Ongoing research into quantum-resistant Bitcoin systems has produced several new proposals and early-stage implementations, reflecting continued efforts to address long-term cryptographic risks posed by the advent of quantum computing. These advancements span novel signature schemes, softfork-less transaction methods, and innovative wallet recovery mechanisms, collectively demonstrating a proactive stance within the Bitcoin development community against a potential future threat. The accelerating pace of quantum computing research has brought into sharper focus the theoretical vulnerability of current cryptographic standards. Bitcoin, like many digital assets and secure communication protocols, relies heavily on elliptic curve cryptography (ECC), specifically the Elliptic Curve Digital Signature Algorithm (ECDSA), for transaction signing and public key generation. The security of ECDSA is predicated on the computational difficulty of solving the elliptic curve discrete logarithm problem. However, quantum algorithms, most notably Shor’s algorithm, could theoretically break this problem efficiently, rendering existing ECDSA signatures insecure. While cryptographically relevant quantum computers capable of executing Shor’s algorithm are still considered years, if not decades, away, the long-term immutability and security requirements of Bitcoin necessitate early and robust preparation. Experts widely acknowledge that the development and standardization of post-quantum cryptography (PQC) solutions must begin well in advance of the actual threat, given the significant lead time required for implementation, testing, and widespread adoption in a decentralized system like Bitcoin.
Advancing Post-Quantum Signatures: The SHRIMPS Proposal
Jonas Nick, a prominent researcher at Blockstream, a company at the forefront of Bitcoin and blockchain technology innovation, recently introduced SHRIMPS (Scalable Hash-based Signatures for Multi-device Post-Quantum Security). This proposed post-quantum signature scheme is designed to facilitate secure transaction signing across multiple devices while maintaining relatively compact signature sizes, a crucial factor for blockchain efficiency and user experience. Nick unveiled SHRIMPS through a detailed discussion on the Delving Bitcoin forum and an anouncement on social media on March 30, 2026, marking a significant step in hash-based signature research.
SHRIMPS builds upon the foundation of SHRINCS (Scalable Hash-based Signatures for Single-device Post-Quantum Security), an earlier development that offered highly compact (~324-byte) hash-based signatures but was limited to single-device usage. The primary innovation of SHRIMPS lies in its ability to extend this security model to multi-device configurations. According to Nick, SHRIMPS enables multiple devices, all derived from the same cryptographic seed, to generate approximately 2.5 KB signatures. This multi-device capability is critical for modern Bitcoin wallet architectures, which often involve multiple hardware wallets, mobile devices, or other forms of key management for enhanced security and convenience.
The design of SHRIMPS is particularly noteworthy for its integration of two SPHINCS+ instances, operating with distinct primary and fallback paths. SPHINCS+ is a stateless hash-based signature scheme that was selected by the U.S. National Institute of Standards and Technology (NIST) as a standard for post-quantum cryptography in 2022, underscoring its robust security profile. By leveraging SPHINCS+, SHRIMPS inherits strong security assurances while introducing optimizations for multi-device environments. This dual-path approach allows for flexible and resilient signature generation, adapting to various operational conditions. The resulting signature sizes, at around 2.5 KB, are notably smaller than some other stateless alternatives, such as SLH-DSA, which can produce signatures around 7.8 KB. SLH-DSA is another NIST-standardized hash-based signature scheme, forming part of the SPHINCS+ family, and its comparison highlights SHRIMPS’ efficiency in terms of data footprint.
The practicality of SHRIMPS is further enhanced by its support for hybrid setups. This allows for scenarios where SHRINCS could be used for primary, frequently accessed devices, while SHRIMPS handles backup or less frequently used devices. Such flexibility is paramount for Bitcoin wallets, where users often employ a combination of hot wallets for daily transactions and cold storage solutions for long-term holdings. The ability to manage keys across these diverse setups with a consistent post-quantum secure framework represents a significant leap forward for wallet developers aiming to future-proof their offerings. The compact signature size is also vital for the Bitcoin blockchain, where every byte of data contributes to transaction fees and block space consumption. While 2.5 KB is considerably larger than current ECDSA signatures (typically around 72-73 bytes for P-256), it represents an optimized solution within the current landscape of post-quantum signature schemes, balancing security with practical network considerations.
Quantum-Safe Bitcoin Without Protocol Changes: Levy’s Proposal
In parallel to developments in signature schemes, Avihu Levy introduced a compelling proposal titled "Quantum-Safe Bitcoin Transactions Without Softforks." This groundbreaking method outlines a way to construct quantum-resistant Bitcoin transactions using only existing consensus rules, circumventing the need for potentially contentious and complex network-wide softforks. Levy’s approach, which he refers to as Quantum Safe Bitcoin (QSB), represents a significant effort to provide immediate, backward-compatible quantum resistance for Bitcoin transactions. His proposal was shared publicly via GitHub and social media on April 9, 2026, sparking considerable interest.
QSB fundamentally re-architects the cryptographic underpinnings of Bitcoin transactions by replacing the reliance on elliptic curve cryptography with hash-based constructions. The core objective of this design is to mitigate the risks posed by quantum algorithms like Shor’s, which, as mentioned, could theoretically break ECDSA. Instead of depending on the difficulty of solving discrete logarithms on elliptic curves, QSB shifts the security paradigm to the well-understood and currently quantum-resistant property of hash pre-image resistance.
