Definition
A quantum-safe wallet — sometimes called quantum-resistant or post-quantum — is a crypto wallet whose signing and key-exchange primitives are believed to remain unbroken against a large-scale quantum computer. In 2026 that means the NIST-standardised algorithms ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205), rather than the ECDSA and RSA schemes today's wallets rely on.
The label describes a property of the algorithms, not the physical device. A hardware wallet can be tamper-resistant and open-source and still not be quantum-safe, because everything it signs still uses ECDSA.
Why ECDSA breaks under a quantum computer
Bitcoin, Ethereum, and most other chains sign transactions with ECDSA (Bitcoin Taproot additionally uses Schnorr). Both rest on the hardness of the discrete-log problem on an elliptic curve. Shor's algorithm, running on a sufficiently large fault-tolerant quantum computer, solves that problem in polynomial time. Once someone can recover a private key from a public key, they can spend from the address.
The immediate threat isn't the future computer — it's harvest-now, decrypt-later. Every reused address has already published its public key on-chain. That key sits in the mempool history forever, waiting for a CRQC.
The NIST post-quantum standards
- ML-KEM (FIPS 203) — key encapsulation, used for encrypted channels between host and wallet, cloud backups, and seed transport.
- ML-DSA (FIPS 204) — lattice-based digital signature, the leading candidate to replace ECDSA on-chain.
- SLH-DSA (FIPS 205) — stateless hash-based signature, more conservative, larger signatures, useful where lattice assumptions are undesirable.
A truly quantum-safe wallet needs both a KEM and a signature scheme — ML-KEM to protect key material in transit, and ML-DSA (or SLH-DSA) to sign transactions once the underlying chain accepts post-quantum signatures.
What actually exists in 2026
On Bitcoin and Ethereum: nothing consumer-grade. The chains themselves don't yet accept ML-DSA signatures, so wallet vendors have nothing to sign with. Proposals like BIP-360 (Bitcoin) and post-quantum precompiles for Ethereum are in discussion but not deployed.
On post-quantum-native chains: a handful of wallets (QRL, some IOTA tooling, experimental L2 prototypes) sign with hash-based schemes like XMSS or SLH-DSA. They're usable for those chains but don't make Bitcoin quantum-safe. See our quantum crypto rankings for how each chain scores.
What to do while waiting
- Run your address through the wallet scanner for a rules-based exposure check.
- Sweep reused UTXOs into fresh, never-spent addresses so the public key stays hidden behind a hash.
- Prefer P2WPKH or P2TR outputs that haven't been spent from — a spent Taproot output exposes the raw public key.
- Keep firmware current; PQC arrives via firmware once chains support it.
- Avoid parking large sums on addresses whose public key is already on-chain.
Frequently asked questions
What is a quantum-safe wallet?
A quantum-safe (or 'quantum-resistant') wallet is one whose signing and key-exchange algorithms are believed to remain secure against a large-scale quantum computer running Shor's algorithm. In practice today that means using NIST post-quantum standards — ML-KEM (FIPS 203) for key encapsulation and ML-DSA (FIPS 204) or SLH-DSA (FIPS 205) for signatures — instead of legacy ECDSA or RSA.
Are Bitcoin or Ethereum wallets quantum-safe today?
No. Bitcoin and Ethereum sign transactions with ECDSA (and Bitcoin Taproot also uses Schnorr), both of which are broken by Shor's algorithm on a sufficiently large quantum computer. No mainstream Bitcoin or Ethereum wallet ships a NIST post-quantum signature today; the chains themselves would need a protocol upgrade first.
How is a quantum-safe wallet different from a normal hardware wallet?
A regular hardware wallet protects your private key from theft or malware. A quantum-safe wallet additionally uses cryptographic algorithms that survive quantum attacks. The two properties are independent — a Trezor or Ledger is 'secure' against normal attackers but not quantum-safe, because the algorithms it signs with are ECDSA/Schnorr.
When do I actually need a quantum-safe wallet?
The mainstream estimate is that a cryptographically relevant quantum computer (CRQC) is a decade-plus away, but 'harvest-now, decrypt-later' means public keys already exposed on-chain can be attacked retroactively. If you hold long-term cold storage on reused addresses, your risk window starts today, not on Q-Day.
What should I do right now?
Three concrete steps: (1) run your address through the /wallet-scanner to see rules-based exposure; (2) sweep reused addresses into fresh, never-spent ones so the public key stays hidden behind a hash; (3) follow chain-level migration proposals like BIP-360 for Bitcoin and Ethereum's post-quantum roadmap.