Blockstream Proposes SHRINCS to Secure Bitcoin Against Quantum Threats
Blockstream has put a Bitcoin Improvement Proposal on the table that would graft its hash-based post-quantum signature scheme SHRINCS onto the base layer — and per the proposal's own architects, the design is a deliberate compromise, not a destination.
As Blockstream researcher Jonas Nick framed it, this is the first concrete post-quantum signature scheme designed specifically for Bitcoin, yet it is not intended to be the network's "final" solution, and the trade-offs are stark enough to reshape near-term migration economics.
The size tax on consensus
The reason SHRINCS exists is simple arithmetic. NIST-endorsed hash- and lattice-based post-quantum schemes run 38 to 123 times larger than Bitcoin's incumbent ECDSA and Schnorr signatures, a delta that, if bolted on naively, would crater throughput to a fraction of one transaction per second. SHRINCS compresses the problem: a minimum footprint of 548 bytes plus a 48-byte public key, scaling up to 4,619 bytes under worst-case conditions, which is roughly a 13.23-times reduction against the raw NIST baseline. That figure matters because every additional byte on a signature is a byte validators must store, relay, and price into fee markets for the next decade. Blockstream researcher Mikhail Kudinov and Nick first unveiled the construction in December 2025, with the opcode proposal following in May; the BIP now lands it in front of the broader standards process. The catch, made explicit in the proposal materials, is that SHRINCS is still early-stage: unaudited, and lacking the years of public cryptanalysis that NIST signatures have already absorbed. Marin Ivezic, founder of Applied Quantum, called it the most Bitcoin-native post-quantum signature design yet produced, anchored on the same SHA-256 assumptions Bitcoin mining already depends on — precisely the kind of legacy-asset compatibility that institutional custodians will be underwriting when they underwrite the upgrade.
The parallel fork-free track
While Blockstream works through the BIP process, StarkWare has staked out a different route that sidesteps the governance bottleneck entirely. StarkWare researcher Avihu Levy successfully executed what his team describes as the first quantum-safe transaction mined on the Bitcoin mainnet, using a method branded Quantum-Safe Bitcoin (QSB). The salient regulatory feature: the demonstration did not require a soft fork. For asset managers and ETF custodians modeling the probability-weighted cost of a future quantum event, a fork-free mitigation path materially changes the optionality calculus. It converts a binary, years-long consensus upgrade into a deployable client- or wallet-side defense — albeit one whose long-term security guarantees still depend on the same post-quantum primitives everyone else is racing to finalize.
What to watch before allocating
The macro read is straightforward: Bitcoin's post-quantum migration now has at least two live proposals with sharply different activation costs. Blockstream is absorbing the political friction of a BIP to keep the security model anchored in Bitcoin's existing hash assumptions, while StarkWare is attempting to externalize the problem to overlay infrastructure that needs no consensus change. For institutional desks, the diligence question is no longer whether quantum will eventually force a migration, but which pathway gets audited, deployed, and supported by custodians first — because the entity controlling that migration effectively controls the liability surface of every long-held UTXO on the books.