A Bitcoin Improvement Proposal for the SHRINCS signature scheme has been published as part of the push to make Bitcoin quantum-secure. The work comes out of Blockstream, a company whose co-founder and CEO, Adam Back, has long been known as a skeptic of near-term quantum computer risk. Even so, Back told Cointelegraph earlier this year that the safe move is to prepare well in advance.
Blockstream has already tested its experimental post-quantum signature scheme, SHRINCS, in production on the Liquid sidechain. The newly published BIP puts that work into a concrete proposal for Bitcoin itself. Blockstream Research’s Jonas Nick called it “the first concrete proposal for a post-quantum signature scheme designed specifically for Bitcoin.” He also said that “SHRINCS is not intended to be Bitcoin’s ‘final’ signature scheme, and it is not optimal along every axis.” In his view, it is still “a very good trade-off among the options we have now.”
The timing of a serious quantum threat is still disputed, but scientists broadly agree on the basic risk: once quantum computers become capable enough, they could derive private keys from public keys, weakening Bitcoin’s security model and opening the door to theft on a very large scale. That is why the search for a workable Bitcoin upgrade path is already underway.
Signature size is the first bottleneck
One of Blockstream’s main research goals has been to adapt post-quantum signatures to Bitcoin’s constraints without discarding too many of the properties Bitcoin users want to preserve. Today’s post-quantum secure hash-based and lattice-based signature schemes endorsed by the National Institute of Standards and Technology, or NIST, are between 38 and 123 times larger than Bitcoin’s existing ECDSA and Schnorr signatures.
That size penalty creates a direct throughput problem. If one of those schemes were dropped into Bitcoin as-is, the chain could slow to a fraction of 1 transaction per second. Ethereum’s post-quantum team plans to address this by aggregating signatures into a tiny zero-knowledge proof for each block. That option is also being discussed for Bitcoin. If adopted, it could even make Bitcoin faster than it is now because a single proof takes less block space than many separate signatures. But for Bitcoin, adding zero-knowledge proofs would be a major protocol change and would face a hard path to activation.
Blockstream is looking at that route too, but it has separated that debate from a less contentious line of work: shrinking NIST-approved hash-based post-quantum signatures by about 13.23 times.
SHRINCS is smaller, but not small
In December 2025, Blockstream researchers Jonas Nick and Mikhail Kudinov introduced the SHRINCS signature scheme, and the opcode proposal was published in May. SHRINCS is a hash-based post-quantum signature system with a minimum signature size of 548 bytes, plus a 48-byte public key. In some cases, the signature can grow to 4,619 bytes.
Marin Ivezic, author of PostQuantum.com and founder of Applied Quantum, described SHRINCS as “the most Bitcoin-native post-quantum signature design anyone has produced.” He said it offers full BIP-39 seed recovery and relies on the same SHA-256 security assumptions that Bitcoin mining already uses.
Ivezic also said the scheme is still early. It has not been audited, and it has not gone through the years of public cryptanalysis that NIST signatures have faced. Even so, he said it is already a serious contender.
SHRINCS is much smaller than most post-quantum signatures, but it is still about nine times larger than Bitcoin’s existing Schnorr signatures, which are 64 bytes. Older ECDSA signatures are about 70 bytes.
That does not translate into a 9x block size requirement. Ivezic said Segregated Witness changes the economics of signature data: “Under SegWit, signature bytes fit in the witness and take a quarter as much as other transaction data.”
According to estimates from Blockstream’s earlier research, using slightly different parameters, Bitcoin could run at about 6.5 transactions per second if everyone used Taproot’s Schnorr signatures, though about 80% of users do not. If Bitcoin used the NIST-approved lattice-based signature ML-DSA, throughput would fall to 0.5 TPS. With the NIST-approved hash-based SPHINCS+, it would drop to 0.36 TPS. With SHRINCS, by contrast, Bitcoin could run at 3 TPS, roughly in line with present-day performance.
SHRINCS was tested in production on the Liquid sidechain in March this year, and the test even included a copy of the Bitcoin white paper. That was a practical milestone, but it did not settle every open question.
The catch: unfinished proof and added complexity
The BIP itself includes a warning: “a security proof is TODO.” In plain terms, the proposal is promising, but it is not yet a fully validated and cryptographically mature design.
It also adds complexity. Each signature uses a new one-time key. One reason SPHINCS+ is so large is that it wraps those one-time keys inside a multi-layer hash-tree structure that keeps the system stateless.
SHRINCS removes that structure to save space and instead stores used keys on the signing device, making it stateful. That lets the device quickly check that keys are not reused. The trade-off is that the signature grows by 16 bytes every time it is used. If the device is lost, recovery requires a much larger “stateless fallback” transaction of around 5,777 bytes.
Yoon Auh, founder of BOLTS Technologies, said that in the process of reducing size, the designers introduced “statefulness, compact signing paths, fallbacks, assumptions about how many times a seed is initialized, and rules for when devices must switch to larger stateless signatures.”
Further optimization and the SHRIMPS change
Blockstream has kept refining the scheme through 2026. Just last week, it demonstrated that SHRINCS and a range of other post-quantum signature schemes can run effectively on common hardware wallets. The BIP still warns that this comes with risk.
In March, the research team published a companion scheme called SHRIMPS. It was meant to work alongside SHRINCS so that backup devices initialized from the same seed could also sign transactions. In the current BIP, the SHRIMPS name has been dropped. The functionality has been folded into a built-in stateless path under the same 48-byte public key, and optimized with a non-standard parameter set to make it about 26% smaller than it would otherwise be.
Blockstream is also experimenting with lattice-based signatures. Those are generally smaller than hash-based schemes, but they are also seen as less proven and less reliable. The company is separately considering zero-knowledge proof aggregation for signatures. Its estimate is that if ZK proofs are combined with SHRINCS, Bitcoin throughput could rise to 6.7 TPS.
Blockstream has deliberately separated the question of which signature scheme Bitcoin should adopt from the questions of whether to increase block size or add ZK proof aggregation. Putting all of those changes into one debate could make adoption harder. Any post-quantum upgrade for Bitcoin is likely to be controversial and difficult to activate.
Ivezic framed the issue in governance terms: “The binding constraint in Bitcoin’s quantum migration isn’t cryptography, it’s governance. Between BIP-360, BIP-361, SHRINCS and STARKs, the engineering menu is filling up fast. What Bitcoin lacks is a mechanism for choosing from it before the clock runs out.”