Blockstream Picks Falcon-1024 as Bitcoin's Leading Quantum-Resistant Signature Candidate

Blockstream Bitcoin Quantum Security Research Identifies Falcon-1024 as a Leading Candidate

Blockstream Bitcoin quantum security research has identified Falcon-1024 as a promising cryptographic solution that could help protect the world's largest cryptocurrency from future quantum computing attacks.

In its November 5, 2026, quarterly update, Bitcoin infrastructure company Blockstream highlighted its ongoing work on post-quantum cryptography, including research comparing three lattice-based digital signature algorithms.

The underlying technical evaluation was published on August 26, 2026, and examined Dilithium, Falcon, and Hawk as potential alternatives to Bitcoin's existing signature mechanisms.

After evaluating their security assumptions, computational performance, and compatibility with Bitcoin's technical requirements, researchers selected Falcon-1024 as their preferred lattice-based candidate.

However, Blockstream has not announced that Bitcoin will immediately adopt Falcon-1024.

The company emphasized that important technical challenges must be addressed before such an algorithm could become part of Bitcoin's production infrastructure.

The announcement comes as blockchain developers, cybersecurity researchers, and financial institutions increasingly examine how future quantum computers could affect today's cryptographic systems.

For Bitcoin, the concern is not that its network has already been compromised. Instead, researchers are preparing for a technological development that could eventually weaken the mathematical protections used to authorize transactions.

Why Quantum Computing Could Become a Threat to Bitcoin

Bitcoin relies on cryptography to verify transactions and establish ownership of digital assets.

When someone sends Bitcoin, their wallet produces a digital signature demonstrating authorization to spend the funds.

Bitcoin currently uses elliptic-curve-based signature systems, including ECDSA and Schnorr signatures.

These technologies are considered secure against known practical attacks using conventional computers.

However, sufficiently advanced quantum computers could potentially solve certain mathematical problems that make these signature systems secure.

A quantum algorithm known as Shor's algorithm could theoretically recover private keys from exposed elliptic-curve public keys if implemented on a powerful enough fault-tolerant quantum computer.

That creates a potential risk for Bitcoin addresses whose public keys are visible on the blockchain.

The distinction between public keys and Bitcoin addresses is important.

Some Bitcoin output types conceal the public key behind a cryptographic hash until the coins are spent. Others, including Taproot outputs, expose an elliptic-curve public key directly.

A future quantum attacker with sufficient computing capability could potentially target exposed public keys.

However, Bitcoin's proof-of-work mining system and SHA-256 hashing are not vulnerable to Shor's algorithm in the same way.

Quantum computing could affect certain hashing operations through other algorithms, but that does not mean quantum machines could simply rewrite Bitcoin's blockchain or instantly defeat its mining security.

The primary concern addressed by Blockstream's research is therefore transaction authorization and digital signature security, rather than the immediate collapse of Bitcoin's entire network.

How Falcon-1024 Could Protect Bitcoin From Quantum Attacks

Falcon-1024 belongs to a family of cryptographic algorithms based on mathematical problems involving lattices.

A lattice can be understood as a structured arrangement of points in a multidimensional mathematical space.

Certain problems involving these structures are believed to remain extremely difficult even for quantum computers.

Falcon uses these mathematical properties to create digital signatures that can verify transactions without relying on the elliptic-curve assumptions used by Bitcoin today.

The algorithm was selected by the U.S. National Institute of Standards and Technology (NIST) for standardization under the name FN-DSA.

Blockstream's researchers favor Falcon-1024 because it offers a relatively compact combination of public key and signature data while maintaining strong security assumptions.

For Bitcoin, data size is particularly important.

Every additional byte included in a transaction consumes blockchain capacity, increasing the amount of information that network participants must process and store.

If quantum-resistant signatures were substantially larger than existing signatures, they could increase transaction costs and reduce the number of transactions that fit into each block.

Falcon-1024 offers a potential compromise between cryptographic security and blockchain efficiency.

