Ledger CTO Charles Guillemet stated that Bitcoin does not face quantum computing issues today, but rather potential migration problems that could take years to resolve, shifting the discussion from the signature scheme itself to the wallet layer that must run this scheme.
He specifically mentioned SHRINCS as the first serious end-to-end trade-off proposal for Bitcoin’s post-quantum draft: based on hash, relying on SHA-256, with a single 48-byte public key that simultaneously commits to a compact stateful path (Flexible XMSS and WOTS+C) and a stateless SLH-DSA fallback. The authors of the draft include Conduition, Ethan Heilman, Mikhail Kudinov, Oleksandr Kurbatov, Jonas Nick, among others, and it is not a proposal from Bitcoin Core.
He referred to the verification side as a pleasant surprise, primarily based on SHA-256, with the draft report indicating that the worst-case unit signature byte cost is lower than that of BIP340 Schnorr. The stateful path uses a one-time key, where each slot can only sign once; the counter cannot roll back and must be written to persistent storage before the signature goes offline, and it must never be restored from backup. If two different messages are signed in the same slot, an observer can steal the funds.
SHRINCS is more stable than purely stateful schemes: when state is lost or uncertain, the seed can still export a stateless key, with the loss being efficiency rather than principal. The cost is that the wallet state changes from application data to cryptographic state, with rollbacks directly risking funds—hundreds of UTXOs corresponding to hundreds of counters, across multiple devices and software wallets, while hash-based key generation can now take minutes on hardware.
He outlined the capabilities that cannot be recovered after migration: non-hardened BIP32 derivation, and today’s observation wallets; compact Schnorr-style threshold signatures. The specifications also state: non-standard SLH-DSA parameters, constructions outside of NIST standards, and security proofs pending completion. The current draft public key is 48 bytes, with stateful signatures ranging from about 548 to 4619 bytes, and stateless fallback around 5777 bytes, compared to Schnorr’s 64 bytes.
In market mechanisms, this is pricing and engineering redistribution driven by expectations of consensus upgrades, rather than an immediate shock of “quantum machines are here.” Computing power and R&D budgets are shifting from algorithm selection to wallet state machines, hardware firmware, and lost coin disposal; hardware wallets and infrastructure needing to rewrite derivation/threshold stacks are under pressure, benefiting from hash-based paths and more efficient block space already validated on the Liquid sidechain. Coins that have never been moved by their owners pose a third question, with almost all public discussions still stuck on the relatively easier first question: which scheme to choose.
Blockstream has estimated: if the entire network used Schnorr, it would achieve about 6.5 transactions per second, standard SLH-DSA could drop to about 0.36 transactions per second, while SHRINCS compact paths could return to about 3 transactions per second; this construction has been validated with signatures on the Liquid mainnet using Simplicity contracts.
Source: Public information