Daily News 19

Tag: Taproot

  • AI Coding Slashes Quantum-Safe Bitcoin Transaction Cost Estimate from $320 to $66 in One Week

    AI Coding Slashes Quantum-Safe Bitcoin Transaction Cost Estimate from $320 to $66 in One Week

    Key Highlights

    • StarkWare has demonstrated a quantum-resistant Bitcoin transaction method that operates within current protocol rules, requiring no soft fork or network upgrade.
    • The approach uses hash-based cryptography to protect against quantum computers deriving private keys from exposed public keys, but costs approximately $320 in computing per transaction under current implementation.
    • Significant limitations remain: transactions must be submitted directly to miners, and the method cannot protect coins whose public keys are already exposed — the primary target for any quantum attacker.

    StarkWare Unveils Quantum-Resistant Bitcoin Transaction Method Without Protocol Changes

    Israeli blockchain scaling firm StarkWare has published research demonstrating a method to execute quantum-resistant transactions on Bitcoin without requiring a soft fork or any modification to the network’s consensus rules. The technique leverages hash-based cryptographic commitments — specifically leveraging the collision resistance of SHA-256 — to shield coins from a future scenario in which a sufficiently powerful quantum computer could derive a private key from an exposed public key using Shor’s algorithm.

    Because the construction fits entirely within Bitcoin’s existing script and transaction validity rules, it can be deployed immediately as an emergency mitigation if the quantum threat materializes before the broader ecosystem adopts a more comprehensive, protocol-level upgrade such as BIP-360 or similar proposals for post-quantum signature schemes. However, the current implementation carries a steep computational price tag: approximately $320 of computing resources per transaction, according to the cost breakdown published by StarkWare.

    Cost Claims and Independent Verification

    A third-party contest site associated with the research cites a lower figure of $66 per transaction, but this number remains an estimate drawn from a test computation and has not been validated by a subsequent transaction actually mined on the Bitcoin mainnet. The improved code referenced by the contest site has not been shown preparing another transaction that was successfully included in a block. Applying the speedups displayed on the contest site to StarkWare’s original $320 cost breakdown yields an estimated $83 per transaction, according to calculations performed by CoinDesk. The contest site states that later record-setting runs surpass those measurements, though it does not disclose which specific results underpin the $66 estimate.

    Operational Constraints Limit Practical Deployment

    Beyond cost, the method imposes structural constraints that reduce its utility as a general-purpose solution. Transactions constructed using this approach must be sent directly to a miner because they do not propagate through the Bitcoin peer-to-peer network in the standard manner. More critically, the protection only applies to coins whose public keys have not yet been exposed on-chain — such as those locked in pay-to-taproot (P2TR) or pay-to-witness-script-hash (P2WSH) outputs where the public key remains hidden until spending. Coins in pay-to-pubkey-hash (P2PKH) or reused pay-to-taproot addresses with revealed public keys — the very cohort a quantum adversary would target first — cannot be secured retroactively by this method.

    Why This Matters

    The research addresses a long-standing theoretical vulnerability in Bitcoin’s elliptic curve cryptography (secp256k1), which secures the vast majority of coins in circulation. While large-scale, fault-tolerant quantum computers capable of breaking ECDSA do not yet exist, advances in quantum error correction and qubit coherence have accelerated expert timelines. The National Institute of Standards and Technology (NIST) has already standardized post-quantum algorithms such as CRYSTALS-Dilithium and SPHINCS+, but integrating them into Bitcoin would require a contentious, multi-year soft fork process with broad miner, developer, and user consensus.

    StarkWare’s hash-based fallback offers a permissionless, immediate escape hatch — but only for a subset of unspent transaction outputs (UTXOs) and at a cost that currently limits use to high-value holdings. The requirement for direct miner submission also introduces trust and censorship considerations. As the ecosystem debates long-term quantum resistance — including proposals for quantum-resistant address formats and commit-reveal schemes — this work establishes a proven, if imperfect, bridge capability.