Nevertheless, its combined public key and signature are still considerably larger than Bitcoin's current Schnorr equivalent.

This means adopting Falcon would require careful consideration of transaction weight, fee implications, and network performance.

Falcon vs Dilithium vs Hawk: What Blockstream Found

Blockstream evaluated three major lattice-based signature schemes to determine which could be suitable for Bitcoin.

Each offered different advantages and limitations.

Why Falcon-1024 Came Out Ahead

Falcon-1024 offers a smaller data footprint than Dilithium-3 and faster verification performance among the evaluated lattice-based candidates.

Verification speed matters because every Bitcoin full node must independently validate transactions.

An algorithm that requires excessive computational resources could increase the cost of operating network infrastructure.

Falcon's verification process is comparatively efficient, making it attractive for a decentralized network.

However, producing signatures is more complex.

The algorithm uses floating-point calculations during signing, creating additional implementation challenges and potential security risks if handled incorrectly.

Why Dilithium Was Not the Preferred Choice

Dilithium, standardized by NIST as ML-DSA, benefits from a comparatively straightforward implementation design.

It also has a more developed approach to certain forms of key derivation.

However, its larger public keys and signatures would consume more blockchain space.

For Bitcoin, where transaction capacity is limited, this disadvantage is significant.

Why Hawk Was Removed From Consideration

Hawk initially attracted attention for its compact signatures and efficient design.

However, a cryptographic attack disclosed in July 2026 significantly weakened its estimated security.

The Hawk development team subsequently withdrew the algorithm from NIST's additional digital signature standardization process.

The incident demonstrates why cryptographic algorithms must undergo extensive independent review before being trusted to protect valuable assets.

A design that appears secure during early evaluations may later reveal weaknesses as researchers develop more advanced attacks.

Why Bitcoin Cannot Simply Switch to Falcon-1024 Today

Although Falcon-1024 performed well in Blockstream's evaluation, several technical challenges remain unresolved.

1. Final Standardization Is Still Pending

NIST selected Falcon for standardization as FN-DSA, but the final standard was not yet available when Blockstream published its evaluation.

Finalized standards are important because they establish consistent technical specifications and support independent security audits.

Without a stable standard, developers risk implementing technology that may subsequently change.

2. Hardware Wallets Face Memory Constraints

Falcon-1024's signing process can require approximately 90 KB of working memory.

That may not sound significant for a modern computer, but specialized cryptocurrency hardware wallets often operate with limited memory.

Blockstream researchers identified an alternative implementation requiring around 16 KB of memory.

However, this approach can approximately double the signing time.

The trade-off demonstrates why cryptographic solutions must be evaluated on real consumer devices rather than only on powerful development computers.

Wallet compatibility is particularly important because many Bitcoin investors rely on hardware devices to store their private keys offline.

Security improvements that cannot operate reliably on existing wallet infrastructure could create adoption difficulties.

3. Hierarchical Wallet Key Derivation Remains Unsolved

One of the most significant challenges concerns hierarchical deterministic wallets.

Modern Bitcoin wallets commonly use a single recovery phrase to generate multiple addresses and associated keys.

This functionality is supported by standards such as BIP-32.

However, Blockstream found that Falcon does not currently have a practical public-key derivation mechanism comparable to the one used by existing Bitcoin wallets.

One proposed approach would increase the on-chain signature size to approximately 23.7 KB while introducing additional security concerns.

Until researchers develop a workable solution, integrating Falcon into everyday Bitcoin wallet systems would remain difficult.

4. Bitcoin Requires Network Consensus

Even if Falcon-1024 becomes technically ready, its adoption would require changes to Bitcoin's transaction validation rules.

Such changes would need extensive developer review, implementation testing, and agreement through Bitcoin's decentralized upgrade process.

A research recommendation from Blockstream does not automatically become a Bitcoin network upgrade.

