Author: Castle Labs

Translation: Shen Chao TechFlow

Shen Chao Introduction: As on-chain finance approaches traditional markets, two fatal issues have surfaced: all fund flows are publicly visible, and quantum computing poses a threat to existing cryptographic signatures. Bitcoin, as the largest asset with a 56% share of the crypto market, has become the clearest litmus test for these two issues. The strkBTC solution of Starknet attempts to simultaneously address visibility and persistence: allowing Bitcoin to transfer privately while preparing technologically for the quantum era to come.

As on-chain finance increasingly approaches traditional markets, digital assets are facing higher standards and stricter requirements.

This new world presents two key issues: the on-chain flow of funds being publicly visible to everyone, and the cryptographic signatures underpinning the entire technology facing threats from quantum computing.

This is most apparent in Bitcoin.

Bitcoin currently accounts for over 56% of the total market capitalization of the cryptocurrency market, still serving as the anchor point for the entire crypto market, although it itself has nearly no programmability.

To enhance its utility and programmability, Bitcoin has been exported across chains, entering the on-chain finance world via wrapped tokens.

However, Bitcoin in DeFi needs not only higher yields; it needs a way to perform large transfers without public broadcasting and a guarantee that it remains secure when tomorrow's quantum computer arrives.

The same applies to other assets in on-chain finance: assets need to be transferred, settled, and composed without exposing every holding to the public, and cannot rely on potentially obsolete cryptographic technology that may not survive to the next decade.

We have been tracking a protocol that seems to have understood these issues earlier than most projects and built solutions around both problems.

Though Starknet launched the BTCFi initiative earlier this year, it seeks to do more than simply make Bitcoin available on-chain. It takes Bitcoin as the first clear test case of the conditions that individuals and institutions truly care about: defaulting to privacy, disclosure when necessary, and fortified for a post-quantum future.

Regarding Starknet's work in this area, we previously reported on why $2 trillion worth of idle Bitcoin exists and how Starknet's roadmap plans for a trustless path to BTC, as well as Starknet's new privacy framework STRK20, and why they designed the system as "achieving privacy through ownership."

Privacy and Quantum Countdown

The core tenet of the cryptographic world has always been "do not trust, but verify," which is precisely what a public and transparent blockchain has always allowed us to do. Verifying balances, scrutinizing transfers, checking fund flows, monitoring contract interactions. Everything is publicly visible to everyone.

You can understand how this began.

Transparency builds trust, but complete transparency can damage intellectual property, strategy, personal safety, and operational privacy. This is especially true today, where AI-driven de-anonymization can link public addresses to real identities with 90% accuracy.

Privacy is not just a human right; it is also a key infrastructure needed for protecting on-chain users and institutional adoption.

Individuals need privacy to avoid surveillance, profiling, harassment, crime, and political exposure. Institutions need privacy to ensure the confidentiality of holdings, order flows, and other data, as well as to prevent counterparty visibility and strategy leaks. Moreover, privacy needs to be configured to allow selective disclosure to auditors, regulators, or compliance departments.

Previous on-chain privacy attempts have repeatedly highlighted the trade-offs:

Purely anonymous privacy pools like Tornado Cash faced compliance pressure, leading to OFAC sanctions, criminal charges, and imprisonment of developers, providing a stark reminder that non-compliance paths are fraught with political and legal risks.

Native on-chain privacy coins (like Monero, Zcash) have proven that concealing transactions is possible, yet have always struggled to integrate with other parts of the on-chain world, failing to combine on a large scale with DeFi primitives, pointing to a larger issue beyond privacy itself: liquidity, interoperability, and compliance issues.

Privacy executing systems like Aztec saw early demand for private DeFi, but they often face high costs, fragmented liquidity, and poor user experiences.

The issues caused by a lack of privacy not only exist in the isolated on-chain world but also bleed into the physical world. On-chain addresses tied to real people and public balances present greater attack risks. CertiK reports 34 verified physical attacks against cryptocurrency holders in the first four months of 2026, a 41% increase year-on-year, representing only a portion of these extremely underreported incidents. Specifically, in France, there were 41 cryptocurrency-related kidnapping cases from January to May 2026, averaging one every 2.5 days.

Privacy is increasingly about reducing personal and operational risk, not just hiding transactional activity or protecting alpha.

While privacy issues are being actively addressed in the industry, another threat of quantum computing has emerged. A path that simultaneously addresses visibility and persistence can propel blockchains closer to becoming the next generation of financial infrastructure.

In March of this year, a report from Google Quantum AI, co-authored by Justin Drake (Ethereum Foundation) and Dan Boneh (Stanford University), identified multiple attack vectors and estimated that approximately $100 billion in the Ethereum ecosystem is at risk. It also specifically pointed out that Starknet has a stronger post-quantum position than other major L2s, as its proof system is based on hash-based STARK assumptions rather than elliptic curve cryptography.

