What happened
On 26 August 2026 Blockstream Research published an evaluation of lattice-based signature schemes for Bitcoin, with the full paper on the Cryptology ePrint Archive as Lattice-based Signature Schemes for Bitcoin by Dmytro Zakharov, Mikhail Kudinov, Viktoria Balatska and Yaroslava Chopa. It reviews three candidates for replacing the signatures Bitcoin uses today: Dilithium (standardised as ML-DSA), Falcon (selected for standardisation as FN-DSA), and Hawk. The paper is direct about the third. Hawk "was recently withdrawn from NIST standardization following a key-recovery attack; we retain it because its design paradigm remains of independent interest."
What it changes
It puts numbers on the part of the problem Bitcoin cannot argue with, which is size. Signatures are paid for in block space, so a replacement scheme is not judged on security alone. A BIP-340 Schnorr signature is 64 bytes and the x-only public key it verifies against is 32, so the pair that an ordinary spend puts on chain today is 96 bytes.
The paper measures the candidates the same way, by the combined public key and signature that an output and its spend would carry. Falcon-1024 comes to 3,073 bytes, ML-DSA-65 to 5,261, and the withdrawn HAWK-1024 to 3,661. The cheapest credible replacement is therefore something like thirty times the on-chain cost of what it replaces, before anyone argues about soft forks. The authors' recommendation among the three is Falcon, which "offers the best combination of compactness, verification speed, and mature assumptions, and its main drawback (floating-point signing) has a known, practical mitigation".
What it does not change
There is no proposal here. No BIP number, no implementation for Bitcoin, no activation path. A review of three schemes is a review of three schemes, and the same authors say the conservative near-term option is still a hash-based scheme rather than any of them.
It does not solve key derivation, and that gap is larger than it sounds. No workable BIP-32-style public key derivation exists for Falcon, which is the mechanism behind a watch-only wallet, an extended public key handed to an accountant, and the address gap limit every wallet relies on. None of the schemes deliver the multisignature, threshold or aggregation constructions that lattice-based cryptography is often said to promise. They remain potential, not available.
And it does not settle which assumptions are mature. Hawk was a live candidate in NIST's additional signatures process until its own team withdrew it on 29 July 2026 "because Anthropic discovered a new attack that approximately halves the block size required in lattice reduction to recover an (equivalent) private key". The attack, published as HAWK-n Key Recovery Reduces to SVP in Dimension n/2 + 1 by Zygimantas Straznickas and Stephen A. Weis, drops the stated key-recovery cost of HAWK-512 from 2^150 to 2^108 and demonstrates full recovery against HAWK-256 "end-to-end in a few hours on a single server". It was posted to the NIST pqc-forum on 28 July 2026. A scheme sitting on a shortlist for years is not the same as a scheme that has survived them.
Context
The Bitcoin end of this has been an open question since a draft proposed an output type that keeps its public key hashed, which narrows the window in which a key is exposed without saying what should sign in its place. This paper is about the other half: what actually signs, and what it costs.
Signing is also where the hardware bites. Falcon signing wants roughly 90 kB of RAM, and a signing device working within about 16 kB has to rebuild the tree instead, at roughly double the signing time. That is the ordinary shape of a cryptographic migration rather than a Bitcoin peculiarity: the scheme is chosen once, and every device that has to run it is inherited.