Bitcoin researchers have unveiled a new proposal designed to protect the network from quantum computers without choking transaction capacity. The draft, called SHRINCS, comes from Blockstream researchers and targets a fundamental weakness in Bitcoin's cryptography: the possibility that a sufficiently powerful quantum machine could reverse-engineer private keys from public data on the blockchain.
Bitcoin transactions today rely on digital signatures that prove ownership of bitcoin. These signatures are generated from a private key that corresponds to a public key. The public key is shared with the world, and it is used to verify that a transaction really did come from the owner of the private key. Under classical cryptography, it is computationally infeasible to derive the private key from the public key, even with the most powerful supercomputers available today. But quantum computers operate on entirely different principles, and algorithms such as Shor's algorithm could, in theory, solve the mathematical problems underpinning Bitcoin's signatures with terrifying efficiency.
The quantum threat is not hypothetical
Bitcoin currently uses elliptic curve cryptography, specifically the Elliptic Curve Digital Signature Algorithm, or ECDSA, and Schnorr signatures. Both are based on the discrete logarithm problem, which is believed to be hard for classical computers but would be solvable by a large-scale, fault-tolerant quantum computer. If an attacker were able to derive a private key from a public key, they could spend the bitcoin controlled by that key. Because every unspent transaction output exposes a public key, an attacker with a powerful quantum computer could potentially sweep funds from any wallet whose public key has been revealed on-chain.
The threat is widely understood in the Bitcoin community. Developers have been exploring quantum-resistant alternatives for years, and standards bodies such as the U.S. National Institute of Standards and Technology, or NIST, have been working on post-quantum cryptographic algorithms for more than a decade. In 2022, NIST announced its first selections for post-quantum cryptography, including CRYSTALS-Kyber for encryption and CRYSTALS-Dilithium, Falcon, and SPHINCS+ for digital signatures. These algorithms are designed to resist attacks from quantum computers, but they come with a trade-off: their signatures are significantly larger than the 64-byte Schnorr signatures currently used by Bitcoin.
Bitcoin's block size is limited, and every transaction must fit into a block that is capped at 1 megabyte of data. The more bytes a signature occupies, the fewer transactions can fit into each block. Under the current design, Bitcoin can process roughly 6.5 transactions per second in the best case. But if Bitcoin were to adopt a NIST-approved quantum-safe signature scheme such as Dilithium or SPHINCS+, the signature size would balloon to thousands of bytes. That would fill blocks much faster, pushing the network's throughput down to less than one transaction per second. Such a drastic drop would make Bitcoin impractical as a payments network, and it would likely lead to higher fees as users compete for scarce block space.
What is SHRINCS?
The SHRINCS proposal aims to solve this problem by offering a quantum-resistant signature scheme that is much more compact than the NIST standards. According to the draft paper, SHRINCS signatures would be approximately 324 bytes, compared to 64 bytes for Schnorr signatures. That is a significant increase—about five times larger—but far smaller than the massive signatures of many post-quantum schemes. The researchers estimate that Bitcoin would still be able to process around three transactions per second if SHRINCS were adopted, preserving a meaningful portion of the network's current capacity.
The name SHRINCS suggests a hash-based or structured approach to signatures, although the technical details are complex. What matters for the broader Bitcoin debate is that SHRINCS appears to offer a middle ground: it provides quantum resistance while maintaining enough efficiency to keep Bitcoin usable.
The proposal is still very much a draft. The researchers note that there is no completed security proof, and the reference software is not meant for production use. Security proofs are essential for any cryptographic system that handles billions of dollars in value. Without a formal proof, there is the risk of unknown attacks that could undermine the scheme's claimed security.
There are also practical concerns. The draft warns that moving certain keys between incompatible wallets could lead to the irreversible loss of funds. This is a serious issue. Bitcoin wallets are built around specific signature schemes, and a new scheme would require changes to how keys are derived and stored. If a user tries to send bitcoin from a wallet that expects one format to a wallet that expects another, there is a real danger that the transaction could be unspendable.
