Blockstream-backed SHRINCS post-quantum signature BIP published
The proposal targets roughly 3 TPS throughput but flags “a security proof is TODO” and wallet-side fund-loss risks.
A Bitcoin Improvement Proposal for Blockstream’s SHRINCS post-quantum signature scheme was published on Aug. 27, 2026, putting a Bitcoin-specific quantum-resistant signature design into the formal review pipeline. The document pairs a throughput-focused pitch with explicit maturity gaps and operational warnings that shift near-term risk toward wallets, recovery, and implementation coordination.
Key Takeaways
- A Bitcoin Improvement Proposal for Blockstream’s SHRINCS post-quantum signature scheme was published on Aug. 27, 2026.
- SHRINCS is a hash-based post-quantum design with signatures from 548 bytes (plus a 48-byte public key) up to 4,619 bytes.
- The BIP explicitly flags unfinished formal validation, stating “a security proof is TODO.”
- The proposal warns that importing SHRINCS keys across incompatible implementations, including differences around hypertree pruning support, may result in lost funds.
SHRINCS Enters the BIP Process as a Bitcoin-Specific Post-Quantum Option
The SHRINCS proposal is now in the BIP process, which is the mechanism Bitcoin uses to publish and review design documents that could eventually become consensus changes. That matters because post-quantum work has mostly lived in research threads, sidechain experiments, and “someday” roadmaps.
Blockstream Research’s Jonas Nick framed the publication as “the first concrete proposal for a post-quantum signature scheme designed specifically for Bitcoin.” He also narrowed expectations. “SHRINCS is not intended to be Bitcoin’s ‘final’ signature scheme, and it is not optimal along every axis.” The pitch is pragmatic rather than maximalist. “I do think it is a very good trade-off among the options we have now,” Nick said.
The scheme has already been exercised outside of theory. SHRINCS has signed real transactions on Liquid mainnet and was tested in production on the Liquid sidechain in March 2026, including a transaction that embedded a copy of the Bitcoin white paper.
The Throughput Math: Signature Sizes, SegWit Weighting, and the 3 TPS Claim
The market-structure issue is blockspace. Post-quantum signatures are typically much larger than today’s ECDSA and Taproot Schnorr signatures, and larger signatures compete directly with fee-paying demand.
SHRINCS is hash-based and post-quantum, with a minimum signature size of 548 bytes plus a 48-byte public key. The signature can grow as large as 4,619 bytes. That is still materially larger than Bitcoin’s current signature footprint. The same packet describes Schnorr signatures at 64 bytes and older ECDSA signatures at 70 bytes, putting SHRINCS at roughly nine times Schnorr at the low end before it grows.
SegWit changes how that translates into effective block consumption. Marin Ivezic, founder of Applied Quantum and author of PostQuantum.com, described the key nuance: “Under SegWit, signature bytes fit in the witness and take a quarter as much as other transaction data,” meaning a raw byte comparison overstates the fee-market impact when the extra bytes sit in witness.
Blockstream’s earlier research estimates put rough throughput bounds on the trade. Under those assumptions, Bitcoin could run at about 6.5 transactions per second if everyone used Taproot Schnorr signatures. The same estimates put NIST lattice-based ML-DSA at about 0.5 TPS and NIST hash-based SPHINCS+ at about 0.36 TPS. SHRINCS lands at about 3 TPS, described as similar to today.
That 3 TPS figure is the core claim traders should care about. It implies a post-quantum migration path that does not automatically reprice blockspace into a structurally scarcer regime the way sub-1 TPS outcomes would.
The Catch for Wallets: Stateful Signing, Growing Signatures, and Oversized Recovery
The BIP itself is explicit about maturity. It warns “a security proof is TODO.” That is not a footnote. It is a gating item for serious third-party review, cryptanalysis, and any conversation about standardization.
The bigger near-term risk is operational. SHRINCS is stateful. It stores used one-time keys on the device to prevent reuse, rather than wrapping those keys in a large stateless structure the way SPHINCS+ does. The savings come with a new failure mode: the wallet has to track state correctly, forever.
Two concrete mechanics matter. Signatures grow by 16 bytes each time they are used. Device loss also forces a stateless fallback recovery transaction of about 5,777 bytes. That is a recovery path that is both operationally heavy and blockspace-expensive, and it concentrates risk into the exact moment users are already under stress.
The BIP also calls out a compatibility trap that can turn into a hard loss. SHRINCS keys generated using hypertree pruning for the stateless component are not compatible with implementations that do not support hypertree pruning. The document warns that importing a key across incompatible implementations may result in lost funds.
Yoon Auh, founder of BOLTS Technologies, summarized the design trade-off as an accumulation of wallet-side assumptions: “statefulness, compact signing paths, fallbacks, assumptions about how many times a seed is initialized, and rules for when devices must switch to larger stateless signatures.” He added: “That may be pragmatic engineering, but it is also complexity and fragility introduced largely to maximize throughput and minimize computation cycles. In Bitcoin, every new consensus rule becomes a permanent maintenance obligation, and every wallet-side assumption becomes a possible user failure mode.”
From Liquid to Bitcoin: Hardware Wallet Demos, ZK Aggregation Ideas, and the Governance Bottleneck
The implementation story is moving, but it is not settled. Blockstream demonstrated last week that SHRINCS and other post-quantum signature schemes can run on common hardware wallets, which addresses the usual objection that post-quantum primitives are too heavy for constrained devices.
The roadmap also includes a second lever: compressing many signatures into a small proof. Ethereum’s post-quantum approach described in the packet uses signature aggregation via a small zero-knowledge proof per block. A similar idea is under consideration for Bitcoin, but it is described as a fairly radical change that would face a steep activation battle.
Blockstream’s own estimate is that combining ZK proof aggregation with SHRINCS could double Bitcoin’s speed to about 6.7 TPS. That is the upside case for fees and throughput, but it comes with a governance cost that is likely higher than a signature-only swap.
Near-term, the concrete milestones are less about activation talk and more about review and coordination. The BIP’s “security proof is TODO” flag makes proof completion and any announced third-party audits the first hurdle. Wallet and library alignment on hypertree pruning support is another, because the proposal itself warns of fund-loss outcomes under incompatibility. The last practical test is operational: more production-style usage that exercises stateful signing and the roughly 5,777-byte stateless recovery path under real conditions, not just demos.
My Read: Post-Quantum Progress Is Getting Concrete, but the Risk Surface Is Moving to Operations and Coordination
The threshold that matters is not the 3 TPS estimate. It is whether the proposal can clear the maturity bar implied by its own “a security proof is TODO” warning, then survive third-party cryptanalysis without forcing a redesign that blows up the sizing assumptions.
If SHRINCS does progress, the real test is wallet coordination. Stateful signing, growing signatures, and hypertree-pruning incompatibilities are the kind of edge cases that do not fail in a lab. They fail in recovery flows, migrations, and vendor mismatches, which is where Bitcoin users actually lose money. This only becomes structurally important if the ecosystem can standardize implementations tightly enough that “post-quantum” does not translate into “operationally brittle.”