The proposal builds upon earlier conceptual work known as Binohash, which explored the use of hash functions for transaction validation. Levy’s QSB introduces a "hash-to-signature" puzzle, where the validity of a transaction depends on a prover demonstrating knowledge of a pre-image to a specific hash output, rather than possessing a valid ECDSA signature for an elliptic curve public key. This design leverages established cryptographic hash functions such as RIPEMD-160, a component already deeply embedded in Bitcoin’s address scheme (as part of P2PKH and P2SH). The security of hash functions like RIPEMD-160 and SHA-256 against quantum attacks is primarily challenged by Grover’s algorithm, which offers a quadratic speedup for brute-force attacks, meaning a 256-bit hash function would effectively have 128 bits of security against a quantum adversary. While this is a reduction, it is not a catastrophic break like Shor’s algorithm against ECDSA, and adequately sized hash outputs remain secure. By relying on these hash functions, QSB offers a strong defense against the most immediate quantum threat to Bitcoin’s signing mechanism.
A key advantage of QSB is its operation within Bitcoin’s existing constraints, including opcode and script size limits. This means that the quantum-safe transactions can theoretically be constructed and validated by current Bitcoin nodes without any protocol upgrades. However, a significant practical consideration is that these transactions would likely be deemed "non-standard" by most network nodes. Standardness rules are heuristics enforced by nodes to prevent denial-of-service attacks and ensure efficient propagation of transactions. Non-standard transactions might not be relayed by the peer-to-peer network and may require direct submission to miners for inclusion in a block. This implies a higher barrier to entry for users and potentially higher transaction fees, as miners would have to explicitly include these transactions, perhaps outside the normal mempool propagation process.
The computational cost for constructing such QSB transactions is estimated to range between $75 and $150, primarily utilizing GPU resources. This cost, while significant for typical daily transactions, could be acceptable for high-value cold storage transactions or for users prioritizing absolute quantum resistance for specific UTXOs. The economic implications suggest that QSB might serve as a niche, albeit crucial, solution for specific use cases rather than a widespread replacement for all Bitcoin transactions without further network upgrades.
Securing Wallet Recovery in a Post-Quantum World: Osuntokun’s Prototype
Adding another critical layer to Bitcoin’s post-quantum defense strategy, Olaoluwa Osuntokun, a co-founder and CTO of Lightning Labs and a prominent figure in the Bitcoin and Lightning Network development, has developed a prototype focused on wallet recovery in a post-quantum scenario. Osuntokun’s work, publicly referenced on April 8, 2026, addresses a specific, yet potentially catastrophic, vulnerability during a transition to quantum-safe cryptography.
The system utilizes zk-STARK (Zero-Knowledge Scalable Transparent ARguments of Knowledge) proofs to allow users to demonstrate ownership of a wallet derived from a seed phrase without revealing the seed itself. This is particularly ingenious because many legacy Bitcoin wallets are derived from seed phrases that, if their underlying cryptographic principles (like ECDSA) were to be compromised by quantum computers, could expose the entire wallet history and funds. A direct upgrade scenario might disable legacy signature schemes, potentially rendering older wallets inaccessible if users cannot transition their funds to a quantum-safe format.
Osuntokun’s prototype is designed to specifically address this limitation. In an emergency upgrade scenario, where legacy signature schemes might be disabled or deprecated due to an imminent quantum threat, users of older wallets could face the risk of losing access to their funds. The zk-STARK-based recovery system provides a mechanism for these users to prove their legitimate ownership of the wallet, derived from a seed phrase, without ever exposing the potentially vulnerable seed. This proof of ownership can then be used to migrate funds to a new, quantum-resistant address or to initiate a recovery process under new rules.
The performance metrics of the prototype are impressive for a zero-knowledge proof system. It generates proofs in under a minute on consumer hardware, with verification completed in a matter of seconds. The proof sizes are around 1.7 MB. While 1.7 MB is a substantial amount of data, the primary use case is wallet recovery, which is an infrequent, high-stakes event, making these sizes manageable. zk-STARKs are known for their scalability and transparency, making them suitable for such complex cryptographic proofs. This development ensures a critical safety net, allowing for a smoother and more secure transition period for existing Bitcoin holders, protecting them from potential "lockout" scenarios if the network were to rapidly transition to new cryptographic standards.
Osuntokun underscored the community’s dedication, stating, "proposals to make Bitcoin Post Quantum secure are actively being researched, discussed and developed by Bitcoin developers all around the world." This statement highlights the collaborative and global nature of the efforts to secure Bitcoin’s long-term future.
The Broader Context: Quantum Computing and Bitcoin’s Future
These developments unfold against a backdrop of increased discussion and investment in quantum computing. While the exact timeline for a "cryptographically relevant" quantum computer remains uncertain, with estimates ranging from 10 to 30 years, the potential impact on public-key cryptography is undeniable. Governments, academic institutions, and private corporations worldwide are investing heavily in quantum research, driving both hardware and algorithmic advancements. This global race necessitates a proactive and multi-faceted approach to PQC for critical financial infrastructure like Bitcoin.
The Bitcoin network, with its global reach and significant market capitalization, represents a prime target for any entity possessing quantum capabilities. While current ECDSA implementations are considered secure against classical computers, a quantum computer capable of running Shor’s algorithm could theoretically derive a private key from a public key. Bitcoin transactions often expose public keys on the blockchain. Specifically, in Pay-to-Public-Key-Hash (P2PKH) transactions, the public key is revealed when funds are spent, making the associated private key vulnerable to quantum attacks at that point. Unspent Transaction Outputs (UTXOs) whose public keys have already been revealed are at particular risk. This "harvest now, decrypt later" threat implies that even if a quantum computer is decades away, adversaries could be collecting public keys today to decrypt them in the future.
The U.S. National Institute of Standards and Technology (NIST) initiated its Post-Quantum Cryptography Standardization Process in 2016, with the goal of soliciting, evaluating, and standardizing quantum-resistant cryptographic algorithms. This multi-year process has already yielded initial standards, including SPHINCS+ (used in SHRIMPS) and ML-
