Trezor is leaning toward making the largest, slowest option for quantum-resistant Bitcoin signatures its default, putting user safety ahead of efficiency as the industry grapples with a leading candidate scheme known as SHRINCS, the hardware wallet maker's chief technology officer said.
Tomáš Sušánka said the company is weighing how to implement the composite hash-based signature system, which lets users choose between two very different paths: bulky "stateless" signatures that can be reused safely, or compact "stateful" signatures that demand meticulous bookkeeping. The lighter option is roughly a tenth the size of the heavier one, but it carries a serious catch.
"You're giving them an option to mess up," Sušánka said during an appearance on MARA Foundation TV, referring to the burden of state tracking. "It's our job to make it in a secure way, right? It shouldn't be the user's job."
SHRINCS was proposed late last year by Blockstream Research Director Jonas Nick and cryptographer Mikhail Kudinov. Its stateful component is built from a tree of one-time signatures. If a key is used more times than its prescribed signing budget allows, enough cryptographic material is exposed for an attacker to forge that user's signature and drain the funds it protects.
That risk is manageable on a single device but becomes thorny when a user holds two hardware wallets loaded with the same recovery seed, since there is no practical way to synchronize the signing state between them. "You really don't," Sušánka said of sharing state across devices.
To keep ordinary holders away from that trap, the company is considering routing everyone to stateless signatures by default and hiding the stateful option behind an advanced settings menu. Sušánka described himself as "kind of torn" on the question, because SHRINCS rests on the same cryptographic assumptions as Bitcoin's SHA-256 hashing and is therefore a conservative choice, yet the state-management burden is real. "I just don't want to throw it off the table completely," he said of the smaller signatures.
Note: Size comparison reflects Sušánka's estimate that stateful signatures are about 10 times smaller than stateless ones.
The debate over signatures is only part of the problem. Sušánka noted that most signing devices on the market today rely on cryptography vulnerable to quantum attack for hardware-level functions such as firmware and device authentication, not just for the transaction signatures themselves. Full protection therefore requires new hardware, not merely a software patch.
Trezor has already begun shipping such hardware. Its Safe 7 wallet, released recently, uses post-quantum cryptography to authenticate the device. Even so, Sušánka cautioned that transactions made on the device will only be quantum-secure once Bitcoin's base layer itself adopts post-quantum addresses and signatures.
The timeline is what worries him. Migrating potentially millions of holders to new keys and new devices is a years-long undertaking, and he argued that developers should not wait for a perfect design before offering users a way across. "People should be ready to make compromises," he said. "If we're all going to be very strict on what can and cannot be done, we're not going to get anywhere."
For wallet makers, the SHRINCS question is a preview of a broader design split in the post-quantum era: whether to optimize for transaction cost and speed or for fail-safe simplicity. Bitcoin's elliptic-curve cryptography, which links each private key to its public counterpart, could in theory be broken by a sufficiently powerful quantum computer running Shor's algorithm, a scenario that has moved from science fiction to engineering roadmap in recent years.
How Trezor resolves the default-setting question will shape user experience across its installed base, and other manufacturers are likely to face the same choice. For holders, the practical takeaway is that quantum readiness will require both a network upgrade and new hardware, and that the cheaper signature option may come bundled with responsibilities most users are not equipped to handle.
