ZK STARKs are the best way to deal with the issues created with making Bitcoin quantum-safe — and to reach mass adoption at the same time — says StarkWare co-founder Eli Ben-Sasson.
What’s more, he claims Blockstream founder Adam Back agrees.
Ben-Sasson has been in the news this week for his controversial suggestion on X to increase Bitcoin inflation to 4% annually. Grok’s analysis of the replies found “zero clear support for the proposal.”
But as the co-inventor of STARKs — quantum-secure, hash-based zero-knowledge proofs — he’s on much firmer ground, with some leading Bitcoin researchers supporting the concept.
Ben-Sasson’s own project Starknet last week announced its own three phase project to become quantum secure.
The problem of large PQ signatures on Bitcoin
Adding zero-knowledge proofs to Bitcoin does not make the blockchain quantum secure by itself. ZK proofs are a way to deal with the problems caused by adding much larger post-quantum (PQ) signature schemes to Bitcoin.
The current crop of PQ signatures approved by the National Institute of Standards and Technology (NIST) is 10 to 100 times larger than Bitcoin’s existing ECDSA and Schnorr signature schemes.
Some argue this could slow the blockchain to fewer than 1 transaction per second. But all of the large transaction signatures for a block could be compressed into a tiny ZK STARK proof. Because the proof would be much smaller than even including the existing signatures, the blockchain may end up running faster.
“If they don’t allow for ZK STARK aggregation, then definitely it will be a very unfortunate move because it won’t really solve the problem … where the problem is ‘can everyone actually use Bitcoin?’” Ben-Sasson said.
“So for that you need massive scale. And for that, you need things like signature aggregation and just increasing the block size isn’t enough.”
Related: StarkWare CEO suggests 4% annual Bitcoin inflation to replace 21M cap
Source: Eli Ben-Sasson
The quantum alternative: Increase Bitcoin’s block size
Marin Ivezic, author of PostQuantum.com and founder of Applied Quantum, told Cointelegraph that Bitcoin’s SegWit scheme reduced the impact of large signatures by up to 75%. But his modeling of NIST’s ML-DSA-44 scheme, which has 2,420 bytes per signature, “puts block capacity at roughly 500 to 700 transactions, down from 2,500 to 3,000 today. That is where the block-size debate comes in.”
Increasing Bitcoin’s block size is a genuine alternative, but the community split over a proposal to double the block size back in 2017. Many of the arguments against remain relevant, as it’s a blunt fix that requires every node to carry, store and verify much more data. That’s more expensive and requires more equipment, which critics argue pushes the network toward centralization.
Blockstream Research has been experimenting in recent months with compressing the size of hash-based post-quantum signature schemes for use with Bitcoin. It has come up with the promising SHRINCS and SHRIMPS schemes, which have everyday signatures around five times larger than Bitcoin’s current ones, but up to 40 times larger if you lose your wallet and need to resurrect it.
While SHRINCS has been used to sign real transactions on the Liquid sidechain, its development is at an early stage and there are drawbacks in terms of complexity and usability. The much larger signatures would also slow the blockchain down, unless the block size was increased.
“Raising capacity natively is the simple engineering answer and the hardest governance answer,” said Marin Ivezic, author of PostQuantum.com and founder of Applied Quantum, about a block size increase. “We just don’t have time for those debates.”
ZK proof aggregation has advantages
ncrease, but it would arguably be much better at preserving decentralization while also making Bitcoin more efficient.
At their simplest, ZK proofs are a way to mathematically prove that something exists without needing to include all the details. For example, a ZK proof could demonstrate that you know the combination to a safe, without telling the other person what the combination is.
Generating a ZK proof for a single block technically only needs to be done once (although it’s safer to generate additional backups for redundancy), and the equipment required to do so looks like it would be much less expensive than a commercial mining setup.
Lean Ethereum’s specs are for proving equipment that costs under $100,000 (and can be run from an ordinary home). Verifying a ZK proof, meanwhile, can be done on almost any equipment, including a Raspberry Pi.
Ben-Sasson said that early Bitcoin devs like Greg Maxwell and Mike Hearn were “very bullish about ZK STARKs, which are post-quantum secure and have no trusted setup,” and that he believes Bitcoin Core developer Luke Dashjr and Blockstream founder Adam Back are coming around to the idea.
“I heard this myself from them. They are bullish on things related to and using ZK STARKs. I think each of them has spoken well, definitely privately but also publicly, in favor. Adam Back and Luke Dashjr don’t exactly see everything eye to eye, but on this I think they actually agree that it’s a great technology that, under the right terms, could find its way to Bitcoin.”
Cointelegraph contacted Back for comment, but did not receive a response.
Ethereum researcher Justin Drake has spoken publicly about his desire for Bitcoin to adopt Lean Ethereum’s ZK proof aggregation technology so that it becomes standard across the industry. This may be unfeasible for political reasons.
Ethereum aims to be post quantum by 2029. Source: Ethereum Foundation
Bitcoin specific ZK proposals
Given Bitcoin’s conservative culture, the most politically pragmatic way to add ZK to Bitcoin would likely be to re-enable OP_CAT, which is nine lines of code written by Satoshi.
“[He] even introduced and then he removed it,” said Ben-Sasson said. “And if you add that, you can get things like STARK proofs and then aggregation and post-quantum security.”
“I think it’s the best and safest solution that will really, really just jump-start again this journey that Satoshi really started and wanted.”
But despite a flurry of interest in OP_CAT about 12 to 24 months ago, it seems to have lost momentum more recently (although Bitcoin governance moves in mysterious ways).
There are also more speculative proposals, including OP_STARK_VERIFY, that would add opcodes specifically designed to more efficiently verify STARKs on Bitcoin. And BIP-360 co-author Ethan Heilman proposed aggregating Bitcoin’s signatures and public keys into a single STARK proof under the name BitZip.
Heilman told Cointelegraph earlier this year there are two main ways to achieve the desired result:
“Either add a bunch of general purpose opcodes to Bitcoin and then build something like a ZKRollup in Bitcoin or support STARKs at the consensus layer of Bitcoin. Alternatively, other less powerful aggregation schemes, such as CISA [Cross Input Signature Aggregation] might help here as well.”
What are the chances though?
Ivezic says Bitcoin governance, rather than technological capability, is the sticking point.
“Eli’s cryptography is rock solid: pure hash assumptions, no trusted setup, thousands of signatures compressed into one small proof. The problem is everything around the cryptography,” he says.
“Bitcoin Script cannot verify a STARK today, and a production verifier is a massive consensus surface compared with a narrow hash-signature opcode. Given that a tiny opcode like OP_CAT has spent years in debate, a base-layer STARK verifier is realistically a 2030s conversation.”
Meanwhile, Ethereum is targeting 2029 for its transition to post-quantum, and Solana has also been experimenting with adding post-quantum signatures. StarkNet’s three-phase transition will benefit from account abstraction, which enables the underlying cryptography to be upgraded without making every user manually transfer to new accounts.
As a result, Ben-Sasson said that Solana and Ethereum’s post-quantum roadmap will be “extremely hard.”
“On Starknet, we have this big advantage that we have already native account abstraction and smart wallets, which means that nothing is enshrined so its very easy to upgrade the wallets and the infrastructure to be post quantum.“
Features: The biggest blockchain upgrades still to come in 2026
