Blockstream co-founder and CEO Adam Back has a reputation as a quantum computing skeptic who considers the technology so immature that the threat will not materialize for decades. His company is nevertheless among the leaders in researching practical defenses against it. Back told Cointelegraph earlier this year that “the safe thing” is to prepare for the threat well in advance.

Blockstream has already demonstrated that its experimental post-quantum signature scheme, SHRINCS, works in production on its Liquid sidechain, and a Bitcoin Improvement Proposal for SHRINCS was published earlier today.

Blockstream Research’s Jonas Nick called it “the first concrete proposal for a post-quantum signature scheme designed specifically for Bitcoin.” He added, however, that “SHRINCS is not intended to be Bitcoin’s ‘final’ signature scheme, and it is not optimal along every axis. I do think it is a very good trade-off among the options we have now.”

https://x.com/n1ckler/status/2092740384938226107

While the timeline is hotly debated, scientists agree that sufficiently advanced quantum computers will be able to reverse engineer private keys from public keys, undermining Bitcoin’s security and enabling the theft of billions. That consensus has fueled a race to upgrade Bitcoin so it can withstand such an attack.

Shrinking the size of post-quantum signatures

One of Blockstream’s most promising areas of study has been optimizing post-quantum signature schemes for Bitcoin’s requirements so the blockchain can keep more of the properties Bitcoiners hold dear. The current crop of post-quantum secure hash-based and lattice-based signature schemes endorsed by the National Institute of Standards and Technology are between 38 and 123 times larger than Bitcoin’s existing ECDSA and Schnorr signatures. Deploying any of them in Bitcoin could slow the blockchain to a fraction of 1 TPS.

Ethereum’s post-quantum team plans to deal with the size problem by aggregating signatures using a tiny zero-knowledge proof for each block. That approach is under consideration for Bitcoin too, and if implemented it would allow Bitcoin to run faster than it does today, since a single proof takes less blockspace than a collection of signatures. In the Bitcoin world, however, adding zero-knowledge proofs would be a fairly radical change and would face a steep uphill battle to gather enough support for activation.

Blockstream is considering that option as well, but it has separated it from the more incremental path of shrinking the size of NIST-approved hash-based post-quantum signatures by roughly 13.23 times.

Bitcoin-optimized small(er) signatures

In December 2025, Blockstream researchers Jonas Nick and Mikhail Kudinov unveiled the SHRINCS signature scheme, and the opcode proposal was published in May. SHRINCS is a hash-based post-quantum signature scheme with a minimum size of 548 bytes (plus a 48-byte public key) that can grow as large as 4,619 bytes.

“SHRINCS is the most Bitcoin-native post-quantum signature design anyone has produced,” Marin Ivezic, author of PostQuantum.com and founder of Applied Quantum, told Magazine. “[It has] full BIP-39 seed recovery, and security resting on the same SHA-256 assumptions Bitcoin mining already depends on.”

Ivezic noted that the scheme is still at an early stage: it has not been audited, nor has it benefited from the years of public cryptanalysis the NIST signatures have weathered. Even so, he called it a serious contender.

“It is real code that has signed real transactions on Liquid mainnet, and I rate it the strongest answer yet to going post-quantum without wrecking Bitcoin’s block economics,” he said.

Despite being much smaller than most post-quantum signatures, SHRINCS would still be around nine times larger than Bitcoin’s existing Schnorr signatures, which are 64 bytes, or the older ECDSA signatures, which are 70 bytes.

It might seem logical to assume that a signature nine times larger than the current ones would require Bitcoin’s block size to increase ninefold to compensate, but Ivezic explained that Bitcoin’s Segregated Witness changes that calculation.

“Under SegWit, signature bytes fit in the witness and take a quarter as much as other transaction data,” he said.

According to estimates published in Blockstream’s earlier research, which used slightly different parameters, Bitcoin could run at 6.5 transactions per second if everyone used Taproot’s Schnorr signatures — about 80% of people do not. The blockchain’s speed would drop to 0.5 TPS if Bitcoin used the NIST-approved lattice-based signature ML-DSA, and to just 0.36 TPS using the NIST-approved hash-based signature SPHINCS+. Employing SHRINCS, the blockchain could run at 3 TPS, which is similar to today.

SHRINCS was tested in production on the Liquid sidechain in March this year — the test even included a copy of the Bitcoin white paper.

https://x.com/Blockstream/status/2090215730604298359?s=20

SHRINCS works in production — so what’s the catch?

As the BIP warns, “a security proof is TODO,” meaning the research is promising but the proposal is not yet a cryptographically mature design that has been fully validated. That matters because Bitcoin upgrades tend to move slowly, and any post-quantum change would need time not just for code review but for wallet, hardware, and consensus-layer compatibility work across the ecosystem.

It also introduces additional complexity to Bitcoin. Every signature uses a new one-time key, and one of the reasons SPHINCS+ is so large is that it wraps all of those one-time keys in a multi-layer hash tree structure that makes the scheme stateless. SHRINCS discards that structure to save space and instead stores used keys on the user’s device — an approach known as stateful — so it can quickly check that keys are not being reused.

The trade-offs are concrete: signatures get larger by 16 bytes each time they are used, and losing the device requires a very large “stateless fallback” transaction of around 5,777 bytes to recover access.

Yoon Auh, founder of BOLTS Technologies, said that in reducing the size, SHRINCS’ designers added “statefulness, compact signing paths, fallbacks, assumptions about how many times a seed is initialized, and rules for when devices must switch to larger stateless signatures.”

“That may be pragmatic engineering, but it is also complexity and fragility introduced largely to maximize throughput and minimize computation cycles. In Bitcoin, every new consensus rule becomes a permanent maintenance obligation, and every wallet-side assumption becomes a possible user failure mode,” Auh said.

Refining SHRINCS and adding SHRIMPS

Blockstream has been researching and optimizing the scheme throughout 2026. Just last week it demonstrated that SHRINCS, along with a range of other post-quantum signature schemes, can effectively run on common hardware wallets, a useful step because any Bitcoin migration would have to work for users who sign from constrained devices rather than from specialized infrastructure.

The BIP cautions, however, that some of the complexities of running the scheme on low-powered hardware wallets are not without risk: SHRINCS keys generated using hypertree pruning for the stateless component are not compatible with SHRINCS implementations that do not support hypertree pruning, and importing a key across such incompatible implementations may result in lost funds.

In March, the lab published a companion scheme called SHRIMPS, which would be used in conjunction with SHRINCS to enable backup devices initialized from the same seed to sign transactions. It is not clear from the draft BIP whether the scheme will be incorporated.

Blockstream has also been experimenting with lattice-based signature schemes, which are generally smaller than hash-based schemes but are seen as less proven and less reliable. It is additionally considering zero-knowledge proof aggregation of signatures, estimating that ZK proofs used in conjunction with SHRINCS could double Bitcoin’s speed to 6.7 TPS.

The company has deliberately separated the choice of signatures from questions around increasing the block size or adding ZK proof aggregation, as considering them together could sink the adoption of SHRINCS. Every post-quantum upgrade to Bitcoin is expected to be controversial and difficult to push to activation.

“The binding constraint in Bitcoin’s quantum migration isn’t cryptography, it’s governance,” says Ivezic. “Between BIP-360, BIP-361, SHRINCS and STARKs, the engineering menu is filling up fast. What Bitcoin lacks is a mechanism for choosing from it before the clock runs out.”