Ledger CTO Charles Guillemet: Bitcoin Has No Quantum Computing Issues Today
Ledger CTO Charles Guillemet stated that Bitcoin does not face quantum computing issues today, but rather potential migration problems that could take years to resolve, shifting the discussion from the signature scheme itself to the wallet layer that must run this scheme.
He specifically mentioned SHRINCS as the first serious end-to-end trade-off proposal for Bitcoin's post-quantum draft: based on hash, relying on SHA-256, with a single 48-byte public key that simultaneously commits to a compact stateful path (Flexible XMSS and WOTS+C) and a stateless SLH-DSA fallback. The authors of the draft include Conduition, Ethan Heilman, Mikhail Kudinov, Oleksandr Kurbatov, Jonas Nick, among others, and it is not a proposal from Bitcoin Core.
He referred to the verification side as a pleasant surprise, primarily based on SHA-256, with the draft report indicating that the worst-case unit signature byte cost is lower than that of BIP340 Schnorr. The stateful path uses a one-time key, where each slot can only sign once; the counter cannot roll back and must be written to persistent storage before the signature goes offline, and it must never be restored from backup. If two different messages are signed in the same slot, an observer can steal the funds.
SHRINCS is more stable than purely stateful schemes: when state is lost or uncertain, the seed can still export a stateless key, with the loss being efficiency rather than principal. The cost is that the wallet state changes from application data to cryptographic state, with rollbacks directly risking funds—hundreds of UTXOs corresponding to hundreds of counters, across multiple devices and software wallets, while hash-based key generation can now take minutes on hardware.
He outlined the capabilities that cannot be recovered after migration: non-hardened BIP32 derivation, and today's observation wallets; compact Schnorr-style threshold signatures. The specifications also state: non-standard SLH-DSA parameters, constructions outside of NIST standards, and security proofs pending completion. The current draft public key is 48 bytes, with stateful signatures ranging from about 548 to 4619 bytes, and stateless fallback around 5777 bytes, compared to Schnorr's 64 bytes.
In market mechanisms, this is pricing and engineering redistribution driven by expectations of consensus upgrades, rather than an immediate shock of "quantum machines are here." Computing power and R&D budgets are shifting from algorithm selection to wallet state machines, hardware firmware, and lost coin disposal; hardware wallets and infrastructure needing to rewrite derivation/threshold stacks are under pressure, benefiting from hash-based paths and more efficient block space already validated on the Liquid sidechain. Coins that have never been moved by their owners pose a third question, with almost all public discussions still stuck on the relatively easier first question: which scheme to choose.
Blockstream has estimated: if the entire network used Schnorr, it would achieve about 6.5 transactions per second, standard SLH-DSA could drop to about 0.36 transactions per second, while SHRINCS compact paths could return to about 3 transactions per second; this construction has been validated with signatures on the Liquid mainnet using Simplicity contracts.
Source: Public information
ABAB AI Insight
Jonas Nick and Mikhail Kudinov from Blockstream Research introduced SHRINCS in December 2025 with ePrint "Hash-based Signature Schemes for Bitcoin" and followed up with OP_CHECKSHRINCS in May 2026, forming draft BIP in August, and validating signatures on the Liquid mainnet using Simplicity. As a hardware wallet provider, Guillemet has previously shifted the narrative of Q-Day from "10% in ten years" to "migration is overdue," emphasizing that abandoning coins and exposing public key addresses are the real threats. The two paths differ: one compresses signatures to a size viable for block economics, while the other shifts the cost accounting from byte count to device state machines.
Capital and engineering resources are shifting from "issuing another algorithm paper" to three types of hard investments: hardware capable of generating hash keys in minutes, cross-device non-roll-back counter storage, and rewriting product lines that can no longer support non-hardened BIP32 and Schnorr thresholds. Liquid's early implementation treats the sidechain as a testing ground, externalizing governance costs from the main chain; StarkWare simultaneously used about 3100 GPU hours to execute a quantum-safe transaction on the mainnet and set a $20,000 optimization reward, indicating another path that does not alter consensus but uses computation for proof. The motivation is the same: the migration window is measured in years, while the quantum machine timeline is uncertain.
Drawing parallels to Segregated Witness in 2017 and Taproot in 2021: the real time-consuming factor is not the elliptic curve formulas, but the synchronization of wallets, exchanges, observation addresses, and script ecosystems. If NIST-standardized SLH-DSA and ML-DSA were directly implemented in Bitcoin, throughput would drop below 1 transaction per second; SHRINCS reduces this to about half to one-third of the capacity loss. The industry is transitioning from algorithm discovery to wallet and governance competition.
Structural judgments belong to the transfer of pricing power at the protocol layer before regulatory changes. Whoever defines "acceptable signature bytes, acceptable state machine risks, whether abandoned coins are frozen" will define the cost curves for the next round of block space and hardware wallets. The mechanism is: the hash assumption and Bitcoin mining share the same origin, politically easier to navigate; stateful one-time signatures upgrade user errors from "losing mnemonic phrases" to "backup rollbacks resulting in lost coins," thus shifting the security boundary from curve mathematics to firmware and UX. Choosing a scheme remains the easiest question among the three, precisely because the latter two will alter the profit distribution in the industry chain.
ABAB News · Cognitive Law
- Algorithms are easy to choose, but wallets that can run algorithms are hard to migrate.
- Once state becomes a key, backups become an attack surface.
- The real deadline for the system is not when the threat arrives, but when collaboration is completed.