Mentioned in This Article
1. Blockstream's quantum-resistant Bitcoin signature pick
Blockstream Research has named Falcon-1024 as its preferred lattice-based signature scheme for a future quantum-resistant Bitcoin, according to a research report the company published in 2026. The scheme packs a public key and signature into 3,073 bytes, making it the most compact of the lattice options examined. The same report stresses that Falcon-1024 is not ready for deployment and that any transition would be gradual.
The distinction matters for anyone following quantum computing and Bitcoin. A recommendation from a research team is an input to a long engineering and governance process, not a decision to change the network. Bitcoin's rules change only through broad agreement among developers, node operators, miners and users, and nothing in the report alters that. It sets out which cryptographic tools look most promising and what each would cost.
The report evaluates three lattice-based signature families: Dilithium, Falcon and Hawk. Each was judged against the constraints that shape Bitcoin: scarce block space, the need for every node to verify every signature, and the importance of keeping the cost of running a node low. Falcon-1024 came out ahead on the strength of its size and the speed at which it can be verified.
2. Why does Bitcoin need quantum-resistant signatures?
Bitcoin relies on digital signatures to prove that the person spending coins controls the matching private key. Today's signatures are built on elliptic-curve mathematics, which is believed to be secure against ordinary computers. A sufficiently powerful quantum computer running Shor's algorithm could, in theory, derive a private key from a public key, which would let an attacker forge signatures and move coins that belong to others.
No quantum computer capable of doing this exists today, and the Blockstream report does not change that assessment. The concern is about preparation time. Changing the signature scheme of a decentralized network with trillions of dollars of value takes years of research, review, software development, wallet upgrades and user migration. Researchers therefore study candidate replacements well before the threat becomes practical.
Post-quantum schemes fall into several families. Lattice-based designs, such as Falcon and Dilithium, rely on the difficulty of certain geometric problems in high-dimensional lattices. Hash-based designs rely only on the security of hash functions, a property Bitcoin already depends on heavily. Each family trades off size, speed and maturity in different ways, and the Blockstream work examines both families side by side.
3. How does Falcon-1024 compare with other lattice candidates?
Falcon-1024 wins on compactness. Its combined public key and signature occupy 3,073 bytes, a figure given for the scheme's highest security category. By comparison, a standard Bitcoin signature today is only tens of bytes long, so even the smallest lattice option represents a large jump in the data each transaction must carry.
Size matters because Bitcoin's block space is limited and is sold through transaction fees. If each signature is dozens of times larger, fewer transactions fit in each block, and fees could rise unless the network adapts. Among the lattice options the report considered, the one that carries the least data per signature therefore has a natural advantage, and Falcon-1024 holds that position.
Verification speed is the second point in its favor. Every full node checks every signature in every block it receives. A scheme that verifies quickly keeps the burden on node operators manageable, which in turn helps preserve the ease of running a node that underpins Bitcoin's decentralization. Slow verification would push up hardware requirements and could narrow the set of people able to participate.
4. What are Falcon-1024's drawbacks?
The report lists several problems that keep Falcon-1024 from being a drop-in choice. The first is memory: the signing process requires roughly 90 KB, which the report describes as a high demand. That is modest for a desktop computer but significant for the small, constrained devices on which hardware wallets run.
The second is implementation difficulty. Falcon relies on floating-point arithmetic, the kind of calculation that handles fractional numbers. Floating-point operations can behave differently across processors and software environments, and the report says this makes a correct and consistent implementation harder to achieve. In a consensus system, where every participant must reach identical results, such inconsistencies carry real risk.
The third is the absence of native support for hierarchical deterministic key derivation, commonly called HD derivation. This feature lets a wallet generate a large tree of keys from a single seed phrase, and it underlies the backup and address-management habits of most Bitcoin users. Without a native equivalent, wallet designers would need new methods, and the report suggests everyday users may feel this gap more than any other.