The paper focuses on the exposure of secp256k1 public keys associated with Bitcoin and Ethereum wallets, noting that sufficiently powerful quantum computers could attack wallets in less than 9 minutes. Justin Drake later warned that "there is at least a 10% chance" that quantum computers could recover private keys from exposed public keys by 2032.

While this is not a reality today, the long-term security of assets that should last for decades and their lifespan have been called into question.

Bitcoin is the world's most important digital asset, and as it is increasingly used as collateral, a reserve, and an asset on institutional balance sheets, the demands for its security and privacy are increasing.

In the next section, we highlight a solution developed around Bitcoin, which serves as the largest and clearest test case for these privacy challenges.

strkBTC: Private Bitcoin on Starknet

We may have all used BTC wrapped tokens. They allow Bitcoin to enter other ecosystems and become composable: as tradable assets, as collateral, as liquidity.

What they haven't addressed is visibility.

While wrapped BTC can become productive, each transfer can still be monitored, checked, and counterparty traded. Deposits, loans, trades, LP positions, repayments, withdrawals, wallet clusters, treasury flows. All are default publicly visible.

This is not how serious financial markets operate; until this issue is resolved, on-chain finance will continue to reach institutional ceilings.

In traditional finance, privacy is built into the infrastructure, whether you are a retail investor or an institutional giant. In fact, a significant portion of stock trading volume flows through private venues like dark pools or over-the-counter markets, where counterparties see what they need to see, regulators retain access when necessary, and the public sees aggregated trading volumes rather than every real-time move.

Cryptocurrency perceives visibility as the norm. In reality, privacy should be the default.

strkBTC is Starknet's attempt to let Bitcoin flow in the on-chain financial world without such restrictions.

strkBTC is an ERC-20 on Starknet, backed by BTC locked on the Bitcoin network, and built on StarkWare's privacy framework STRK20 for shielding balances and private transfers.

STRK20 offers two modes for strkBTC:

In public mode, it behaves like a standard ERC-20: users can hold, transfer, supply to lending markets, provide liquidity, or use it as collateral.

In shielded mode, selected balances and transfers are hidden from public view. Users can shield, make private transactions, and unshield back to public balances directly from the wallet.

Before the Starknet v0.14.2 upgrade, which enabled STRK20, applications wanting to verify STARK proofs on Starknet had to do so within smart contracts. This made it costly and complex due to the size of the proofs. But now, transactions can directly reference off-chain proofs, with Starknet consensus validating local handling through protocol-level proofs.

This unlocks privacy at the protocol level, rather than using separate applications, chains, pools, or mixers that historically add complexity, cost, and liquidity fragmentation. This enables applications to focus on building better products because the underlying infrastructure allows builders easy access to private operations.

Compliance is a key part of the design, which is part of opening Starknet to institutions entering on-chain.

When users shield strkBTC, the associated view key will be shared with Financial Privacy Inc (also known as FPI), an independent third-party auditing agency that operates the compliance infrastructure for STRK20, granting access as per effective regulatory requests. While this may not align with pure crypto-punk philosophy, it fits much better with the traditional market. Public privacy, disclosure to regulators.

The bridge follows a similar logic, run by a trusted strkBTC alliance composed of Twinstake, NEAR Intents, Luganodes, UTXO Management, and Xverse. Currently, these independent signers support the minting and burning between BTC and strkBTC. The alliance is not the final state; however, Starknet is committed to gradually strengthening its roadmap over time.

strkBTC is not meant to be another wrapped token, but to release the potential of a programmable, composable BTC whose movements are not broadcast, thereby addressing the first problem: visibility.

The next issue is persistence.

The Quantum Issue of Blockchain

Every blockchain relies on public key cryptography. When users sign transactions, they reveal their public key while keeping their private key hidden. This is routine in Bitcoin and most other blockchains, considered completely normal and secure in today’s environment. But in a post-quantum world, this assumption becomes somewhat unstable.

As mentioned earlier, sufficiently powerful quantum computers running Shor's algorithm could theoretically derive the private key from an exposed public key. This means that public key exposure, the seemingly harmless part of transaction verification, could quickly become a potential attack surface. This is not unique to any one chain since the same elliptic curve primitives underpin Bitcoin, Ethereum, and Solana.

The threat is shared, but the capacity to respond is not. The chains that are the most exposed tend to be the slowest-moving; Bitcoin is the clearest example.

