Mentioned in This Article
1. Trezor weighs the cost of quantum computing for Bitcoin wallets
Trezor Chief Technology Officer Tomáš Sušánka has outlined why the quantum computing Bitcoin challenge is a wallet problem as much as a protocol one. Speaking in an interview promoted on November 12, 2026, he said SHRINCS, the community's leading post-quantum signature candidate, includes compact stateful signatures that could cost users their funds if a one-time key is ever reused.
Hardware wallet makers such as Trezor exist to keep private keys offline, away from internet-connected computers where malware can reach them. Holding bitcoin has always involved some degree of risk, and these devices are designed to reduce it. But the shift toward cryptography that can withstand future quantum computers brings a new set of design problems, and Sušánka's comments show that the companies building signing devices will carry much of the burden of getting the transition right.
His central concern is that the most efficient form of signature on offer also demands the most careful bookkeeping. A mistake in that bookkeeping would not merely cause an error message. It could hand an attacker the information needed to forge signatures and drain a wallet.
2. Why does quantum computing threaten Bitcoin?
Quantum computing threatens Bitcoin because a sufficiently powerful quantum machine could, in principle, derive a private key from its public key, breaking the elliptic curve cryptography that Bitcoin uses to authorize spending today. Classical computers cannot feasibly perform that calculation, which is why current signatures are considered secure.
The defense being discussed across the industry is to adopt post-quantum signature schemes, which rely on mathematical problems that quantum computers are not expected to solve efficiently. Hash-based signatures are one of the most conservative families of these schemes, because their security rests on the properties of hash functions, a well-studied area of cryptography that Bitcoin already depends on heavily.
Moving Bitcoin to a new signature scheme is not a simple software patch. It would require agreement across the network on a new standard, new address types, and new software at every layer, from node implementations to the wallets people use to send and receive coins. Hardware wallets sit at the end of that chain, and their constraints shape what is practical.
3. What is SHRINCS?
SHRINCS is a hash-based post-quantum signature proposal put forward late last year by Jonas Nick, research director at Blockstream Research, and cryptographer Mikhail Kudinov. Its defining feature is a composite design that lets a user produce either a stateful signature or a stateless one from the same setup.
The two options sit at opposite ends of a trade-off. Stateless signatures are large. Their size affects transaction fees, since bigger transactions cost more to include in a block, and it can slow signing and weigh on other measures of efficiency. Their advantage is that they are safe to reuse: a wallet can produce as many as it needs without tracking anything.
Stateful signatures are much smaller and more efficient. Sušánka put the difference at roughly 10 times. The catch is that they are only secure within a fixed signing budget, and exceeding that budget, or reusing a key, opens serious security holes.
The reason lies in how the stateful component is built. It is structured as a tree of one-time signatures. Each key in that tree is meant to sign exactly once. If the same one-time key is used to sign twice, enough information leaks that an attacker can forge signatures and steal the funds it protects. The wallet must therefore remember, reliably and permanently, which keys it has already used. That record is the "state" in stateful.
Offering both modes in one scheme is meant to give wallets flexibility rather than forcing a single answer on the whole network. In practice, that flexibility moves the decision to the people building wallets. They must choose which mode to use, when to use it, and how to guarantee that the compact option is never used in a way that breaks its security, all without making everyday use of bitcoin harder for the people who rely on their products.
4. "An option to mess up": the burden on wallet makers
Sušánka's worry is that if Bitcoin adopts SHRINCS, the job of tracking signing state falls on wallet developers, and that job is full of edge cases where a small oversight becomes a security failure. The design, he said, "gives them an option to mess up."
In his view, the responsibility for keeping that from happening belongs to the manufacturer, not the person holding the coins. Users should not need to understand one-time signature trees in order to keep their savings safe. A wallet maker that ships a product built on stateful signatures has to guarantee that state is never lost, rolled back or duplicated, under every circumstance a device might face.
