Bitcoin's Quantum Security: The First Real-World Tests
Quantum security for Bitcoin is gradually moving beyond the realm of theory. Researchers at Blockstream are working on SHRINCS —a new digital signature scheme designed to help the network withstand the emergence of sufficiently powerful quantum computers without a critical drop in throughput.
On August 27, this development once again drew attention to a question that, until recently, had seemed far-fetched: What will happen to Bitcoin if quantum computers learn to attack the cryptography used today?
This isn't about a quantum computer simply "breaking Bitcoin" one day. The main potential vulnerability lies in the digital signature mechanism, which the owner uses to prove their right to dispose of their BTC.
Today, Bitcoin uses ECDSA and Schnorr—schemes based on elliptic curves. For conventional computers, it is virtually impossible to derive a private key from a public key. However, a sufficiently powerful quantum computer, using Shor's algorithm, could theoretically solve such a problem.
That is exactly why developers start looking for a replacement ahead of time.
Why the problem isn't with SHA-256
The quantum threat to Bitcoin is often reduced to the question of whether a quantum computer will be able to “break SHA-256.”
That's not quite right.
SHA-256 is used in proof-of-work, hashing, and other parts of the system, but the quantum algorithms known today do not offer the same advantage against it as they do against elliptic curve cryptography.
The main risk is associated with public keys.
If, in the future, a quantum computer is able to derive a private key from a public key, an attacker would be able to generate a valid signature and attempt to spend someone else’s BTC.
In other words, it is not the blockchain itself as a structure that is at risk, but rather the mechanism for proving ownership of coins.
Millions of BTC already have public keys that have been disclosed
The scale of the potential problem depends on which types of addresses are taken into account.
Blockstream cites an estimate from Chaincode Labs, according to which approximately 30% of the BTC in circulation—about 6 million coins—are already associated with public keys disclosed on the blockchain. Other estimates cited by Blockstream range from approximately 4 million to 10 million BTC.
This does not mean that these coins are vulnerable today. There are currently no computers with the necessary processing power.
But it is precisely these addresses that may be the first targets of future attacks.
With P2PKH and P2WPKH, the public key is hidden behind a hash until it is spent. However, when Bitcoin is sent, it is revealed in the transaction.
Theoretically, in a quantum future, this could lead to an arms race:
The owner sends BTC → the public key becomes visible → the attacker calculates the private key → attempts to create a competing transaction before the original one is confirmed.
It is precisely with this scenario in mind that developers are beginning to design new security measures.
What is SHRINCS?
One of Blockstream Research's solutions was the SHRINCS scheme —the Stateful Hash-based Reduced-size Incremental CoSign Scheme.
Instead of relying on elliptic curves, it uses an approach based on hash functions.
The idea is to create a digital signature against which Shor's algorithm would not have the same advantage as it does against Schnorr or ECDSA.
But this raises another problem: post-quantum signatures are significantly larger than current ones.
And it is precisely the size of the signature that becomes one of the main limitations.
The Price of Post-Quantum Security: Transaction Size
A standard Schnorr signature in Bitcoin is about 64 bytes long.
In post-quantum circuits, this volume could increase several times or even by an order of magnitude.
If we simply replace the current signature scheme with a heavy post-quantum one, each block will contain significantly fewer transactions.
According to estimates, using the standardized NIST SLH-DSA scheme could reduce Bitcoin's estimated throughput by approximately:
from 6.5 to 0.36 transactions per second.
For a network with limited block space, this is a significant trade-off.
Therefore, the challenge is not only to make the signature resistant to quantum attacks, but also to keep it sufficiently compact.
What SHRINCS Offers
The first SHRINCS signature can be about 324 bytes long.
For the configuration that Blockstream considers more practical for Bitcoin, we're talking about roughly 580 bytes.
That is still significantly larger than the current Schnorr signature.
But the difference from other post-quantum options is significant.
According to Blockstream's estimates, Bitcoin with SHRINCS could maintain its throughput at approximately:
Up to 3 transactions per second.
By comparison, the calculations for SLH-DSA indicated a rate of approximately 0.36 transactions per second.
In other words, SHRINCS doesn't eliminate the switching cost, but it makes it much less painful.
