stays fixed.

If you run an inference stack, a proof system, or anything with a hot kernel and a reference implementation, that recipe ports directly. The leaderboard also tells you which agents people reach for when the job is CUDA rather than CRUD.

$66, $67 or $83

StarkWare's post says $67 and the dashboard says $66; the difference is the record moving. The better question is how either number is built. The dashboard breaks the August cost into $15 for pinning, $80 for digest round one, $200 for round two and $25 unallocated, and it measures speedups on a simulated fleet of 100 RTX 3090s over 1,200 seconds: pinning 4.01x faster, subset 5.16x faster. Apply those to the breakdown and you get about $83, which is the figure CoinDesk arrived at too. The $66 comes from the dashboard's note that "later 4090 record gains extend from the measurement cutoff" and that the digest rounds "use the subset gain until confirmed." So the headline number leans on extrapolating the 4090 records that landed after the 3090 measurement, on top of a $25 slice that no speedup touches.

StarkWare is upfront that this is "an estimate under stated hardware assumptions, not a price," that the benchmark reproduces the grinding core and builds no Bitcoin transactions, and that a benchmark speedup still has to be confirmed against the production implementation. No second mainnet transaction has been mined at the new cost. The other limits have not moved at all: QSB transactions are nonstandard and need a miner willing to take them directly, the construction only protects coins whose public key has never been exposed, and the QSB paper's 118-bit second-preimage security drops to about 59 bits under a rough Grover reduction. StarkWare still says a soft fork is the right long-term answer; QSB is what exists under today's rules while that argument runs.

Key Takeaways

• A one-week public optimization contest cut the estimated GPU cost of a quantum-safe Bitcoin transaction from about $320 to $66, per StarkWare and the qsb.fast dashboard, with 62 promoted submissions across two tracks.
• Pinning throughput rose from 146.09 million to 881.3 million verified candidates per second on an RTX 4090 (6x); subset selection rose from about 62 million to 623.5 million (10x).
• Solvers log the model they ran: the top three pinning entries were two GPT-6 Astra runs and one Opus 5 run, and the largest single jump (+270.66%) was a Kimi K3 run on day one.
• The design is the reusable part: CPU reference re-derivation, platform-clock timing on unseen inputs, a published ratcheting floor, and windowed prize pools.
• Applying the dashboard's own 3090 speedups to its cost breakdown gives about $83; the $66 extrapolates later 4090 records. No second transaction has been mined at the new price.
• Cost was the barrier a contest could attack. Nonstandard relay, exposed-key coverage and 59-bit Grover security are unchanged.

Sources: StarkWare: AI research competition cut Quantum-Safe Bitcoin costs by 79% in a week, qsb.fast challenge dashboard and leaderboard, Quantum-Safe-Bitcoin-Transactions on GitHub, Yukon Research, Crypto Briefing: challenge launch, CoinDesk, Cointelegraph