What Is SHRINCS? Blockstream's Quantum-Resistance Proposal for Bitcoin

Blockstream Research has proposed SHRINCS, a new digital signature scheme designed to help Bitcoin prepare for powerful quantum computers. It tackles one of the hardest practical problems in post-quantum cryptography: signatures are often so large that they consume substantial block space and reduce the number of transactions the network can process.

The compact SHRINCS signature starts at roughly 324 bytes. That is larger than the 64-byte Schnorr signature Bitcoin uses today, but considerably smaller than many other post-quantum alternatives. For now, however, SHRINCS remains a research project and draft proposal. It is not active on Bitcoin.

Why Bitcoin needs to prepare for quantum computing

Bitcoin uses digital signatures to prove that a transaction was authorized by the holder of the private key without revealing that key. Its ECDSA and Schnorr signatures rely on mathematical problems involving elliptic curves. Conventional computers cannot feasibly work backwards from a public key to recover its private key.

A sufficiently powerful quantum computer could change that. Shor's algorithm may eventually make it possible to derive a private key from an exposed public key much faster. Coins whose public keys are already visible on the blockchain could therefore become vulnerable before others.

No quantum computer has been shown to break Bitcoin signatures today. The reason researchers are working on this problem now is that changing cryptography across a decentralized network can take years. A credible migration requires design work, public review, testing, software and hardware support, and broad agreement across the Bitcoin ecosystem. Waiting until an attack becomes practical would leave too little time.

What is SHRINCS?

SHRINCS stands for Shrunken SPHINCS. It is a hash-based post-quantum signature scheme. Blockstream's design uses SHA-256, a function already embedded throughout Bitcoin, including mining, block data structures and parts of address construction.

The proposal gives one public key two ways to authorize a spend:

1. A compact, stateful path: the wallet records which one-time signing keys have already been used. This produces signatures that begin at about 324 bytes and grow by roughly 16 bytes each time the same key signs again.
2. A larger, stateless recovery path: if a device is lost, wiped or restored from a backup without its former signing history, the owner can still sign without relying on that state, but the signature will be larger.

A useful analogy is a numbered coupon book. As long as the wallet remembers which coupons have been redeemed, it can use the compact route. If that record disappears, SHRINCS still provides a recovery route that does not require guessing which coupons were used, though the resulting transaction takes more space.

Why signature size matters

Every signature must be carried with its transaction. Larger signatures mean fewer transactions fit into a block. If many users ever needed to move coins during a quantum emergency, limited block space could push fees higher and slow down the migration.

Blockstream estimates that a practical SHRINCS parameter set using signatures of about 580 bytes could support roughly three transactions per second. The SLH-DSA configuration used for comparison comes in at approximately 0.36 transactions per second. These are modelled figures based on particular transaction formats and assumptions, not fixed network speeds under every condition.

SHRINCS does not require every transaction to become larger immediately

Blockstream's approach is designed as an optional path rather than a mandatory replacement for every signature from day one. A user could create a Taproot output that commits to both a conventional Schnorr key and a post-quantum spending path.

While quantum computers remain an impractical threat, the owner could spend through the compact Schnorr path as usual. The SHRINCS route would stay hidden inside the Taproot structure until it was needed. This would let users prepare an emergency exit without paying the cost of a larger signature on every transaction in advance.

SHRINCS was tested on Liquid. Is it ready for Bitcoin?

No. In March 2026, Blockstream Research demonstrated a SHRINCS-signed transaction on Liquid, a Bitcoin sidechain. The test showed that the signature could be generated and verified on a live network. Liquid, however, uses Simplicity, which provides more flexibility for adding new verification conditions than Bitcoin mainnet currently offers.

Bitcoin would first need a new instruction capable of verifying SHRINCS signatures. That change would need to move through the Bitcoin improvement process, receive sustained review from developers and cryptographers, and ultimately gain enough network support for a soft fork.

What still needs to be solved?

1. Wallets must manage signing state reliably

SHRINCS achieves its compact size by using one-time keys. A wallet therefore needs an accurate record of which keys have already been used. If multiple devices fall out of sync, or an old backup is restored carelessly, the wallet may need to fall back to the larger stateless signature. Backup design, device migration and a clear user experience are all essential.

