The short version
- Bitcoin quantum threat: Blockstream Research names Falcon-1024 its top lattice signature, at 3,073 bytes per key and signature versus 96 bytes today, but says it isn’t ready to deploy.
- Bitcoin Core contributor Cory Fields suggested quantum landmines and auctions that would make a thief of old coins lose their own collateral.
- About 6.26 million BTC, 31.2% of supply, sits behind a public key already visible on-chain, Glassnode counted in October.
- Next: every fix is still a draft. Follow Base Camp on X to see it first when one moves toward activation.
Nobody has a quantum computer that can break Bitcoin. Yet the people who maintain it spent this week arguing about what to do on the day someone does.
Two ideas landed within days. Blockstream is pushing its research on lattice signatures again, and named Falcon-1024 as the one it would pick. Longtime Bitcoin Core contributor Cory Fields posted a plan to booby-trap old coins so a quantum thief walks into a trap instead of a payday.
Both answer the same Bitcoin quantum threat from opposite ends. One is about the new locks. The other is about the coins that will never get one.
Blockstream put the research back in front of its followers on Friday:
Bitcoin can add new signature schemes to stay ahead of quantum computing. @blksresearch is studying lattice-based signatures to help figure out what that upgrade should look like.
blog.blockstream.com/lattice-signat…
What Did Blockstream Find About Lattice Signatures?
Falcon-1024 is the best lattice option on paper, but it isn’t ready to go on-chain yet. That is the short answer from Blockstream Research’s report, first published on August 26 and pushed again this week.
Some background. Bitcoin signs transactions with Schnorr and ECDSA signatures. They are tiny and cheap. They are also exactly what a big enough quantum computer could break, using Shor’s algorithm from 1994. Lattice signatures are built on a different kind of maths problem that quantum machines aren’t known to solve.
The team tested three schemes. Here is what each would cost on-chain:
Every byte is downloaded and stored by every full node, so size matters a lot.
- Falcon is the most compact and the fastest to verify. Its weak spot is signing, which uses floating-point maths that can differ between chips. A safe fix makes signing about 15 times slower, which Blockstream calls the right trade, since a coin is signed once and checked by every node.
- Dilithium is the simplest to build safely and already ships in OpenSSL and Apple’s CryptoKit. It is also the biggest.
- Hawk was even smaller than Falcon. Then researchers Straznickas and Weis of Anthropic found a structural weakness, and its team withdrew it from the US standards process.
Hawk is the warning label on the whole field. A scheme can be three rounds deep into a standards contest and still lose a big part of its security to one paper.
Blockstream’s own summary when the report came out in August was blunt:
If Bitcoin had to choose a lattice signature today, it would be Falcon-1024.
@blksresearch has published a full report on Dilithium, Falcon and Hawk: what each costs on-chain, how hard each is to implement safely, and which assumptions you are trusting.
blog.blockstream.com/lattice-signat…
So why not ship Falcon now? Three problems. NIST hasn’t published the final Falcon standard (FN-DSA). There is no workable way to derive many addresses from one master key, the trick every modern wallet relies on. And signing needs about 90 kB of memory, a lot for a small hardware wallet.
That is why Blockstream still calls hash-based signatures the conservative choice for now. Its team co-wrote SHRINCS, a hash-based design posted to the Bitcoin developer mailing list as a draft BIP in August. Falcon could later replace its backup signature with something much smaller, the company said in its third-quarter update.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
Landmines and Auctions for Quantum Thieves
The second idea starts where new signatures can’t help.
On November 4, Cory Fields posted “Quantum Landmines and Vulnerable Coin Auctions” to the Bitcoin developer mailing list. He calls the ideas thought experiments and leaves the soft-fork mechanics for later.
The starting point: after “Q-day”, the day a quantum computer can crack old keys, anyone spending a coin from an old output type would have to put up the same amount again as collateral. The spend then sits in limbo for a while, say 30 days.
That waiting period is where the traps live.
- Landmine: before Q-day, Alice tucks a hidden proof inside a tiny, normal-looking quantum-safe output. If a thief later cracks her old key and spends her coin, Alice reveals the proof during the 30 days, gets her coin back and takes the thief’s collateral too.
- Staked auction: many old coins have no owner left to set a mine. So anyone can lock coins before Q-day as a secret bid on a specific old output. If a thief grabs it, the bidder reveals the bid and claims part of the thief’s collateral. The stolen coins themselves are burned.
- Sats auction: a version suggested by Neha Narula, who runs MIT’s Digital Currency Initiative, built on the “dollar auction” game. The top bidder wins the coins minus the bid, and the runner-up loses theirs. The rational move for an attacker is not to play at all.
The clever part is the doubt. Nobody can tell which outputs are mined, so every theft becomes a gamble with the thief’s own money. Fields admits the hard question is still open: should the goal be to scare attackers off, to let them win sometimes, or to hand old coins out like a lottery?
No replies on the list yet. It is a few days old.
SIDE TRAIL: Bitcoin Core Vulnerability Found by AI Crashed Windows Nodes
Which Coins Are Actually at Risk?
Coins whose public key is already visible on the blockchain. A quantum computer needs that key to work out the private key, and most modern addresses only show it at the moment you spend.
Glassnode counted how many coins sit in the open:
6.26M #BTC, or 31.2% of supply, sits behind a public key that is already visible on-chain.
At least that much would have to move in a migration to addresses whose keys are still hidden behind a hash.
The share is up from 24.8% in early 2021 and back at 2016 levels.
🧵 1/6
That was 6.26 million BTC, or 31.2% of supply, in early October. In its May report, Glassnode split the exposure in two:
- Exposed by design: 1.92 million BTC in early output types such as P2PK, which includes coins tied to Satoshi Nakamoto, plus old bare multisig and Taproot.
- Exposed by habit: about 4.12 million BTC in addresses that were reused after a spend. Exchanges hold a big share of these.
The second group can fix itself with a fresh address. The first mostly can’t, because many of those keys are believed to be lost. That pile is the hardest part of the Bitcoin quantum threat, and the one Fields’ auctions are about. Freeze them and you break the promise that nobody touches your Bitcoin. Leave them and a thief may get over a million BTC.
The market isn’t reacting. Bitcoin trades at $76,092 at the time of writing, down 0.2% on the day.
How Far Off Is a Fix for the Bitcoin Quantum Threat?
Years. Nothing is close to activation.
The main pieces are all drafts:
- BIP 360 (Pay-to-Merkle-Root): a new Taproot-like output without the key path, so coins at rest don’t expose a key. Status: Draft. Its authors say it guards against long exposure only, not against a key cracked while a transaction waits in the mempool.
- SHRINCS: the hash-based signature draft BIP. In August, Blockstream showed hardware wallets from Trezor, Ledger, BitBox and its own Jade can already sign with it, in about 22 to 42 seconds.
- Falcon: the smaller post-quantum signatures, waiting on NIST’s final standard and a fix for wallet key derivation.
Any of these would need a soft fork, and then every holder would have to move their coins by hand. Bitcoin’s last big upgrade, Taproot, took about four years from proposal to activation.
TRAIL MAP: How to Set Up a Crypto Wallet
What a holder can do today is dull but real. Don’t reuse addresses, keep long-term coins in a wallet you control, and move them when a quantum-safe address type ships.
One fresh address won’t save the 1.92 million BTC that can’t move. It does keep yours out of that pile.
TheCryptoMonk has been trading since 2017 and reads the market from the top down. The focus is macro and the high timeframes: where stocks, rates and liquidity are heading, and what the weekly and monthly charts say about Bitcoin. Short-term noise matters less than the bigger trend.
More from TheCryptoMonk
