Key Highlights
- Charles Guillemet said Bitcoin faces no immediate quantum-computer threat, but migration planning could take years.
- SHRINCS combines stateful hash-based signatures with a stateless fallback using SHA-256-based cryptography.
- The draft targets NIST security category 1, with a 48-byte public key and signatures up to 5,777 bytes.
Ledger Chief Technology Officer Charles Guillemet has published an analysis of SHRINCS, a draft Bitcoin Improvement Proposal for post-quantum signatures. In the analysis, Guillemet stated that Bitcoin does not face an immediate quantum-computer threat but that migration planning is required because the process could take years.
In a blog post on September 16, Guillemet noted that Bitcoin’s ownership model relies on digital signatures and that a cryptographically relevant quantum computer would break ECDSA and Schnorr signatures.
He wrote that no such machine exists today and that the timing of one remains unknown. He added that waiting until a concrete threat appears would be irresponsible given the time needed for research, implementation, deployment, and user adoption.
Three questions in the migration
Guillemet identified three distinct questions for any Bitcoin migration to post-quantum signatures. The first is which post-quantum signature scheme Bitcoin should support. The second concerns the changes that the scheme would impose on the protocol and the wallet ecosystem. The third concerns how existing coins would be migrated, particularly those that have never been moved by their owners.
He observed that the last two questions remain unresolved and that reaching social consensus on the treatment of quantum-vulnerable coins presents a significant challenge.
Details of the SHRINCS proposal
SHRINCS, short for “Shrunken SPHINCS,” is a draft BIP proposed by Conduition, Ethan Heilman, Mikhail Kudinov, Oleksandr Kurbatov, Jonas Nick, and remix7531. Guillemet described it as one of the first serious Bitcoin-specific post-quantum proposals. The specification was still evolving as of September 2026 and is not a Bitcoin Core institutional proposal.
The design relies on hash-based signatures that use SHA-256, the hash function Bitcoin already depends on, thereby avoiding additional hardness assumptions such as those used by lattice-based schemes. It combines a compact stateful component based on Flexible XMSS and WOTS+C with a larger stateless fallback based on SLH-DSA using a non-standard parameter set. The draft targets NIST security category 1.
In the current draft, the public key is 48 bytes. Stateful signatures range from 548 to 4,619 bytes, and the stateless signature is 5,777 bytes. These sizes remain substantially larger than current Schnorr or ECDSA signatures of 64 to 72 bytes.
State management and wallet implications
Guillemet explained that the compact path relies on one-time keys organized in a Merkle tree. Each key may be used only once. The signer must maintain a counter that never moves backward, must increment it in persistent storage before releasing a signature, and must prevent concurrent signing or restoration from backup. Reuse of the same slot for different messages would allow observers to forge signatures.
If the state is lost or uncertain, the seed can still derive the stateless key and produce a valid signature of 5,777 bytes. State loss therefore results in loss of efficiency rather than loss of funds. Guillemet noted that blockchain scanning alone cannot confirm that a one-time leaf was never used, because a signature may have been created and never broadcast.
He stated that managing counters across hundreds of UTXOs and multiple devices turns wallet state into a cryptographic state whose rollback can compromise funds. Hash-based key generation and the stateless path can take on the order of minutes on current secure hardware. Non-hardened BIP32 derivation and compact Schnorr-style threshold signing are not preserved under the hash-based approach.
According to the draft, worst-case verification cost per signature byte is lower than that of BIP340 Schnorr signatures because verification consists mostly of SHA-256 computations. Guillemet observed that larger signatures still increase bandwidth, propagation time, storage, and initial synchronization costs, which affect who can run a full node.
Related corporate activity of Ledger
Separately, Ledger faces a putative class-action lawsuit filed on August 27, 2026, in the U.S. District Court for the Southern District of New York. The complaint, docketed as case number 1:26-cv-07307-VM, seeks damages of no less than $500 million and alleges responsibility for a $1.9 million loss claimed by one customer.
The filing estimates a potential class of 210,000 people and connects the loss to an earlier data incident through allegations pleaded on information and belief.
Guillemet’s analysis concluded that SHRINCS makes a serious end-to-end trade-off by providing compact signatures under conservative assumptions while introducing new operational requirements for wallets. He stated that the specification remains a draft whose security proof is pending and that selecting the signature scheme may be the easiest of the migration questions.
Also Read: DTCC Adds Ondo’s Oasis Pro Markets to Fund/SERV Network
