Quantum-resistant signatures for Bitcoin would roughly multiply the data every transaction carries by ten, according to an analysis of the proposal circulating among protocol developers. The finding lands as the network weighs how to protect itself against future quantum computers without crushing the machines that store and relay its blockchain. The same review flags a second problem: compact versions of the signatures need reliable counters and tighter coordination among custody providers, neither of which is guaranteed today.
The signature size problem
Bitcoin transactions are deliberately small. That's what lets thousands of full nodes run on ordinary hardware, from home servers to cheap cloud instances. Swap in quantum-proof signatures and each transaction balloons to roughly ten times its current footprint. Nodes would have to store, validate, and forward that extra data, and the network's bandwidth and disk requirements would climb accordingly.
The proposal's backers aren't pretending otherwise. SHRINCS, the scheme under review, keeps a larger signing path specifically so users can recover access if something goes wrong. In other words, the bulk isn't a bug to be shaved off later; it's baked into the design. The trade-off is deliberate, but it's still a trade-off.
Why counters matter
The compact variant of quantum-proof signature schemes relies on counters to keep signing state in order. That sounds like plumbing, and it is — but plumbing is what breaks. If a counter desynchronizes, signatures can fail or, worse, key material can be reused in ways the scheme wasn't built to handle. For everyday users that's an annoyance. For custodians holding keys on behalf of thousands of clients, it's an operational risk that needs coordination across teams.
Wallets and exchanges would need to track state precisely, and any backup or recovery procedure would have to account for it too. It's the sort of requirement that looks trivial in a spec and turns into support tickets in production.
What node operators face
Full-node operators are the ones who'd feel this first. More data per transaction means more storage growth and more bandwidth burned on relay. The network has spent years trying to keep node operation accessible to hobbyists; a tenfold signature increase pushes in the opposite direction. Developers haven't said how they plan to offset that, and the analysis doesn't offer a fix.
There's no deadline attached yet. The scheme remains under review, and no activation timeline has been set.
The custody coordination question
For custodial services, the compact path is appealing because it keeps on-chain costs down. But the counter requirement means every signer in a custody setup has to stay in lockstep. Multi-party arrangements, cold-storage workflows, and recovery drills all get more complicated. That's not a reason to abandon the work. It is a reason to expect a longer integration cycle than the marketing around quantum-proofing suggests.
The next concrete step is a review of the compact signing path and how its counters would be handled in practice. Until that's settled, the tenfold data question sits unanswered — and node operators are the ones who'll live with the answer.