    Frequently Asked Questions

    Does this method require a Bitcoin soft fork or protocol upgrade?
    No. The construction operates entirely within Bitcoin’s existing consensus and script rules, meaning it can be used today without any network-level changes.
    Can this protect all Bitcoin holdings from a quantum attack?
    No. It only secures coins whose public keys have not yet been revealed on-chain — primarily Taproot and certain Script-based outputs. Coins in legacy P2PKH addresses or reused Taproot addresses with exposed public keys remain vulnerable.
    What is the real-world cost to use this quantum-resistant transaction method?
    StarkWare’s published breakdown estimates ~$320 in compute per transaction. Independent analysis by CoinDesk applying claimed optimizations suggests ~$83, while a contest site cites an unverified $66 figure. No subsequent mainnet transaction has confirmed the lower costs.
  • Bitcoin Unable to Activate Soft Forks Currently, Drivechain Creator States

    Bitcoin Unable to Activate Soft Forks Currently, Drivechain Creator States

    Bitcoin Soft Fork Failures Signal Frozen Upgrade Process, Drivechain Creator Warns

    Bitcoin has not activated a single proposed soft fork since Taproot went live in November 2021, a trend that LayerTwo Labs CEO and Drivechain creator Paul Sztorc says points to a fundamental inability to approve consensus changes for the foreseeable future. Speaking to crypto.news, Sztorc framed the recent collapse of BIP-110 as evidence of a systemic coordination failure that extends well beyond one disputed upgrade.

    “All soft forks since Taproot have failed to activate, and this was no exception,” Sztorc said.

    BIP-110 Collapse Illustrates Miner Signaling Deadlock

    BIP-110, formally known as the Reduced Data Temporary Softfork, sought to impose seven temporary consensus restrictions for roughly one year (52,416 blocks). The rules included an 83-byte cap on OP_RETURN outputs, a 256-byte limit on certain data pushes, and constraints on some Taproot functions. Supporters such as Bitcoin Knots maintainer Luke Dashjr argued the measures would curb arbitrary data storage linked to inscriptions and keep Bitcoin focused on monetary transactions. Critics including Strategy Executive Chairman Michael Saylor and Blockstream co-founder Adam Back countered that the proposal could undermine Bitcoin’s neutrality by rejecting transaction structures the network currently accepts.

    The proposal’s voluntary activation mechanism required 55% of blocks in a difficulty period to signal support. By August 2, that threshold had become mathematically unreachable: only 28 of the first 1,108 blocks had signaled, yielding a support rate of roughly 2.53%. When the mandatory signaling period began at block 961,632 on August 8, nodes enforcing BIP-110 began rejecting non-signaling blocks. Most miners continued building on the dominant chain, causing the minority branch to stall after producing just two blocks.

    By August 9, the minority chain remained frozen at block 961,633 while the main chain advanced 111 blocks. OCEAN’s BIP-110 endpoint showed approximately 257 petahashes per second assigned to the minority branch, while Saylor estimated that 99.85% of Bitcoin’s hash power stayed with the dominant chain. The stall was exacerbated because the minority branch inherited Bitcoin’s mining difficulty of 127.48 trillion; without sufficient computing power, its miners could not quickly produce the blocks needed to trigger a difficulty adjustment.

    Consensus Barrier Extends to OP_CAT and Other Proposals

    Sztorc emphasized that BIP-110 is not an isolated case. Since Taproot activated at block 709,632 via the Speedy Trial process, numerous proposals — including OP_CAT, BIP-360, and others — have remained in discussion without achieving activation. OP_CAT, a 13-line opcode originally present in Bitcoin’s codebase before being disabled by Satoshi Nakamoto in 2010, has garnered developer support for enabling covenants, vaults, and programmable spending conditions. Yet Sztorc argues it faces the same insurmountable coordination hurdle.

    “Nothing can — not even OP_CAT, which is just 13 lines of code and was in the original software and had lots of support,”

    he said when asked how BIP 300 could overcome resistance to consensus changes.

    “Bitcoin cannot activate any soft forks, for the foreseeable future.”