Hash-Based Signatures Remain Bitcoin's More Conservative Option

Despite identifying Falcon-1024 as the leading lattice-based candidate, Blockstream continues to favor hash-based signatures as a more conservative near-term approach.

Hash-based cryptography relies on mathematical assumptions that have been studied extensively over several decades.

Unlike elliptic-curve signatures, these schemes do not depend on mathematical problems that Shor's algorithm can efficiently solve.

Blockstream has been developing a hash-based signature approach called SHRINCS, designed specifically for blockchain applications.

The technology aims to reduce the data requirements associated with quantum-resistant signatures.

One of its designs produces signatures as small as 324 bytes in a stateful configuration.

However, stateful signatures introduce additional operational requirements, including careful management of signing state.

Losing or incorrectly reusing that state can create security or recovery problems.

Blockstream's research therefore considers hybrid approaches that could combine hash-based signatures with lattice-based alternatives.

Under such a design, one cryptographic method could provide everyday signing functionality while another supports recovery or additional security.

The objective would be to balance transaction efficiency, implementation reliability, and long-term resistance to quantum attacks.

Blockstream Already Tested Post-Quantum Transactions on Liquid

Blockstream's quantum security research extends beyond theoretical comparisons.

On March 3, 2026, the company confirmed a post-quantum-signed transaction on the Liquid Network, a Bitcoin sidechain.

The transaction used Blockstream's SHRINCS signature technology and demonstrated that quantum-resistant authorization could operate on a production blockchain environment.

The signature itself measured 324 bytes, although the complete transaction and verification program required substantially more data.

This distinction matters because a compact signature does not necessarily mean an entire blockchain transaction will be equally compact.

Liquid provides a testing environment for technologies that may eventually inform Bitcoin development.

However, a successful demonstration on Liquid does not mean the same cryptographic system has been activated on Bitcoin's main network.

The two environments have different technical and governance requirements.

Blockstream's testing nevertheless provides useful evidence that certain post-quantum cryptographic designs can operate outside laboratory conditions.

Bitnxt Take: Bitcoin's Quantum Challenge Is About Preparation, Not Panic

At Bitnxt, we believe Blockstream's latest research deserves attention because it addresses a long-term security challenge without presenting quantum computing as an immediate disaster for Bitcoin.

There is a significant difference between identifying a theoretical vulnerability and demonstrating a practical attack.

Quantum computing research continues to advance, but no publicly demonstrated machine currently has the capability required to recover Bitcoin private keys from its elliptic-curve public keys at a practical scale.

That does not mean developers should wait until such a machine exists.

Bitcoin's decentralized architecture makes major upgrades complex.

Changes to signature verification can affect wallet software, hardware devices, exchanges, custody providers, miners, and full-node operators.

A transition involving millions of users and substantial financial value would require careful planning.

From our perspective, the biggest challenge may not be discovering quantum-resistant cryptography, but deploying it safely across Bitcoin's existing infrastructure.

Falcon-1024 illustrates this problem.

The algorithm offers promising security properties and relatively efficient verification, yet its memory requirements, implementation complexity, and lack of practical hierarchical key derivation prevent straightforward adoption.

We also believe the Hawk withdrawal provides an important warning.

Cryptographic security cannot be judged only by performance benchmarks or early research enthusiasm.

Algorithms must survive sustained scrutiny before they are entrusted with protecting large amounts of digital wealth.

Bitnxt previously examined similar concerns about emerging cryptographic technologies in our coverage of Vitalik Buterin's warning against rushed wallet migrations amid AI-related cryptography questions.

Although AI-assisted cryptanalysis and quantum computing involve different technological risks, both discussions emphasize the importance of avoiding poorly planned security transitions.

The strongest long-term strategy is likely to involve continued research, independent verification, gradual testing, and carefully coordinated upgrades.

What Bitcoin's Quantum Security Research Means for Investors

For Bitcoin holders, the immediate implications are more limited than some headlines might suggest.

Blockstream's research does not indicate that Bitcoin's current cryptographic protections have been broken.