2. The draft is not a production standard

The proposal remains a draft. Parts of the security analysis and specification are still being developed, and the reference software has not been audited for protecting real funds. Publication of the research does not mean Bitcoin has selected SHRINCS.

3. It is still larger than Schnorr

Even in compact form, a starting SHRINCS signature is about five times the size of a Schnorr signature, and it grows as the same key signs again. Block-space demand and fees would still need careful planning if a large portion of the network migrated at the same time.

4. Bitcoin requires network consensus

No company can unilaterally change Bitcoin's rules. A technically sound proposal still needs open scrutiny, implementation work and adoption by node operators, miners, wallet developers, service providers and users.

Do current hardware wallets support SHRINCS?

No consumer hardware wallet can use SHRINCS on Bitcoin mainnet today because the network itself does not support it. Blockstream has nevertheless benchmarked hash-based signature calculations on several device families, including Jade, Trezor, Ledger and BitBox02. The early results suggest that currently available hardware can perform these calculations, although some parameter sets may take several seconds or around a minute.

Those benchmarks show hardware feasibility, not current firmware support. If Bitcoin eventually adopts this approach, manufacturers would still need to build secure firmware, backup procedures and signing-state management that ordinary users can operate safely.

What should Bitcoin holders do now?

1. Do not move coins solely because of this news: SHRINCS is still a proposal, and no quantum computer is currently known to break Bitcoin signatures in practice.
2. Avoid address reuse: receiving to a fresh address reduces how long the public key of an unspent coin is exposed.
3. Protect your recovery phrase: phishing, malware and poor backup storage are immediate risks today, unlike a practical quantum attack.
4. Follow wallet software and firmware updates: a future post-quantum migration may require an update and possibly a transfer to a new output type.
5. Ignore services claiming to offer an instant quantum upgrade: there is currently no official action that enables SHRINCS for Bitcoin mainnet holders.

Will SHRINCS be Bitcoin's final answer?

It is too early to say. Blockstream notes that SHRINCS is not best in every category and does not have to become Bitcoin's only post-quantum signature scheme. Lattice-based signatures, proof-based signature aggregation and combinations tailored to different wallets and use cases remain active areas of research.

SHRINCS is valuable now because it turns a broad debate about whether Bitcoin can survive quantum computing into questions that can be measured and tested: signature size, hardware-wallet performance, node burden, recovery design and the process for changing network rules.

Frequently asked questions

Can quantum computers steal Bitcoin today?

There is no evidence that any quantum computer can currently recover a private key from a Bitcoin signature in a practical amount of time. SHRINCS is advance preparation for a possible future threat.

Is SHRINCS active on Bitcoin?

No. It remains research and a draft proposal. Bitcoin adoption would require further review, a complete specification and agreement on a network rule change.

Does SHRINCS use the same SHA-256 as Bitcoin mining?

It uses SHA-256 as its security foundation, as do several important parts of Bitcoin. The calculation pattern and purpose of a digital signature are different from mining.

Does a hardware wallet protect Bitcoin from quantum computers?

A hardware wallet isolates private keys from internet-connected devices and reduces many risks that exist today. It does not automatically make Bitcoin's current signature scheme quantum-resistant. Network-level protection requires a change to Bitcoin's signature system.

Would SHRINCS require a hard fork?

The proposed route adds signature verification through a soft fork, allowing older software to continue following the chain. The exact activation design still needs community review.

Conclusion

SHRINCS is an attempt to balance post-quantum security with Bitcoin's limited block space. Its main advantages are a hash-based signature starting at about 324 bytes, a fallback route when a device loses its signing state, and reliance on SHA-256, which Bitcoin already uses extensively.

Important work remains. Wallet state must be handled safely, fallback signatures are larger, the security design needs more review and any network change requires broad support. SHRINCS should therefore be viewed as a meaningful step in Bitcoin's long-term preparation, not proof that the quantum problem has already been solved.

Last reviewed: 28 August 2026. This article is for technology and security education only and is not investment advice.