Most ransomware tools stop at detection. Most Bitcoin forks stop at marketing. This post is about neither — it's about building a Bitcoin whose signatures survive Shor's algorithm, and what "fair launch" means when you actually mean it.
pqbit is open source, phase 2 just shipped, and this is the honest state of it.
Repo: https://github.com/BartoszOsiej/pqbit
The thesis, in one paragraph
~7M BTC sit in quantum-exposed addresses — ECDSA public keys revealed on-chain by old P2PK outputs and reused addresses. BIP-360 (P2MR) was merged into the Bitcoin BIPs repo in February 2026, so the ecosystem agrees the problem is real. But Bitcoin moves slowly by design, and a migration touching every wallet is a decade of debate. pqbit skips the debate: the chain is born post-quantum. Not a faster Bitcoin, not a token sale — one thesis, executed cleanly.
What shipped today (phase 2)
- pqbit-core — UTXO transaction model with canonical sighash, signatures via bitcoinpqc: ML-DSA-44 (FIPS 204) as primary, SLH-DSA-SHA2-128s (FIPS 205) as the conservative alternative. No ECDSA fallback at the consensus layer — that's the entire point.
- pqbit-node — testnet chain engine: blocks, SHA-256d PoW (leading-zero-bits difficulty), coinbase with a height commitment, UTXO set with ML-DSA spend authorization, and a CLI miner.
- 9/9 tests — including a double-spend test that caught a real bug during development.
The bug the test caught (the good part)
The first coinbase design stored the block height in the signature field. Sounds fine — except the sighash preimage commits prevouts and outputs but not signatures. Signatures are witnesses, not committed data. Result: every coinbase hashed to the same txid, block after block. The UTXO set happily re-created the same output every block, and a legitimate "spend" of it succeeded twice.
If that survived to a real network, it would be a consensus failure — minted outputs reappearing like ghosts. The fix follows Bitcoin's own pattern: commit the height in the prevout reference (prev_txid[0..8], little-endian). Prevouts are committed, so the height now is too. One test, one real protocol bug, one clean fix — in an evening, not after mainnet.
// before: height in the signature field (NOT committed by sighash)
signature: height.to_le_bytes().to_vec()
// after: height committed in the prevout (sighash commits prevouts)
let mut prev = [0u8; 32];
prev[0..8].copy_from_slice(&height.to_le_bytes());
Why the fair-launch constitution is written like a legal document
Zero premine. Zero presale. Founder stash capped at 100 coins, single public address, published at genesis — and never moved. Moving one coin ends the project's own narrative, and everyone can watch that address forever. That's not a marketing line; it's a reputational bond with an observable state.
The kill criteria are equally public: fewer than 50 non-founder nodes six months after genesis means the coin experiment freezes and pqbit returns to pure research. Sunk cost kills more projects than competitors do — we pre-signed the exit.
What's deliberately undecided
The PoW algorithm. CPU-friendly maximizes early distribution but botnets exist; "ASIC-proof" claims age badly. The honest position is memory-hard-leaning, with the decision made from testnet data, not vibes. Same for block interval (5 vs 10 minutes). GENESIS.md is a draft open for public review — tear it apart before genesis, not after.
Where this goes
Phase 3 is p2p networking. Then an explorator, a whitepaper, and — only when the founder says go — a public genesis with a timestamped fair launch. Every step ships in the open.
- Repo: https://github.com/BartoszOsiej/pqbit
- Landing: https://bartoszosiej.github.io/pqbit/
- GENESIS draft: https://github.com/BartoszOsiej/pqbit/blob/master/GENESIS.md
If you know post-quantum crypto or consensus internals and want to find holes in the design before it grows — the issues tab is open. That's exactly the review GENESIS.md is asking for.
