Bitcoin quantum migration is the real quantum problem, not the quantum computer. That is the argument Ledger CTO Charles Guillemet made in a technical analysis published September 16: "Bitcoin does not have a quantum computer problem today," he wrote — it has a migration problem, and migrations could take years to get right. His review of SHRINCS, the first Bitcoin-specific post-quantum signature proposal to make what he calls a serious end-to-end trade-off, is the sharpest look yet at what moving the network off elliptic-curve signatures would actually demand from wallets, hardware and the hundreds of billions in dormant coins.
No cryptographically relevant quantum computer is known to exist, and the timing of one remains uncertain. But Bitcoin's ECDSA and Schnorr signatures are built on elliptic curves that Shor's algorithm could theoretically break given sufficient hardware, and the industry has started designing for that day. The question Guillemet forces is harder than choosing an algorithm: who moves the coins, and what happens to the ones nobody can move.
Why Bitcoin Quantum Migration Is a Wallet Problem
Guillemet splits the transition into three problems: selecting a post-quantum signature scheme, adapting wallets and protocol infrastructure to it, and deciding how existing BTC migrates to quantum-resistant outputs. The third is the nasty one. It includes coins whose owners lost their keys years ago or have simply never moved funds — and reaching social agreement over vulnerable legacy coins, he writes, is among the harder unresolved questions. Stanford cryptographer Dan Boneh has landed in a similar place: prepare for quantum risk, but avoid a rushed migration that could introduce severe software failures — a caution worth remembering while Bitcoin's broader upgrade machinery is already struggling to activate any soft fork at all.
Migration also cannot be judged by cryptographic strength alone. Wallets, hardware devices, backup systems and multi-device setups must implement any new scheme safely, and the features users rely on today do not carry over cleanly. Non-hardened BIP32 derivation — the trick behind watch-only wallets — has no efficient hash-based equivalent. Threshold signing, which Schnorr handles compactly, would require larger signatures or different trust assumptions. On some secure hardware, post-quantum key generation and the stateless path take minutes rather than milliseconds.
What SHRINCS Actually Proposes
The draft builds on SHA-256, the hash family Bitcoin already trusts, targeting roughly 128 bits of classical and 64 bits of quantum security. A 48-byte public key commits to two signing paths: a compact stateful route using Flexible XMSS and WOTS+C with signatures from 548 bytes to 4,619 bytes, and a stateless fallback based on SLH-DSA concepts — the scheme NIST standardized as FIPS 205 in August 2024 — producing 5,777-byte signatures. Those numbers matter because an earlier SHRINCS draft circulated a much-cited 324-byte figure that Guillemet says no longer describes the proposal. Against today's 64-byte Schnorr signatures, every current option is a block-space tax.
Blockstream Research, which has already demonstrated SHRINCS verification on the Liquid sidechain through Simplicity — the same network that processed its own high-stakes recovery this month — argues hash-based signatures offer conservative assumptions and cheap verification. The specification, though, remains unfinished: no BIP number, and its formal security proof is literally marked "TODO" in the draft.
The Stateful Trap
The compact path's cost is state. Every one-time signing key must be used exactly once, so a wallet keeps a counter that must advance before a signature ever leaves the device. Reuse the same slot for two messages and an observer can forge a valid signature — the attacker never needs the full seed to steal the funds. Backups make this worse: restoring an old wallet backup can restore a stale counter, and two hardware devices initialized from one seed can burn the same slot independently. An independent Project Eleven review by Alex Pruden and Conor Deegan reached the same conclusion: the scheme pushes a security-critical state requirement into wallets and custody systems, where rollback is a normal operational event.
SHRINCS' answer is the stateless fallback: a seed can always derive the 5,777-byte path, so losing state costs efficiency, not spendability — a design choice Guillemet ranks among the proposal's strongest. The wallet must then permanently retire the compact route for that key.
The Policy Vacuum at the End
None of this is scheduled. BIP 360, Pay-to-Merkle-Root, would strip Taproot's quantum-vulnerable key-path spend, but it is a Draft that introduces no post-quantum algorithm. BIP 361, which phases a sunset of legacy ECDSA and Schnorr spending after a quantum-resistant output type exists, is also a Draft. Until one of them moves, Bitcoin's honest quantum posture is research plus a date nobody can name — and the migration, whenever it starts, will be judged less by cryptography than by how many wallets, backups and sleeping coins survive the trip.