    Other proposals confront identical obstacles. BIP-360 proposes a new output type for post-quantum signatures via soft fork, offering a path for users to migrate funds to quantum-resistant addresses. Its activation would require the same broad network agreement that Sztorc believes Bitcoin can no longer achieve.

    Drivechains Aim to Shift Experimentation Off the Base Layer

    Drivechains, specified in BIP 300 and BIP 301, are designed to let developers test new rules and applications on opt-in sidechains rather than repeatedly seeking changes to Bitcoin’s base layer. Under the two-way peg design, users could move BTC between Bitcoin and independent sidechains, each with its own rules for privacy, smart contracts, faster transactions, or other functions. Sidechains would maintain separate brands and software, similar to existing systems like Liquid and Lightning.

    “Each Drivechain will have its own brand, same as Liquid, Lightning, etc.,”

    Sztorc said, comparing the model to developers launching separate altcoins.

    However, Drivechains themselves require a consensus change on Bitcoin to deploy the proposed withdrawal system. Without activation, BIP 300 cannot move forward.

    “It cannot,”

    Sztorc said when asked how BIP 300 could overcome the resistance that stopped other proposals.

    Miner-Controlled Withdrawals Remain Central Security Debate

    BIP 300 assigns Bitcoin miners a pivotal role in approving withdrawals from Drivechains. Withdrawal requests would remain pending while miners vote through Bitcoin blocks; a request receiving sufficient support over the voting period could release BTC from the sidechain peg. Sztorc argues security depends on the economic value a popular sidechain creates for miners.

    “If the chain is popular, it will be generating fees for miners. If this fee revenue is large, relative to the number of circulating coins on the L2, then it will be secure.”

    Users would need to evaluate the relationship between sidechain fee revenue, miner incentives, and the value of BTC locked in the peg. Critics warn that miners could collude to approve invalid withdrawals, while supporters contend that attacking a profitable sidechain would destroy future fee income and damage system confidence.

    U.S. Mining Operations Highlight Governance Risks

    The BIP-110 episode demonstrated how American mining operations can become directly involved in Bitcoin governance disputes. Foundry USA Pool asked its mining customers to vote on BIP-110 signaling before the mandatory period, while Strategy — a U.S.-listed company and one of the largest corporate Bitcoin holders — publicly opposed the proposal through Saylor.

    The failed fork also created practical risks for holders. Because BIP-110 lacked automatic replay protection, Bitcoin developer Kevin Loaec warned that a transaction sent on one branch could potentially be copied to the other, putting pre-fork coins at risk if users attempted to move or sell assets on the minority chain without first separating them. Meanwhile, BIP-110 supporters prepared code for a possible proof-of-work change that would allow the stalled branch to abandon Bitcoin’s existing mining algorithm, though developer Chris Guida described it as a contingency with no activation date set.

  • Bitcoin’s Latest Mobile Privacy Feature Makes Incoming Transactions Invisible

    Bitcoin’s Latest Mobile Privacy Feature Makes Incoming Transactions Invisible

    Silent Payments Mobile Scanning Bandwidth Measured at 8 MB Daily, but Trust Risks Remain

    A new measurement project indicates that the bandwidth required for mobile wallets to scan for Silent Payments may be manageable, averaging roughly 8 MB per day near the current chain tip. However, the research highlights a more critical challenge: light wallets depend on indexers to deliver complete scanning data, and a single omitted entry can leave a real payment undiscovered.

    How Silent Payments Scanning Works

    Silent Payments, defined in BIP-352, enable a reusable Bitcoin address without exposing an obvious chain of payments. A sender uses the recipient’s public information to derive a fresh Taproot destination. The recipient’s wallet must then scan eligible transactions to find the output belonging to it. For a full node, this data is derived directly from the blockchain. For a light wallet, another source—an indexer—is required.

    Measurement Project Scope and Findings

    The independent project processed every Bitcoin block from height 709,656 through 965,089, an inclusive span of 255,434 blocks from shortly after Taproot activation to September 2026. Its per-block CSV contains the same number of rows with those exact height boundaries.