Bitcoin is not lacking ideas for a post-quantum future. If anything, it has too many ideas. The problem lies in reaching consensus on the trade-offs that the network is willing to accept: larger signatures, higher costs, legacy coin handling, user migration, wallet support, miner policies, or fighting for frozen dormant and unmigrated coins.

Clearly, Bitcoin's challenge is both technical and social and political.

Dan Boneh, one of the co-authors of the Google paper, calmed everyone in a recent interview: "Bitcoin should not panic, but also cannot ignore this. Acting too quickly may be worse than waiting because a rushed post-quantum migration may introduce catastrophic errors before quantum becomes a real-time attack."

Bitcoin may solve its quantum problem, but it will not be quick or clean.

This slowness is in some ways a feature of sound money, but it also leaves the door open. When the foundational layer is in debate, more agile stacks can build the persistence that Bitcoin itself cannot yet commit to.

Ethereum and its extended L2s will not escape this issue. Most rollups settle to Ethereum and rely on it for data availability, inheriting the exposure of the foundational layer. Ethereum is aware of this and has released its multi-year migration plan, but until that plan arrives, every chain built on top of it is exposed to Ethereum's post-quantum migration problems.

This is where Starknet has the advantage. Though it settles to Ethereum like any other L2, the core of Starknet, its proof layer, is built on assumptions that do not rely on quantum-vulnerable cryptography. While the exposure inherited from Ethereum is real, everything within Starknet's own stack carries less migration debt than most major chains and has more content in the pipeline.

Architectural Advantages

Starknet's advantageous position derives from two design choices made well before quantum computing became an urgent issue.

The first is the proof layer, which generates STARK proofs to guard every state transition on the network. It relies on hash functions rather than the elliptic curve mathematics threatened by quantum computers, a design established since 2018 by a paper co-authored by StarkWare CEO Eli Ben-Sasson. This is a critical security layer and why the Google paper lists Starknet as the only major L2 that is already ahead.

The second is native account abstraction. On most chains, the signature schemes at the protocol level are fixed, so replacing it requires a hard fork, requiring each user and application to follow suit. Starknet allows accounts to define how they verify identity themselves, thus enabling users to migrate to quantum-resistant signatures without changing the protocol layer. According to StarkWare, a quantum-resistant wallet called S2morrow has already been deployed using Falcon-512, and OpenZeppelin is building a standardized version.

On many chains, such a change means coordinating the migration of the entire protocol. On Starknet, much of the work can start with wallet upgrades. This does not mean every Starknet wallet is quantum-resistant, but this model provides Starknet users with an easier pathway.

StarkWare is now filling in the remaining gaps. Last week, they released a roadmap aiming to achieve end-to-end quantum resistance for Starknet before Q-day. Q-day refers to the point in time when quantum computers are powerful enough to crack today’s cryptography.

The roadmap is divided into three phases:

None of this means Starknet is fully quantum-resistant today, and the roadmap does not claim that.

What Still Needs Proof?

Starknet can replace Pedersen with BLAKE2, improve quantum-resistant wallet support, and provide migration pathways for traditional contracts, but it cannot eliminate all the inherited issues from the foundational layer. Bridging messages and blob data availability still relies on Ethereum's quantum-resistant roadmap. Starknet can reinforce the parts it controls, but the parts inherited from Ethereum will progress according to Ethereum's timeline. That said, the Ethereum Foundation has outlined a structured milestone for forkings, aiming to complete core quantum-resistant infrastructure around 2029.

strkBTC has a similar phased story. Currently, bridging relies on an alliance to coordinate minting and burning between BTC and strkBTC. This is a trusted starting point, but not the ideal final state of trustlessness. Starknet's goal is to shift from the alliance model to Bitcoin-native verification, followed by less trust in the BitVM design, and finally, adopting a fully trustless OP_CAT-based design if Bitcoin enables the necessary opcodes in the future.

View keys are another part that still needs proof. They are Starknet's practical answer to institutional privacy: opaque yet selectively disclosable to the public, but they have yet to undergo stress testing in real scenarios raising questions about who can request disclosure, under what conditions, and what safeguards are in place.

Digital assets, including Bitcoin, do not need another wrap. They need the surrounding infrastructure to be able to operate on-chain without compromising the two most important aspects for institutions: current confidentiality and future persistence.

strkBTC addresses confidentiality by providing a private, selectively disclosable path for BTC to enter DeFi. Starknet's existing architecture and roadmap target persistence: its proof layer has already avoided the elliptic curve assumptions that burden other protocols with quantum migration, and its roadmap now extends this advantage to the remaining parts, with a clear goal of achieving quantum safety before "Q-day."

While outcomes are still early, the direction is clear: the next institutional phase of on-chain finance requires not just yields. It needs privacy, compliance, programmability, and persistence all integrated within the same tech stack.