Lamport Signature Moves sBTC On Stacks Mainnet, Explorer Shows

A transaction with the transfer of sBTC through a Lamport signature that works once has been conducted by Stacks Labs within Stacks mainnet. This has been verified by means of a Clarity smart contract without implementing any changes to the protocol. Stacks made the post available on November 11, 2026. The transaction took place earlier since the explorer dates it on October 15.

The Lamport signature scheme is a hash-based approach to post-quantum signing. As per the write-up by the Stacks Labs, a quantum computer with enough processing power would enable an individual to derive the private key from the public key. This would enable an attacker to forge the elliptic curve signatures of Bitcoin and Stacks.

The opening of the Stacks Labs post describing the Lamport-signed sBTC transfer. Source: Stacks, The First Post-Quantum sBTC Transfer on Stacks Mainnet.

The vault that checks a Lamport signature

A vault was created using Lamport signatures in Clarity, and this vault will disburse funds only after a successful validation of this Lamport signature. As there are already available hash functions in Clarity, the smart contract itself can perform this validation. This is done through SHA-256 algorithm.

The signed message specifies the vault that will be spending funds, the asset, the amount, and the recipient. Additionally, it specifies the next key to be used. This message is bound to the chain, the contract, and the current transfer number, thus any change would invalidate the authorization.

One key, one message

Each Lamport key can sign a particular message only once. When you use the same key to sign a different message, more secret numbers are exposed, thereby compromising the security of the key. The signature program records every command issued, and will not use the key for any other message, even after a restart.

Once the transaction is done, the contract moves on to the next count and the new key becomes accessible all within the same transaction. Another account of the Stacks network submits the message and pays the fees. The old authorization cannot transfer again.

What the explorer shows

This transaction is a call to contract pq-vault where the function withdraw-sbtc is called. According to the information on Hiro explorer, the transaction was confirmed in block 9219404 on 2026-10-15 21:33:53 and the cost of the transaction fee charged was 1.50 STX. The amount of tokens sent is 0.00001 sbtc-token which is equal to 1,000 base units.

In this page, there is only one post condition and two events in the call. This time, the sender SP366 to 4PM4P is not a vault contract, but rather an account that fits the definition of the post as stated that an account sends the message and pays the fee. The transaction nonce for the sender is 0.

The Hiro explorer page for the mainnet transaction behind the post. Source: Hiro Explorer, withdraw-sbtc transaction on Stacks mainnet.

Cost of a bigger Lamport signature

The size of a Lamport signature is much larger than the size of elliptic curve signatures. As per the blog post, the engineers chose the signature because of the simple design and also its verifiability. The Lamport signature argument in the transaction is an array of 32-byte values.

Tests run locally also showed that the vault refuses any change to the recipient or to the next key, and it refuses a second submission of a finished transfer. The code and the contracts exist in a GitHub repository.

What Stacks Labs says comes next

Post-quantum signature algorithms and migration strategies shall be analyzed, with the first phase consisting of ensuring that the Stacks network is quantum-safe. As all sBTC tokens are collateralized by BTC on the Bitcoin L1 chain, the research will move on to studying the quantum security challenge of the collateral. Stacks Labs plans a follow-up post later this year.

Featured image: IBM Quantum Computer Demo at ITUWTSA 2024, Delhi 1 by Dev Jadiya, licensed CC BY-SA 4.0, via Wikimedia Commons.