On 27 August 2026, StarkWare researcher Avihu Levy landed a quantum-resistant Bitcoin spend in block 964,199, moving a 10,000-satoshi output with Quantum Safe Bitcoin, a scheme combining hash-based one-time signatures with a computational search that binds the authorisation to one specific transaction. No fork. No new opcode. Just existing Bitcoin, used unusually hard.
It cost around $150 to $200 and took hours of computation, which is what the headlines led with. The interesting part sits in StarkWare’s own write-up: the transaction was nonstandard under Bitcoin Core’s default relay policy, so ordinary nodes would not propagate it. To get on-chain at all, it went straight to a miner through MARA’s Slipstream service.
A perfectly valid Bitcoin transaction. Consensus-legal. Confirmed in a block you can go and read right now. And it needed a phone number.
TL;DR
- StarkWare’s quantum-resistant Bitcoin spend confirmed in block 964,199 on 27 August 2026, but it was nonstandard under default relay policy, so no ordinary node would carry it and it went straight to a miner via MARA’s Slipstream.
- Every on-chain action clears two gates: is it valid (consensus, published, checkable by anyone) and will anyone carry it (relay policy, per-operator, discretionary, changed without a vote).
- Provable fairness describes only what happens after the second gate opens. A VRF proof says nothing about whether your transaction ever reached the chain.
- In crypto gaming the gate hides in claim-and-withdraw flows, single-sequencer L2s, and the operator’s own RPC endpoint.
- Verification survives the gate; action does not. You can check a draw from a hostile laptop in four years, but you cannot enter or exit unless somebody carries you.
Two gates, one of them documented
Crypto talks about validity constantly and about carriage almost never. Validity is the glamorous half: rules written down, enforced by every node, identical for everyone, changed only by something resembling a vote. Whether a valid transaction actually gets relayed and proposed is decided by policy, and policy is not consensus.
Policy is a per-node default. It exists for good reasons, keeping the network clear of perfectly legal nonsense, but from where a user stands it is an unwritten permission layer that nobody voted on and that can differ between the node you are shouting into and the miner who builds the block. When it refuses, it does not refuse loudly. Your transaction goes nowhere and nothing owes you an explanation. The gate is invisible to almost everyone because almost everyone is standard. It has not gone away. It has just never closed on you.
StarkWare’s experiment is a rare, honest instance of the gate closing on something legitimate. Levy called QSB a last resort rather than a replacement for protocol-level protection, and CEO Eli Ben-Sasson said plainly that a soft fork should happen. Both are right. But the demo proved a second thing nobody was asking about: the distance between “this is allowed” and “this will be carried” can be a commercial relationship with a mining pool.
What this looks like in a casino
“Provably fair” is a claim about one component sold as a claim about a product, and this is the thirty-sixth unasked half of fairness: the transaction nobody would carry. Cryptographic verification covers what the contract did once your transaction arrived; it is silent on arrival. Three places that bites.
The claim you cannot submit. Plenty of platforms resolve a game and then require a second user transaction to collect: claim, withdraw, harvest, whatever the button says. That is a fresh trip through the gate, taken at the exact moment the operator has the strongest reason to prefer you did not make it. The proof of the draw is untouched and beside the point. You won, verifiably, and the winnings sit behind a door you must be let through.
The single sequencer. Most on-chain gaming, ours included, runs on an L2 where one company orders transactions. That is not consensus censorship. It is a business with a compliance function and an address-screening vendor. Your right to play lives in a contract that cannot be changed; your ability to reach that contract lives in somebody’s terms of service.
The RPC in front of everything. Almost no player runs a node. They touch an endpoint, usually one the operator chose and often one the operator pays for. That is a third gate, and unlike the other two it is the one the house controls directly. A front end that quietly declines to build your transaction is indistinguishable, from the user’s chair, from a busy network.
The asymmetry worth naming
Here is the property that makes verification worth defending anyway: checking is unstoppable, acting is not. A VRF proof can be verified by a stranger, offline, years later, hostile to everybody involved, with no account and no permission. Nothing about that check passes a gate, because reading a chain asks nothing of the people who run it. Writing is the opposite: every deposit, entry and exit is a request to be carried, refusable by a party who owes you no notice.
So the honest shape of a fairness claim is narrower than the marketing. Cryptography can make the outcome unarguable. It cannot make your access unconditional. Different problems, and only one of them is finished.
Where Satoshie actually stands
Escrow, VRF resolution and payout happen in one transaction. No claim step, so no second trip through the gate at the moment the house would most like to stall. If the draw resolves, the money has already moved. That is structural, not a promise to behave. The recovery path for a stalled or underfilled draw is likewise permissionless and time-bounded: after a deadline written in the contract, anybody can trigger it, not the house.
Now the part that is not solved. We are on Base, and Base has one sequencer, run by Coinbase, so everything above about single-sequencer L2s applies to us in full. Rollups do publish a path to force a transaction in through Ethereum L1 when the sequencer will not take it, and that path is real, but it belongs to the rollup, not to us. Notice what that does to the word permissionless: our recovery is only as permissionless as the cheapest route to the chain, so “anybody can trigger it” carries an asterisk about cost and latency. What we commit to is naming that dependency rather than hiding behind the word decentralised.
This is not an argument that L1 is the safe alternative. StarkWare just spent $200 demonstrating that Bitcoin has the same gate. Older and more diffuse, which makes it better, not absent.
Three questions before you deposit
- How many transactions must be carried for me? Entry, then a claim, then a withdrawal is three chances to be refused. Entry with payout in the same transaction is one.
- Who orders the blocks, and have they said anything about who they will not order for? If it is a single named company, that is not a scandal. It is a fact worth holding consciously.
- If the operator’s front end and RPC went dark tonight, could I still act? Not verify. Act. If the honest answer is no, the contract’s immutability is decorative.
Fairness has a half that lives in mathematics and a half that lives in whoever is willing to carry your traffic. The first is finished work. The second is a relationship, and relationships have terms.
📷 Photo by Hyundai Motor Group on Unsplash