Some of those circumstances are ordinary. Devices fail, get lost or are replaced. Firmware gets updated. Users restore wallets from backups. Each of those events is a moment where a record of used keys could fall out of sync with reality, and with stateful signatures, a stale record can lead directly to key reuse.
5. The two-device problem with stateful signatures
Sušánka offered a concrete example of how quickly the problem becomes difficult. Many people keep two hardware wallets initialized from the same recovery seed, one for daily use and one as a backup, or one at home and one in a separate location. With today's signatures, that setup is harmless.
With stateful signatures, it raises a hard question: how would the two devices share state? If both can sign from the same tree of one-time keys, each needs to know which keys the other has used. Sušánka's assessment was blunt. Effectively, they cannot. Two offline devices with no channel between them have no reliable way to coordinate, which means a user signing from both could unknowingly reuse a key.
That example captures why the efficiency gains of stateful signatures come at a real cost. The features that make hardware wallets secure, isolation and the ability to restore from a seed, are the same features that make state tracking hard.
6. Trezor considers making stateless signatures the default
Trezor is weighing ways to support a secure user experience if SHRINCS is adopted. One option under consideration is to make the heavier, slower stateless signatures the default for every user, and to place the riskier stateful option behind advanced settings for those who understand what they are choosing.
Under that approach, most users would pay somewhat more in fees and accept slower signing in exchange for a scheme that cannot be broken by accidental reuse. Experienced users who want the efficiency of stateful signatures could opt in, taking on the responsibility that comes with it.
Sušánka acknowledged that he is "kind of torn." SHRINCS may be the conservative cryptographic choice, he noted, because it relies on the same security assumptions as SHA-256, the hash function already at the heart of Bitcoin's mining and address system. If SHA-256 holds up, so does the scheme. That is an appealing property for a network that prizes caution. Yet maintaining state remains a burden that he does not take lightly.
He stressed that every option involves trade-offs. Because stateful signatures are about 10 times smaller, a meaningful saving for a network where block space is scarce, he said he does not want to rule them out entirely.
7. Quantum readiness reaches beyond signatures
Most of the discussion about a quantum migration concentrates on addresses and transaction signatures. Sušánka pointed to a less visible layer: the hardware itself. Many signing devices rely on quantum-vulnerable cryptography to authenticate their firmware and to prove that the device is genuine.
Those checks are what stop an attacker from loading malicious software onto a wallet or passing off a counterfeit device as authentic. If the cryptography behind them could be broken by a quantum computer, a wallet that signs transactions with post-quantum algorithms could still be compromised at a lower level.
For full protection in a post-quantum world, Sušánka said, users will need devices that use post-quantum cryptography for device and firmware authentication as well. That is a hardware question, not just a software one, which means some existing devices may not be able to deliver complete quantum resistance no matter what updates they receive.
Trezor already sells the Trezor Safe 7, which supports post-quantum cryptography for wallet authentication. Transactions signed on these devices will become quantum-secure only after Bitcoin itself upgrades to a post-quantum signature scheme, so the device is prepared, but the network has not yet made its move.
8. What comes next for Bitcoin's post-quantum migration
Sušánka urged developers not to wait too long before offering migration options. Moving millions of users to new address types and new signing methods will take time, and a transition started late leaves less room to fix problems along the way.
He also called for flexibility in the debate. People should be "ready to make compromises," he said, arguing that rigid demands about what is acceptable will only stall progress. For hardware wallet makers, that likely means accepting that no option is free: larger signatures cost fees and speed, smaller ones cost safety margin, and new hardware costs users money.
For bitcoin holders, the practical takeaway is that quantum readiness will arrive in layers. The network must agree on a new signature standard, wallet software must implement it safely, and signing devices must be able to authenticate themselves with quantum-resistant cryptography. How Trezor and its competitors handle the stateful-versus-stateless question will be one of the clearest signs of how carefully that transition is managed.