The blockchain exposure problem
One of the reasons quantum-resistant signatures are so important for Bitcoin is that public keys are exposed long before funds are spent. In a typical Bitcoin transaction, the recipient's public key is not immediately revealed. Instead, the bitcoin is locked to a hash of the public key, known as a P2PKH (pay-to-public-key-hash) address. When the recipient later spends that bitcoin, they must reveal the public key to prove ownership. This means the public key is exposed on-chain at the moment of spending, and from that point on, an attacker with a quantum computer could try to derive the private key.
This gives rise to a subtle timing issue. If a user spends bitcoin using a quantum-resistant signature, the public key is still exposed on-chain. But the quantum-resistant signature itself should be secure against quantum attacks, meaning that even if the public key is known, an attacker cannot derive the private key. The problem is that many older transaction outputs use ECDSA or Schnorr keys that are vulnerable. Those funds would need to be moved to quantum-resistant addresses before a quantum computer becomes available.
SHRINCS alone would not protect bitcoin that is still held in legacy addresses. It would only protect new transactions that use the new signature scheme after a soft fork. The broader migration of bitcoin to quantum-safe keys would require a coordinated effort from the entire community, including wallet providers, exchanges, and individual users.
How Bitcoin could adopt SHRINCS
Any change to Bitcoin's signature scheme requires a network upgrade. Since SHRINCS would introduce a new way of signing transactions, it would likely be implemented through a soft fork, which is a backward-compatible upgrade. In a soft fork, older nodes that have not upgraded can still validate blocks, but they may not see all the details of the new transaction format. New rules are imposed, and blocks that violate those rules are rejected by upgraded nodes.
A soft fork for SHRINCS would need to be supported by miners, node operators, wallet developers, and the broader community. Reaching that level of consensus in Bitcoin is not easy. The network is decentralized by design, and changes that affect the security of the system or the efficiency of transactions are often debated for months or years. There are dozens of proposed improvement proposals at any given time, and only a few gain traction.
But the threat of quantum computing is not going away. Major corporations, governments, and research institutions are investing heavily in quantum hardware. Companies like IBM, Google, and Microsoft have made significant advances in quantum error correction, and some researchers believe that a quantum computer capable of breaking RSA or elliptic curve cryptography could be built within the next two or three decades. Others are more skeptical, pointing out that such a machine would need millions of physical qubits, far beyond current capabilities. Still, the consensus in the cybersecurity world is that 'harvest now, decrypt later' attacks are a realistic concern. Attackers today can copy encrypted data and store it until they have access to a quantum computer, then decrypt it retroactively.
For Bitcoin, the stakes are particularly high. The cryptocurrency's entire value proposition depends on the security of its cryptography. If quantum computers were to break ECDSA, the supply of bitcoin held in vulnerable addresses could be stolen, and confidence in the network would collapse. A robust quantum-resistant signature scheme is therefore not just a theoretical exercise; it could be essential for the long-term survival of the system.
Capacity trade-offs and the path forward
The SHRINCS proposal is part of a broader effort to make Bitcoin resilient to quantum threats while preserving its utility. The research shows that there is no need to accept an all-or-nothing trade-off. By designing a signature scheme that balances security and efficiency, developers can give Bitcoin a realistic path to quantum resistance.
Still, the draft itself is cautious about how much confidence is warranted. With no completed security proof, SHRINCS is far from being ready for production. The reference software is intended for research, not for real user funds. And the warning about incompatible wallets highlights the need for careful planning before any deployment.
Bitcoin has weathered many challenges in its history, from scaling debates to regulatory crackdowns. New technologies such as SegWit, Taproot, and the Lightning Network have expanded what the network can do. Quantum-resistant signatures may one day be added to that list, and proposals like SHRINCS ensure that the conversation begins early enough to avoid a last-minute scramble when a shor-scalable quantum computer finally arrives.
For now, the SHRINCS draft is an important contribution to the growing body of research on post-quantum cryptography. It does not claim to have all the answers, but it opens a door to a future where Bitcoin can resist quantum attacks without sacrificing the ability to process transactions at scale.
Reaching that future would require not only a valid security proof and production-grade software, but also the gradual migration of the entire network's keys to quantum-resistant addresses. There will need to be wallet upgrades, exchange updates, and widespread public education. It is a long road, but it is far better than waiting until the first quantum transaction theft occurs to start the journey.
Source: Coindesk News