SHRINCS BIP Published: Quantum-Secure Bitcoin Comes With Real Tradeoffs
Blockstream's Jonas Nick published the first BIP for SHRINCS, a post-quantum signature scheme production-tested on Liquid. The scheme is promising, the security proof is not finished, and the path to soft-fork activation is years away.
The most Bitcoin-native post-quantum signature proposal ever written just entered the formal review process, and the BIP itself has not yet received a completed security proof.
Key takeaways
- Blockstream Research's Jonas Nick published a Bitcoin Improvement Proposal for SHRINCS on August 27, 2026, the first formal post-quantum signature proposal built specifically for Bitcoin and already production-tested on the Liquid sidechain since March 2026.
- The scheme is SHA-256-only, supports BIP-39 seed recovery, and enables roughly 3 TPS under the SegWit witness discount, far ahead of NIST-approved alternatives that would push Bitcoin below 0.5 TPS. The BIP's accompanying materials note that a formal security proof is still outstanding.
- SHRINCS's compact signing path is stateful, meaning a device must track key usage. Restoring a seed to a new device forces a fallback to larger signatures. Accidental state reuse can compromise funds. This is a self-custody problem, not just a developer problem.
Blockstream Research's Jonas Nick published a Bitcoin Improvement Proposal for the SHRINCS post-quantum signature scheme on August 27, 2026, first reported by Cointelegraph. In the OP_CHECKSHRINCS blog post published in May 2026, Nick framed the state of play directly: "There is no concrete proposal for a post-quantum signature scheme in Bitcoin today", the SHRINCS BIP is intended to be that proposal. Blockstream has already deployed the scheme in production on the Liquid sidechain. The BIP is a serious research milestone. It is not a deployable fix.
What SHRINCS Actually Is
SHRINCS is a hash-based post-quantum signature scheme designed by Nick and Blockstream researcher Mikhail Kudinov. It was introduced on Delving Bitcoin in December 2025, the opcode proposal OP_CHECKSHRINCS followed in May 2026, and Blockstream ran a live test transaction on Liquid mainnet in March 2026, including a copy of the Bitcoin white paper as padding.
The scheme's security rests entirely on SHA-256, the same hash function Bitcoin mining already depends on, and it supports full BIP-39 seed recovery. Those two properties make it categorically more Bitcoin-native than the NIST-approved post-quantum standards.
The NIST-approved alternatives, ML-DSA (lattice-based) and SLH-DSA/SPHINCS+ (hash-based), are substantially larger than Bitcoin's current Schnorr signatures. Per Blockstream's OP_CHECKSHRINCS research, deploying ML-DSA would drop Bitcoin to roughly 0.5 TPS. SPHINCS+ lands at 0.36 TPS. A fully Taproot-optimized network today runs at about 6.5 TPS.
SHRINCS, using the SegWit witness discount (witness bytes cost one-quarter of non-witness bytes), gets Bitcoin to approximately 3 TPS. That is close to today's actual throughput. It is not a free lunch, but it is the least bad option currently on the table.
The Catches the BIP Spells Out
Three constraints matter for anyone beyond the cryptography research community.
First, per reporting on the BIP and Blockstream's own publication, a formal security proof is still outstanding. SHRINCS has not been audited and has not weathered the years of public cryptanalysis the NIST schemes have accumulated. Marin Ivezic, founder of Applied Quantum and author of PostQuantum.com, told Cointelegraph the scheme is a serious contender even at this early stage, calling it "the strongest answer yet to going post-quantum without wrecking Bitcoin's block economics," while also noting the audit gap. Nick himself framed expectations clearly: "SHRINCS is not intended to be Bitcoin's 'final' signature scheme, and it is not optimal along every axis."
Second, the compact signing path is stateful. The signing device must track how many one-time keys it has consumed. Restore your seed to a new hardware wallet and the scheme automatically falls back to a larger stateless signature mode, which is safe but significantly bigger.
Reuse signing state carelessly and the security of those specific keys is compromised. This is not an edge case for developers to handle quietly. It changes the hardware wallet story in ways that node runners and self-custody advocates need to understand now, before any activation conversation gets serious. The Coldcard Mk3 security incident is a useful reference point for how quickly a signing implementation flaw becomes a funds-loss event.
Third, the TPS math already applies the SegWit discount, and it still shows degradation. Any scenario that forces the stateless fallback, such as device restores or new wallet setups, produces signatures considerably larger than the compact path and erodes that 3 TPS headroom.
The block-size-increase debate is not resolved by this BIP. Blockstream explicitly decoupled the size question from the signature proposal, which is the right process call. It is also a deferred fight.
What the Timeline Actually Looks Like
The Treasury's quantum readiness task force has put post-quantum cryptography on the policy clock, but policy pressure does not accelerate Bitcoin's consensus process. Taproot, the last major soft fork, ran 22 months from published BIPs to activation, and it faced essentially no organized opposition.
SHRINCS has no assigned BIP number as of publication, no completed security proof, no independent cryptanalysis period, and a governance environment considerably noisier than 2020-2021. A realistic activation window, assuming the cryptanalysis goes well and community consensus forms, is 2028 at the earliest.
Holders of legacy pay-to-public-key UTXOs, including some Satoshi-era coins, should not plan around imminent relief. The BIP is the starting gun, not the finish line.
The thesis here is falsifiable. If independent cryptanalysts complete a formal security proof for SHRINCS within the next 12 to 18 months, the scheme survives a community audit period comparable to Taproot's, and a soft-fork activation path emerges without requiring a block size increase, then "research milestone" becomes "deployable upgrade on schedule." That sequence is possible. It is not guaranteed, and nothing in the BIP suggests it should be treated as probable yet.
Sources
- Blockstream OP_CHECKSHRINCS blog post, Jonas Nick, May 12, 2026
- Blockstream "Searching for SHRINCS Parameters"
- Blockstream Quantum Defense page
- Blockstream Q2 2026 Quarterly Update
- First reported by Cointelegraph, August 27, 2026
Frequently Asked Questions
No. A published BIP is the beginning of the review process. SHRINCS still needs a completed formal security proof, independent cryptanalysis, and a multi-year soft-fork activation process. It is a serious research milestone, not a deployed protection.
NIST-approved schemes like ML-DSA and SLH-DSA are substantially larger than Bitcoin's current signatures and would drop Bitcoin's throughput to well under 1 TPS. SHRINCS achieves approximately 3 TPS using the SegWit witness discount, with security resting entirely on SHA-256 rather than on lattice-based or newer mathematical assumptions that have seen far less real-world analysis.
A stateful scheme requires the signing device to remember how many one-time keys it has already used. Restoring a seed to a new device forces SHRINCS into a larger stateless fallback mode (still safe, but bigger signatures). If signing state is corrupted or reused, the security of those specific keys can be compromised. Hardware wallet firmware design becomes meaningfully more complex under SHRINCS than under Schnorr.
