Key facts
- Trezor CTO Tomáš Sušánka said stateful SHRINCS signatures are about 10 times smaller than stateless ones.
- Reusing stateful one-time keys beyond the signing budget can reveal enough to forge a signature and take funds, Sušánka said.
- Sušánka said two Trezors sharing one recovery seed cannot practically share signing state.
- Trezor is considering stateless signatures as the default, with stateful ones behind advanced settings, Sušánka said.
- Sušánka said hardware wallets also need post-quantum firmware and device authentication, not just address upgrades.
Trezor is preparing for the user-experience problems of a post-quantum Bitcoin, where the leading candidate signature scheme forces a choice between efficiency and safety, the company's CTO Tomáš Sušánka said in remarks reported on November 12, 2026.
SHRINCS, proposed in late 2025 by Blockstream Research Director Jonas Nick and cryptographer Mikhail Kudinov, uses a composite hash-based approach that lets users sign with either stateful or stateless signatures, according to the report. Stateless signatures are large, which can affect fees and signing speed, but are safe to reuse. Stateful signatures are smaller and more efficient but carry security risks when reused beyond a set signing budget.
The stateful part of SHRINCS is a tree of one-time signatures. If those keys are used more than once, enough cryptographic information is revealed for someone else to forge the user's signature and take funds, Sušánka said. Wallet developers would then have to track signing state precisely, with many edge-case risks.
"You're giving them an option to mess up," Sušánka said on MARA Foundation TV, referring to state tracking. "It's our job to make it in a secure way, right? It shouldn't be the user's job."
To limit that risk, Trezor is considering making the heavier stateless signatures the default for all users and placing the stateful option behind an advanced settings wall, Sušánka said. He said he is torn because maintaining state is a burden: two Trezors holding the same recovery seed cannot practically share it. He added that stateful signatures are about 10 times smaller, which he said makes a big difference and should not be ruled out.