A peer-reviewed paper from Blockstream Research has identified Falcon-1024 as the strongest lattice-based signature candidate for quantum-proofing Bitcoin. The paper, published on August 6, 2026, evaluates three post-quantum signature schemes—Dilithium, Falcon, and Hawk—against Bitcoin’s constraints, but emphasizes that Falcon-1024 is not ready for immediate deployment.
Size and verification advantages
Falcon-1024 won on size. Its combined public key and signature total 3,073 bytes, compared with 5,261 bytes for Dilithium at Category 3. That makes Falcon’s footprint a bit more than half of Dilithium’s, a significant difference on a blockchain where every byte competes for limited block space. Blockstream also highlighted Falcon-1024’s efficient verification times, which matter because every node on the network checks signatures.
Deployment challenges remain
Despite winning the comparison, Falcon-1024 faces several hurdles before real-world use. The paper flags the following issues:
- Memory: Falcon’s signing process requires about 90 KB, which the report describes as a high demand.
- Implementation complexity: Falcon relies on floating-point arithmetic, making correct implementation more complicated.
- Wallet support: Falcon lacks native support for hierarchical deterministic (HD) key derivation.
- Standardization: Falcon-1024 still needs to reach final standardization, meaning any commitment now could target a moving standard.
Parallel conservative track
Blockstream is also pursuing more conservative options, focusing on hash-based signatures. Its hash-based approach, called SHRINCS, reached draft BIP status in late August 2026. A BIP, or Bitcoin Improvement Proposal, is the formal route for suggesting protocol changes, and draft status marks the start of public review rather than approval. SHRINCS has already been tested on Blockstream’s Liquid sidechain, including a post-quantum transaction completed in March 2026.
Staged transition, not immediate switch
The research points toward a staged transition rather than a single switch. Blockstream frames Falcon-1024 as a strategic long-term option contingent on standards maturing, not an immediate deployment plan. Bitcoin’s current security model remains intact for now; no quantum machine capable of compromising Bitcoin signatures exists today, and nothing in the paper changes that.
Still, the size comparison underscores that post-quantum security will not come free. Even the most compact lattice option weighs in at thousands of bytes per key and signature, so any eventual migration will likely force tradeoffs around block space and fees. Wallet makers face the most work, as the HD derivation gap and the 90 KB signing requirement will require adaptation before any lattice scheme can reach ordinary users.