The fourth is standardization. Falcon-1024 has not reached final standardization, which means details of the scheme could still change. Building Bitcoin's long-term security on a design that is not final would mean committing to a target that might move, a difficult position for a network that places a premium on stability and conservatism.
5. What is the conservative hash-based track?
Blockstream does not treat Falcon-1024 as its only path. The company is also developing more conservative, hash-based signature options. Its proposal in that category, called SHRINCS, reached draft status as a Bitcoin Improvement Proposal, or BIP, in late August 2026.
A BIP is the formal document through which changes to Bitcoin are described and debated. Draft status means the proposal is open for public review and criticism. It does not signal approval, and the draft itself acknowledges that further proposals would be needed before anything could be deployed on the network, including the definition of a new output type.
Hash-based schemes appeal to cautious engineers because their security rests on assumptions Bitcoin already makes. The trade-off is practical: such signatures tend to be larger or carry restrictions on how keys are used, which is why a research team can reasonably pursue both a hash-based and a lattice-based route at the same time.
Blockstream has also tested post-quantum signing in practice. In March 2026 its researchers confirmed a first transaction signed with a post-quantum scheme on the Liquid Network, the company's sidechain. A sidechain is a separate blockchain linked to Bitcoin, so the test did not touch Bitcoin's main network, but it offered real-world experience with the tooling involved.
6. What would a transition look like?
The research points toward a staged transition rather than a single switch. New signature types would likely be introduced as optional output types first, allowing users to move coins at their own pace while older types continue to work. Over time, wallet software, hardware devices, exchanges and custodians would all have to add support.
Blockstream frames Falcon-1024 as a strategic long-term option whose adoption depends on standards maturing and on the implementation problems being solved. It is not presented as an immediate plan. For now, Bitcoin's current security model remains intact, and the report does not claim otherwise.
Even the most compact lattice scheme produces thousands of bytes per key and signature, so any migration will involve trade-offs in block space and fees. Developers will have to weigh those costs against the security benefit, and different parts of the community may reach different conclusions about how quickly to move.
7. What does this mean for wallets and users?
Wallet developers face the most work. The HD derivation gap and the 90 KB signing requirement both affect hardware and software wallets, which would need to adapt before lattice schemes could reach ordinary users. Features that people take for granted, such as restoring a full wallet from a single seed phrase, would need careful redesign.
Ordinary holders have no immediate action to take. The report does not suggest that funds are at risk today, and no network-wide change is scheduled. What it offers is a clearer picture of the options and their costs, which helps the community judge how much time is needed to prepare.
8. Why do these trade-offs matter to the wider network?
Every design choice in a post-quantum signature scheme lands on a shared resource. Larger signatures consume block space, which raises the price of getting a transaction confirmed. Heavier verification raises the cost of running a node. Demanding signing procedures raise the cost and complexity of building wallets, particularly hardware devices designed to keep keys offline and isolated from the internet.
Because these costs are borne by different groups, miners, node operators, wallet makers and ordinary holders, agreement on any change is hard to reach. A scheme that looks efficient to one group may look burdensome to another. This is part of the reason the report catalogs weaknesses alongside strengths instead of simply announcing a winner, and why Blockstream pairs its lattice work with a more conservative hash-based proposal.
The comparison also shows why a quantum-resistant future is unlikely to depend on a single technology. Different output types could coexist, with users choosing the trade-off that suits their holdings and risk tolerance. A long-term holder storing coins for years might accept larger signatures in return for stronger assurances, while a frequent spender might prefer lower fees.
9. What happens next?
The next steps are public rather than scheduled. The SHRINCS draft remains open to review, and further BIPs would be required to define how any new signature type is used on the network. Falcon-1024 will also depend on progress toward final standardization of the scheme and on engineers resolving its implementation and key-derivation challenges.
No activation date exists for any quantum-resistant signature on Bitcoin. Readers following the topic should watch for further review of the SHRINCS proposal, additional research on the practical costs of lattice signatures, and any movement on standards that would remove the uncertainty surrounding Falcon-1024.