StarkWare Mines First Quantum-Safe Bitcoin

Blockstream co-founder and CEO Adam Back has a reputation as a quantum computer skeptic who believes the technology is so immature the threat won’t materialize for decades.Which makes it all the more fascinating that his company is one of the leaders in researching practical solutions to the issue. Back told Cointelegraph earlier this year “the safe thing” is to prepare for the threat well in advance.Blockstream has already proven its experimental post-quantum signature scheme called SHRINCS works in production on its Liquid sidechain and a Bitcoin Improvement Proposal for SHRINCS was published earlier today.Blockstream Research’s Jonas Nick called it “the first concrete proposal for a post-quantum signature scheme designed specifically for Bitcoin.” But he added that “SHRINCS is not intended to be Bitcoin’s ‘final’ signature scheme, and it is not optimal along every axis.”I do think it is a very good trade-off among the options we have now.”Source: Jonas NickWhile the timeline is hotly debated, scientists agree that sufficiently advanced quantum computers will be able to reverse engineer private keys from public keys, thereby undermining Bitcoin’s security and enabling the theft of billions. That’s why the race is on to develop ways to upgrade Bitcoin to make it safe from attack. Shrinking the size of post quantum signaturesOne of Blockstream’s most promising areas of study has been in optimizing post-quantum signature schemes for Bitcoin’s requirements to enable the blockchain to keep more of the existing properties Bitcoiners hold dear. The current crop of post-quantum secure hash and lattice-based signature schemes endorsed by the National Institute of Standards and Technology are between 38 and 123 times larger than Bitcoin’s existing ECDSA and Schnorr signatures.Deploying any of them in Bitcoin could slow the blockchain down to a fraction of 1 TPS. Ethereum’s post-quantum team plans to deal with this issue by aggregating signatures using a tiny zero-knowledge proof for each block. That’s under consideration for Bitcoin too, and if implemented, it would see Bitcoin actually run faster than it does today, as a single proof takes less blockspace than a bunch of signatures. But in the Bitcoin world, adding zero-knowledge proofs would be a fairly radical change and face a steep uphill battle to garner enough support for activation. Blockstream is considering that option too, but has wisely separated the proposal from the much more palatable option of figuring out how to shrink the size of NIST-approved hash based post-quantum signatures by around 13.23 times.Related: Bitcoin’s quantum dilemma — Bigger blocks or STARK proofs?Bitcoin optimized small(er) signaturesIn December 2025, Blockstream researchers Jonas Nick and Mikhail Kudinov unveiled the SHRINCS signature scheme, and the opcode proposal was published in May. It’s a hash-based post-quantum signature scheme that has a minimum size of 548 bytes (plus the 48 byte public key) but can grow as large as 4,619 bytes.“SHRINCS is the most Bitcoin-native post-quantum signature design anyone has produced,” explains Marin Ivezic, author of PostQuantum.com and founder of Applied Quantum.“[It has] full BIP-39 seed recovery, and security resting on the same SHA-256 assumptions Bitcoin mining already depends on.” He tells Magazine the scheme is still at an early stage and hasn’t been audited, nor has it benefited from the years of public cryptanalysis the NIST signatures have weathered. But he says even at this early stage, it’s a serious contender.“It is real code that has signed real transactions on Liquid mainnet, and I rate it the strongest answer yet to going post-quantum without wrecking Bitcoin’s block economics.”Despite being much smaller than most post-quantum signatures, SHRINCS will still be around nine times larger than Bitcoin’s existing Schnorr signatures, which are 64 bytes, or the older ECDSA signatures, which are 70 bytes. It might seem logical to assume that a signature nine times larger than the current ones would require Bitcoin’s block size to increase nine times to compensate, but Ivezic explains that’s not the case due to Bitcoin’s Segregated Witness.