Blockstream Research has identified its leading candidate in the effort to quantum-proof Bitcoin. A peer-reviewed paper published on August 6, 2026 names Falcon-1024, a lattice-based signature scheme, as the strongest option for the network — while also cautioning that it is far from ready for deployment.

Picking a favorite is not the same as picking a launch date. The paper devotes considerable attention to why Falcon-1024 cannot simply be dropped into Bitcoin in its current state.

The motivation is cryptographic: Bitcoin today secures spending with elliptic-curve signatures, a system that a sufficiently powerful quantum computer could break using Shor's algorithm. Post-quantum schemes such as the ones in this study are designed to withstand that class of attack.

Three Contenders, One Frontrunner

The study evaluates three lattice-based post-quantum signature schemes: Dilithium, Falcon, and Hawk, assessing how well each could function within Bitcoin's constraints.

Falcon-1024 won on size. Its combined public key and signature total 3,073 bytes, while Dilithium at Category 3 requires 5,261 bytes for the same task. Falcon's footprint is a little more than half of Dilithium's — a meaningful margin on a blockchain where every byte competes for limited block space.

Blockstream also highlighted Falcon-1024's efficient verification times. Because every node on the network checks signatures, a scheme that verifies quickly helps keep the cost of running the network from ballooning.

A Long List of Caveats

Winning the comparison did not earn Falcon-1024 a clean bill of health. Blockstream outlined several deployment challenges standing between the scheme and real-world use.

The first is memory. Falcon's signing process requires roughly 90 KB, a demand the report flags as high.

The second is implementation complexity. Falcon relies on floating-point arithmetic — mathematics involving fractional numbers — which the report notes makes a correct implementation more complicated.

The third problem may hit everyday users hardest: Falcon lacks native support for hierarchical deterministic key derivation.

Finally, Falcon-1024 has yet to reach final standardization. The U.S. National Institute of Standards and Technology (NIST) selected Falcon for its post-quantum cryptography portfolio in 2022, but the scheme's final specification remains unpublished. Until that standard arrives, anchoring Bitcoin's long-term security to Falcon-1024 would mean committing to a target that could still shift.

The Conservative Track Runs in Parallel

The Falcon paper is only one part of Blockstream's quantum work. The company has also been advancing more conservative options, focused on hash-based signatures.

Blockstream's hash-based approach, known as SHRINCS, reached draft BIP status in late August 2026. A Bitcoin Improvement Proposal (BIP) is the formal route for suggesting changes to the protocol, and draft status marks the opening of public review rather than approval.

SHRINCS has already been tested in the field. Blockstream ran trials on its Liquid sidechain, including a notable post-quantum transaction completed in March 2026.

What This Means for Bitcoin

The research points toward a staged transition rather than a single switch. Blockstream frames Falcon-1024 as a strategic long-term option contingent on standards maturing — not an immediate deployment plan. The concrete markers to watch are procedural: how the SHRINCS draft BIP fares in public review, and whether Falcon-1024 advances to a finalized standard.

For holders and traders, the practical takeaway is that Bitcoin's current security model remains intact. No quantum machine capable of compromising Bitcoin signatures exists today, and nothing in the paper changes that.

Still, the size comparison is a reminder that post-quantum security will not come free. Even the most compact lattice option weighs in at thousands of bytes per key and signature, meaning any eventual migration will likely force tradeoffs around block space and fees.

Wallet makers face the most work ahead. The HD derivation gap and the 90 KB signing requirement land squarely on hardware and software wallets, which will need to adapt before any lattice scheme can reach ordinary users.

Disclosure: This article was edited by Estefano Gomez.