Bitcoin’s Quantum Migration May Take Years, Ledger CTO Says

Ledger’s chief technology officer, Charles Guillemet, says Bitcoin does not face an immediate quantum threat, but the transition to a quantum‑resistant signature scheme will be a multi‑year effort involving wallets, hardware, and legacy funds.

Three Core Challenges

Guillemet breaks the migration into three problems:

• Selecting a post‑quantum signature algorithm.
• Adapting wallets, hardware devices, and protocol infrastructure to the new scheme.
• Deciding how existing BTC, including lost or dormant coins, should be moved to quantum‑resistant outputs.

SHRINCS Draft Proposal

SHRINCS is a Bitcoin‑specific, hash‑based signature draft that combines a small, stateful signing path (signatures 548 – 4,619 bytes) with a larger, stateless fallback (5,777 bytes). It relies on SHA‑256, the same hash function used throughout Bitcoin, and targets 128‑bit classical security and 64‑bit quantum security.

Stateful vs. Stateless Paths

The stateful path requires a one‑time signing slot for each signature. Reusing a slot can expose enough information for an attacker to forge signatures, creating a new wallet‑level theft risk. If the signing state is lost, the seed can still generate a stateless signature, but the wallet must abandon the compact path.

Impact on Wallets and Hardware

Moving from elliptic‑curve signatures (ECDSA, Schnorr) to hash‑based signatures would affect several wallet features:

• Non‑hardened BIP32 derivation, which enables watch‑only wallets, does not have a direct analogue for hash‑based keys.
• Threshold signing schemes that work efficiently with Schnorr would become larger and more complex.
• Key generation and stateless signing on secure hardware can take minutes due to intensive SHA‑256 operations.

Current Status of Bitcoin’s Post‑Quantum Plans

Both BIP 360 (Pay‑to‑Merkle‑Root) and BIP 361, which outline a phased sunset of legacy signatures, remain drafts. SHRINCS itself has no assigned BIP number and is still under peer review, with its formal security proof marked as “TODO.” No quantum‑capable computer capable of breaking Bitcoin’s current signatures exists today, and the timeline for such a machine remains uncertain.

Key Takeaways

The migration is not a simple cryptographic swap; it requires coordinated changes across the ecosystem and a strategy for handling coins that cannot be moved.