“Under SegWit, signature bytes fit in the witness and take a quarter as much as other transaction data,” he says. According to estimates published in Blockstream’s earlier research (using slightly different parameters), Bitcoin could run at 6.5 transactions per second if everyone used Taproot’s Schnorr signatures (about 80% of people don’t). The blockchain’s speed would drop to 0.5 TPS if Bitcoin used the NIST-approved lattice-based signature ML-DSA and to just 0.36 TPS using the NIST-approved hash-based signature SPHINCS+.But employing SHRINCS, the blockchain could run at 3 TPS, which is similar to today. SHRINCS was tested in production on the Liquid sidechain in March this year — they even included a copy of the Bitcoin white paper. So if it works in production, everything is fine and Bitcoin’s quantum problems are solved, right?Source: BlockstreamSHRINCS sounds great: What’s the catch?As the BIP warns, “a security proof is TODO” meaning that the research is promising but it is not yet a cryptographically mature proposal that has been fully validated.It also introduces additional complexity to Bitcoin.Every signature uses a new one-time key, and one of the reasons SPHINCS+ is so large is because it wraps all of those one-time keys in a multi-layer hash tree structure that makes the scheme stateless. SHRINCS does away with all of that to save on space, and just stores used keys on your device (which is known as stateful) so it can quickly check keys aren’t being reused. The drawback is that signatures get larger by 16 bytes each time they are used, and if you lose your device, it requires a very large “stateless fallback” transaction around 5,777 bytes to recover.  Yoon Auh, founder of BOLTS Technologies, says in reducing the size, SHRINCS’ designers added “statefulness, compact signing paths, fallbacks, assumptions about how many times a seed is initialized, and rules for when devices must switch to larger stateless signatures.”“That may be pragmatic engineering, but it is also complexity and fragility introduced largely to maximize throughput and minimize computation cycles. In Bitcoin, every new consensus rule becomes a permanent maintenance obligation, and every wallet-side assumption becomes a possible user failure mode.”  Refining SHRINCS and adding SHRIMPSBlockstream has been researching and optimizing the scheme throughout 2026. Just last week it demonstrated that SHRINCS, and a range of other post quantum signature schemes, can effectively run on common hardware wallets. The BIP carries the warning however that this is not without risk:SHRINCS keys generated using hypertree pruning for the stateless component are not compatible with SHRINCS implementations which do not support hypertree pruning. In fact, importing a key across such incompatible implementations may result in lost funds.In March, the lab published a companion scheme called SHRIMPS, which was to be used in conjunction with SHRINCS to enable backup devices initialized from the same seed to be able to sign transactions. The SHRIMPS names has now been dropped for the BIP, and the scheme has been incorporated as a built in stateless path under the same 48 byte public key. It has been optimized with a non standard parameter set to be around 26% smaller than otherwise.Blockstream has also been experimenting with lattice-based signature schemes, which are generally smaller than hash-based schemes but are seen as less proven and less reliable. It’s also considering the use of ZK proof aggregation of signatures. It estimates that if ZK proofs are used in conjunction with SHRINCS, Bitcoin’s speed could double to 6.7 TPS. Blockstream has wisely separated the choice of signatures from questions around increasing the block size or adding ZK proof aggregation, as considering them together could sink the adoption of SHRINCS. Every post quantum upgrade to Bitcoin will be controversial and hard to gather enough support to activate. “The binding constraint in Bitcoin’s quantum migration isn’t cryptography, it’s governance,” says Ivezic. “Between BIP-360, BIP-361, SHRINCS and STARKs, the engineering menu is filling up fast. What Bitcoin lacks is a mechanism for choosing from it before the clock runs out.”Magazine: 5 tech predictions the mainstream media got horribly wrongCointelegraph publishes long-form journalism, analysis and narrative reporting produced by Cointelegraph’s in-house editorial team with subject-matter expertise. All articles are edited and reviewed by Cointelegraph editors in line with our editorial standards. Some articles contain affiliate links, from which Cointelegraph may earn a commission. These relationships do not influence which products we review or our editorial conclusions. Content published in here does not constitute financial, legal or investment advice. Readers should conduct their own research and consult qualified professionals where appropriate. Cointelegraph maintains full editorial independence.