It also does not establish a deadline by which Bitcoin users must transfer their assets to new wallets.

However, the research highlights why wallet design and key management will remain important as cryptographic standards evolve.

Some Bitcoin outputs expose public keys directly, while others reveal them only when transactions are spent.

This difference may affect how particular funds are exposed to a future quantum attack.

Still, moving Bitcoin between existing elliptic-curve addresses does not create full quantum resistance.

A genuine solution would require transaction authorization methods designed to withstand the relevant quantum attacks.

The issue also extends beyond Bitcoin.

Ethereum and many other blockchain networks use public-key cryptography that may eventually require similar upgrades.

In a previous Bitnxt report on the security implications of a long-undetected Coldcard wallet vulnerability, we explored how weaknesses in trusted wallet infrastructure can place user funds at risk.

That incident involved a different type of security problem, but it reinforces a broader lesson: cryptocurrency security depends on both sound cryptographic foundations and reliable implementation.

For investors, the most useful developments to monitor are formal Bitcoin Improvement Proposals, independent security audits, hardware wallet compatibility, and credible demonstrations of post-quantum transaction systems.

Could Quantum-Resistant Signatures Increase Bitcoin Transaction Fees?

One of the less-discussed consequences of post-quantum cryptography is its potential effect on Bitcoin's transaction capacity.

Bitcoin blocks have limited capacity, and transactions compete for available space.

Larger signatures generally require more transaction data.

For example, Falcon-1024's combined public key and signature measure 3,073 bytes, compared with 96 bytes for the equivalent Schnorr public key and signature combination examined by Blockstream.

That is roughly 32 times larger.

However, this comparison does not mean Bitcoin transaction fees would automatically increase by 32 times.

Actual fees depend on transaction structure, witness-data accounting, network demand, and the final protocol design.

Developers may also introduce optimizations that reduce the effective cost of post-quantum transactions.

Nevertheless, the data-size difference explains why Blockstream places considerable emphasis on compact signatures.

A secure algorithm that dramatically reduces transaction throughput could create new challenges for Bitcoin's scalability and usability.

This is one reason hash-based schemes such as SHRINCS remain relevant despite Falcon's promising performance.

What Happens Next for Bitcoin's Post-Quantum Upgrade?

Blockstream's research points toward a gradual transition rather than an immediate replacement of Bitcoin's existing signature algorithms.

Several developments will be important in determining the direction of future upgrades.

First, Falcon's FN-DSA standardization process must progress toward a stable, thoroughly reviewed specification.

Second, researchers need practical solutions for wallet key derivation, memory usage, and secure implementation.

Third, the Bitcoin development community must evaluate how post-quantum signatures could be introduced without creating unnecessary security risks or compatibility problems.

Hash-based approaches may provide an earlier route to quantum-resistant transaction authorization.

Lattice-based technologies could become more attractive as their standards and implementation techniques mature.

A hybrid approach may eventually offer a practical compromise between security, transaction efficiency, and wallet compatibility.

However, no specific deployment schedule has been established for Falcon-1024 on Bitcoin mainnet.

Final Thoughts

Blockstream's selection of Falcon-1024 as its preferred lattice-based signature candidate represents meaningful progress in preparing Bitcoin for potential quantum computing threats.

The research demonstrates that quantum-resistant cryptographic alternatives already exist, but implementing them within Bitcoin presents significant technical and operational challenges.

Falcon offers promising advantages in signature size, verification speed, and security assumptions.

At the same time, unfinished standardization, hardware requirements, and unresolved wallet key derivation issues mean it is not yet ready for straightforward deployment.

Hash-based signatures remain the more conservative near-term option, while hybrid cryptographic approaches could become important in the future.

Bitnxt believes Bitcoin's long-term resilience will depend not on predicting exactly when powerful quantum computers arrive, but on developing secure and practical upgrade options before they become necessary.

Blockstream's research is an important contribution to that preparation.