Ledger CTO breaks down NIST’s post-quantum signatures and what they mean for Bitcoin and Ethereum

Quantum computing is still mostly a theoretical threat to crypto wallets. But the cryptography community isn’t waiting around to find out exactly when “theoretical” becomes “Tuesday.” NIST published its first finalized post-quantum cryptography standards in August 2024, and Ledger CTO Charles Guillemet has been walking through what those standards actually mean for Bitcoin, Ethereum, and the hardware security world his company operates in.

Two standards, two philosophies

NIST’s August 2024 announcement formalized two digital signature schemes that matter most here. The first is ML-DSA, published as FIPS 204 and based on the CRYSTALS-Dilithium algorithm. It’s a lattice-based approach, meaning its security relies on the computational hardness of certain geometric problems in high-dimensional space.

The second is SLH-DSA, published as FIPS 205 and built on Sphincs+. This one takes a more conservative route: its security is grounded entirely in hash functions, the same cryptographic primitives that have been battle-tested for decades across computing. No novel mathematical assumptions required. The tradeoff is that Sphincs+ produces larger signatures, which matters a lot when you’re paying per byte on a blockchain.

Guillemet noted that ML-DSA has become the go-to choice in sectors outside of blockchain. Bitcoin and Ethereum, however, are leaning toward SLH-DSA. Sphincs+ doesn’t ask developers to trust any new mathematical hardness assumption. Its security chain runs back to hash functions like SHA-256 and SHAKE, tools that the Bitcoin and Ethereum communities have trusted since day one.

Why the divergence matters

Bitcoin currently uses the secp256k1 elliptic curve for signatures. Ethereum uses a similar elliptic curve scheme. Both are efficient and well-understood, but a sufficiently powerful quantum computer running Shor’s algorithm could theoretically break elliptic curve cryptography by recovering private keys from public keys.

Ethereum researchers in mid-2026 have been exploring optimized Sphincs+ variants specifically designed to make verification more tractable within the Ethereum Virtual Machine. The challenge is that Sphincs+ signatures are substantially larger than what current blockchain transactions carry, which affects storage costs, bandwidth, and the economic math of running a node.

Ledger’s implementation timeline

For Ledger, this isn’t a distant horizon problem. The company’s security team is actively working on integrating post-quantum cryptography into its hardware wallet firmware, targeting secure software elements specifically. Guillemet has indicated that Ledger plans to ship firmware support for both ML-KEM, the post-quantum key encapsulation mechanism, and ML-DSA by the end of June 2026.

ML-KEM handles key exchange, while ML-DSA handles signatures. Together they represent a reasonably complete post-quantum security posture for a hardware wallet, covering both the channel through which a device communicates and the authentication layer that proves a transaction came from the right person.

The transition also raises practical questions for existing wallet holders. Migration to post-quantum schemes will likely require users to move funds to new addresses generated under new cryptographic standards, similar to how early Bitcoin users moved from uncompressed to compressed public keys.

Ethereum’s ongoing research into EVM-compatible Sphincs+ verification is the practical test of whether the efficiency gap can be closed enough to make hash-based signatures viable at scale.