Blockstream Research has picked a frontrunner in the race to quantum-proof Bitcoin. A peer-reviewed paper published on August 6, 2026 names Falcon-1024 as the strongest lattice-based signature candidate for the network. The context gives the work its urgency: Bitcoin today secures transactions with elliptic-curve signatures — ECDSA and, since the Taproot upgrade, Schnorr — both of which a sufficiently powerful quantum computer could break using Shor's algorithm, and post-quantum schemes like Falcon are built to resist precisely that attack. Picking a favorite, however, is not the same as picking a launch date: the paper also devotes considerable space to explaining why the scheme is not ready to drop into Bitcoin anytime soon.

Three contenders, one clear leader

The paper evaluates three lattice-based post-quantum signature schemes — Dilithium, Falcon, and Hawk — with each candidate assessed on how well it could operate within Bitcoin's constraints. Lattice-based construction is no side branch: it is one of the most heavily studied families in the global post-quantum cryptography effort now underway at standards bodies.

The size advantage

Falcon-1024 won on compactness. Its combined public key and signature total 3,073 bytes, while Dilithium at Category 3 requires 5,261 bytes to do the same job. Falcon's footprint is a bit more than half of Dilithium's — a margin that matters greatly on a blockchain where every byte competes for limited block space. Bitcoin's consensus rules cap block capacity at 4 million weight units, so heavier signatures feed directly into the fees users pay.

Blockstream also highlighted Falcon-1024's efficient verification times. Every node on the network checks signatures, so a scheme that verifies quickly helps keep the cost of running Bitcoin from ballooning.

A long list of caveats

Winning the comparison did not earn Falcon-1024 a clean bill of health. The paper lays out several deployment challenges that stand between the scheme and real-world use:

• Memory demand: Falcon's signing process requires roughly 90 KB, which the report flags as a high requirement.
• Implementation complexity: The scheme relies on floating-point arithmetic — the kind of math that works with fractional numbers — which the report notes makes building it correctly more complicated.
• No hierarchical deterministic derivation: Falcon lacks native support for hierarchical deterministic key derivation, the shortcoming likely to hit everyday users hardest.
• Unfinished standardization: Falcon-1024 has yet to reach final standardization. NIST selected the scheme for standardization back in 2022, but its final specification has still not been published — and until that happens, anchoring Bitcoin's long-term security to the scheme would mean committing to a target that could still shift.

A conservative track in parallel

The Falcon paper represents only part of Blockstream's quantum research. The company has also been advancing more conservative options centered on hash-based signatures. Hash-based schemes are widely viewed as the most conservative branch of post-quantum cryptography because their security rests only on hash functions, which are considered far more resistant to quantum attack than the number-theoretic math behind today's signatures — the same reason NIST finalized a hash-based option of its own, SPHINCS+ (published as SLH-DSA), in 2024.

Blockstream's hash-based construction, known as SHRINCS, reached draft BIP status in late August 2026. A Bitcoin Improvement Proposal (BIP) is the formal route for suggesting changes to the protocol, and draft status marks the opening of public review rather than approval.

SHRINCS has already been tested outside the lab. Blockstream ran trials on its Liquid sidechain — a federated Bitcoin sidechain the company operates — including a notable post-quantum transaction completed in March 2026.

What it means for Bitcoin

Taken together, the research points toward a staged transition rather than a single switch. Blockstream frames Falcon-1024 as a strategic long-term option contingent on standards maturing — not an immediate deployment plan.

For holders and traders, the practical takeaway is that Bitcoin's current security model stays intact for now. No quantum machine capable of compromising Bitcoin signatures exists today — building one would require error-corrected qubits at a scale no current hardware approaches — and nothing in the paper changes that.

Still, the size comparison is a reminder that post-quantum security will not come free. Even the most compact lattice option weighs in at thousands of bytes per key and signature, so any eventual migration will likely force tradeoffs around block space and fees.

Wallet makers face the most homework ahead. The HD derivation gap and the 90 KB signing requirement land squarely on hardware and software wallets, which will need to adapt before any lattice scheme can reach ordinary users.

For anyone tracking where this goes next, the milestones sit in standards venues rather than on-chain: whether Falcon's final specification lands, and how public review of the SHRINCS draft BIP unfolds. Bitcoin's consensus changes have historically taken years from proposal to activation — SegWit and Taproot each did — so any signature migration will be measured in BIP discussions and review cycles, not weeks.