Researchers from Imperial College London have published a paper on ArXiv.org describing a new quantum-resistant blockchain:
https://arxiv.org/html/2609.32015v1As a reminder, quantum computers are hypothetically capable of taking a transaction signature, finding the public key in it, and deriving the private key from that.
The authors point out that existing post-quantum cryptography solutions are difficult to scale because post-quantum signatures are dozens of times larger than ECDSA and Schnorr signatures. The paper proposes removing signatures from the blockchain entirely and replacing them with hashes. With this approach, a transaction record on the blockchain takes up 96 bytes for each transferred coin (input), regardless of how large the underlying post-quantum signatures are. Meanwhile, the heavy post-quantum proofs of transaction validity are transmitted directly between senders and recipients.
Since there are no signatures in the transactions, network nodes cannot verify which transactions are genuine and which are fake. However, the paper proposes a scheme where this is unnecessary. Signatures are verified on the recipient's side, as the recipient has a vested interest in holding a real transaction output in their wallet - one that actually has value and can later be used as an input for a new transaction. The only issue is that a sender and a recipient could collude to spam the blockchain with transactions whose outputs can never be spent.
This is indeed possible because the blockchain proposed in the paper differs fundamentally from existing blockchains. In standard blockchains, you cannot record a transaction that double-spends coins already spent in an earlier on-chain transaction. In the blockchain proposed by the London researchers, however, you can record any number of transactions using the exact same input. All of them will be stored as conflicting transactions. However, only the output of the genuine transaction can be spent further. Any attempt to spend an output created by an invalid signature will fail, because it is impossible to create a new valid signature based on an invalid one.
For this very reason, Compact Shielded CSV is proposed as a technology for building a new L1 blockchain rather than modifying existing ones. The consensus rules of existing blockchains, which prohibit two transactions from spending the same input, conflict with the logic of the new protocol. Implementing this without forks would be extremely difficult.
Nevertheless, it could be launched as a solution on top of Bitcoin: for example, by recording all the hashes in OP_RETURN. This would result in yet another way to issue and transfer tokens on the Bitcoin blockchain, paying transaction fees in bitcoins and recording the hashes of such token transfers in OP_RETURN.
Still, I think that if this idea does gain traction, it will most likely be as a standalone blockchain with its own altcoin. History shows that tokens on the Bitcoin blockchain don't really tend to catch on.
