Blockstream Backs Falcon-1024 as Its Lead Quantum Signature for Bitcoin

Blockstream Research has named Falcon-1024 as its preferred lattice-based post-quantum signature scheme for Bitcoin, according to a peer-reviewed paper published on August 6, 2026. The endorsement is analytical, not operational: the same document details why the scheme cannot be deployed on Bitcoin today. A favorite, in this case, is not a launch date.

How did Falcon-1024 win the comparison?

The paper evaluated three lattice-based candidates — Dilithium, Falcon, and Hawk — against Bitcoin's technical constraints. Falcon-1024 prevailed primarily on size. Its combined public key and signature occupy 3,073 bytes. Dilithium, at security Category 3, requires 5,261 bytes for the equivalent function. Falcon's footprint is roughly 58 percent of Dilithium's, a meaningful margin on a network where every byte competes for constrained block space.

Blockstream also credited Falcon-1024 with efficient verification times. Because every Bitcoin node validates signatures, faster verification keeps the cost of running a node from rising across the network. In plain terms: Falcon wins because it is small to store and cheap to check.

What stands in the way of deployment?

The paper's caveat list is extensive. Four obstacles separate Falcon-1024 from production use on Bitcoin:

• Memory demand. Falcon's signing process requires approximately 90 KB of memory, which the report flags as high.
• Implementation complexity. The scheme depends on floating-point arithmetic, which makes correct implementations harder to build and audit.
• No native HD derivation. Falcon lacks built-in support for hierarchical deterministic key derivation, the standard method most wallets use to generate keys from a seed.
• Unfinished standardization. Falcon-1024 has not reached final standard status, and committing Bitcoin's long-term security to a specification that could still change carries obvious risk.

The wallet burden deserves emphasis. The HD derivation gap and the 90 KB signing requirement fall squarely on hardware and software wallet developers, who must adapt their products before any lattice scheme reaches ordinary users. In plain terms: the hard work now shifts from researchers to wallet engineers.

Is Blockstream hedging with hash-based signatures?

Yes. The Falcon paper is one track in a broader quantum-readiness program. Blockstream has pursued a parallel, more conservative path based on hash-based signatures.

That effort, a scheme called SHRINCS, reached draft BIP status in late August 2026. A Bitcoin Improvement Proposal draft marks the opening of public review, not protocol approval. SHRINCS has also been tested in production conditions: Blockstream ran trials on its Liquid sidechain, including a post-quantum transaction completed in March 2026. A draft proposal and a sidechain test are evidence of progress, but neither constitutes consensus among Bitcoin's stakeholders.

What changes for Bitcoin users?

Nothing immediate. No quantum computer capable of breaking Bitcoin's existing signatures exists today, and the paper does not alter that baseline. Bitcoin's current security model remains intact.

The research does, however, sketch a staged transition rather than a single protocol switch. Blockstream frames Falcon-1024 as a strategic long-term option contingent on standards maturing — a conditional endorsement, not a deployment schedule. Even the most compact lattice option costs thousands of bytes per key and signature, so any eventual migration will force tradeoffs around block space and transaction fees. In plain terms: post-quantum security will not arrive free, and someone will pay in block space.

The next observable milestone is the public review of the SHRINCS draft BIP, which will test whether hash-based signatures can gather the consensus that lattice schemes have not yet earned.