    Across that history, the complete BlindBit v2 scanning payload totaled 15,079,946,729 bytes, reported as 15.08 GB, averaging 59.0 KB per block. That full-history total describes a restore across the measured range. The daily figure answers a different question: using the average from heights 900,000 through 965,089 and an assumed 144 blocks per day, the project calculates about 8.0 MB for a wallet following the chain near the dataset’s upper end. This does not describe the initial historical download.

    The repository was produced by one independent operator. Its data and scripts are public, and the aggregate row count and payload totals can be checked from the CSV, but a second operator has yet to publish a full rerun. The result speaks to bandwidth volume; it does not measure phone battery use, processor load, storage behavior, or delivery latency.

    Filter-Based Alternative Modeled

    The project also estimates a lighter filter route: about 0.94 GB of modeled Taproot-only filters plus roughly 6.2 GB of raw tweaks yields a 7.14 GB subtotal. The 15.08 GB complete feed is about 2.1 times that subtotal. The filter route then adds a full-block download for every match, including false positives, so its realized traffic varies by wallet activity and match rate.

    The filter component is a model built from exact per-block item counts. Its sizing formula was checked against 21 real filter encodings and landed within about 0.5%, according to the project. A Taproot-only Silent Payments filter has yet to be deployed.

    How an Indexer Can Make a Payment Invisible

    For each eligible transaction, the wallet combines its private scan key with public data derived from the transaction’s inputs. It uses the result to generate candidate output keys and checks whether one appears in the transaction. One server-assisted model keeps matching on the phone and asks a server for public tweaks. This can avoid sharing the private scan key, but the server’s response still needs to be complete. If the one tweak needed for an incoming payment is absent, the wallet generates no matching destination and shows no receipt.

    A Cake Wallet issue opened in July 2025 analyzed how the miss could persist. The reporter wrote that a client may save a later local scan height after receiving incomplete data. If the wallet then treats the earlier range as finished, connecting to a different server would not automatically make it ask for the missing block again. The issue page does not show a maintainer confirmation of that architecture analysis, and it does not document intentional withholding by any server.

    The output itself remains valid on Bitcoin. The recipient’s keys still control it. Discovery can be recovered by rescanning from an earlier height against a complete, honest source or by using a full-node-backed scan. The user-facing danger is silence: the wallet may show a complete sync without signaling that historical data should be revisited.

    Proposed Mitigation: Chained Commitments

    The project proposes chained commitments to each block’s canonical tweak set. Two servers that publish commitments can be compared, and an externally anchored checkpoint can expose later rewriting or equivocation. This creates an audit trail. A first client relying on a single response can still receive an incomplete set before an independent comparison reveals the discrepancy.

    Wallet Implementations Diverge on Trust Models

    The standards picture has two layers. BIP-352’s status is Complete, covering the core Silent Payments protocol. Its light-client appendix still describes privacy-preserving phone support as open research. The new converged light-client document labels itself pre-draft v0.1, with adoption and interoperability work still ahead.

    Wallet developers have meanwhile shipped different server relationships. Sparrow Wallet 2.5.0, released in May 2026, added Silent Payments receiving and automatic selection of a public Frigate server. Frigate describes its design as a Remote Scanner, which performs the matching on server infrastructure with ephemeral client scan keys.

    The work-in-progress index specification maps Cake Esplora to Cake Wallet and lists Dana Wallet, BDK with Kyoto, and BlindBit Desktop as clients around BlindBit Oracle. Dana and Silentium describe their own mobile projects as experimental. Those implementation sources do not claim adoption of the September pre-draft.

    User Choice Extends Beyond Synchronization Speed

    For a user, these designs define more than synchronization speed. A remote scanner can learn which transactions belong to a wallet. A tweak server can keep the private matching work on the phone while leaving the wallet dependent on a complete feed. A personal full-node-backed service shifts both computation and trust onto infrastructure the user controls.

    The measurements make the bandwidth part of that choice look less forbidding. Wider adoption still depends on a second property: a wallet must be able to detect incomplete history before an incoming payment disappears from its view. Silent Payments can hide address reuse on-chain, but phone wallets need safeguards that keep privacy from becoming a new form of server trust.