The first tests have already taken place
SHRINCS is not limited to theoretical calculations.
On March 3, 2026, Blockstream conducted the first transactions using post-quantum signatures on the Liquid Network —Bitcoin’s production sidechain.
The Simplicity smart contract language was used for the experiment. Transactions with post-quantum signatures were conducted on a live network.
This is an important step, but Liquid is not the Bitcoin mainnet.
For a mechanism like this to be implemented directly in Bitcoin, a change to the protocol rules would be required.
Bitcoin will require a soft fork
One of the proposed options calls for a new opcode:
OP_CHECKSHRINCS
It would allow Bitcoin to verify SHRINCS signatures directly at the network level.
That said, the transition could be made gradually.
For example, a Taproot output could contain two ways to spend the funds:
- a standard Schnorr key;
- post-quantum SHRINCS key.
As long as the quantum threat remains theoretical, users continue to use Schnorr.
If the situation changes, funds can be transferred via a post-quantum channel. This approach would allow the migration to be spread out over several years, rather than attempting to overhaul the entire network on an emergency basis.
The most difficult issue is old Bitcoin
Technically, it is possible to transfer active coins to the new security system.
But what should be done with BTC held by owners who will never do that?
There are coins on the network whose private keys were lost long ago. There are addresses belonging to early miners. Approximately 1 million BTC, which are usually associated with the Satoshi Nakamoto era, are the subject of a separate discussion.
If old, vulnerable signatures are left in use indefinitely, a sufficiently powerful quantum computer could theoretically attack such coins in the future.
However, if the old schemes are shut down after a prolonged migration period, the lost BTC will effectively be locked away forever.
This is where the issue ceases to be purely technical.
The Bitcoin community may someday have to choose between maintaining full backward compatibility and protecting older coins from a future quantum attacker.
Such a dispute could turn out to be much more complicated than the development of SHRINCS itself.
SHRINCS has not yet been finalized
It is important to understand that SHRINCS is not an approved future Bitcoin standard.
Blockstream is also exploring other approaches, including lattice-based signatures —signatures based on lattice cryptography.
Among the families under consideration are Falcon and Dilithium. These solutions offer different advantages and trade-offs in terms of size, complexity, and multisig capabilities.
Therefore, it is more accurate at this point to speak not of a completed quantum upgrade for Bitcoin, but of the beginning of the practical selection of an architecture.
What makes SHRINCS interesting is that it has already reached the stage of real-world testing.
The quantum threat remains a future scenario for now
As of today, there is no publicly known quantum computer capable of deriving a Bitcoin private key from its public key.
No one can say for sure when this technology will become available either.
We could be talking about years, decades, or even the more distant future.
Therefore, claims that Bitcoin is supposedly on the verge of a quantum hack would be an exaggeration today.
But what makes Bitcoin unique is that such changes cannot be prepared in just a few weeks.
We need to develop a new cryptographic system, test it, conduct an audit, get the protocol change approved, and then give millions of account holders time to transfer their funds.
That is why the work begins long before the threat itself appears.
Bitcoin is already being prepared for the next phase of security
What's important about the SHRINCS story isn't the mere fact that yet another cryptographic scheme has emerged.
The key point is this: Bitcoin developers are already beginning to prepare the network for a world in which today’s digital signatures may one day prove insufficient.
However, there is no need to rebuild the entire Bitcoin network from scratch.
Proof-of-work remains.
Blockchain is here to stay.
The supply cap of 21 million BTC remains in place.
One fundamental element is changing— the way in which the right to control coins is proven.
Initial tests indicate that a technical path to post-quantum security exists.
But the biggest challenge for Bitcoin may not be the quantum computer itself.
It will be much more difficult to decide what to do with the millions of BTC whose owners will never switch to the new security measure.
Ethereum is also already preparing for the quantum threat
Bitcoin isn’t the only major network that’s preparing in advance for the possible emergence of powerful quantum computers. We’ve previously discussed how Ethereum has begun developing its own defenses against the quantum threat and what changes the network may need to make in the future.
Read more: Ethereum has begun preparing for the quantum threat
Source: Blockstream Research — Quantum Computing and Bitcoin