Ledger CTO Warns Bitcoin Quantum Migration Could Take Years

On September 17, 2026, the Bitcoin Foundation published a warning from Charles Guillemet, Ledger’s Chief Technology Officer, that reshaped the crypto industry’s perspective on quantum risk. His main point wasn’t that a quantum computer is on the verge of cracking Bitcoin. It was the opposite. He stated that Bitcoin does not currently have a quantum computer problem. Instead, it faces a migration challenge, and such migrations could take years to implement correctly.

And this is important. There is no public knowledge of any cryptographically relevant quantum computer, nor has one ever broken a Bitcoin key. The more complex question is how a decentralized network, encompassing millions of wallets, exchanges, and dormant coins, would transition to post-quantum cryptography before such a computer emerges.

Guillemet’s Specific Warning

Guillemet’s analysis focused on SHRINCS, a Bitcoin-specific, hash-based signature scheme that is still under development. It combines a short, stateful signing path built on Flexible XMSS and WOTS+C signatures with a longer, stateless recovery path derived from the SLH-DSA algorithm. The draft aims for approximately 128 bits of classical security and 64 bits of quantum security, but currently lacks a full security proof.

He praised SHRINCS as the first Bitcoin-specific post-quantum proposal he had seen that made a serious end-to-end trade-off. This was an acknowledgment of the effort, not an assertion that it was ready for use. SHRINCS is neither an adopted Bitcoin improvement nor is it in production.

The underlying threat model for all of this is that current Bitcoin wallets utilize ECDSA and Schnorr signatures. Both could theoretically be broken by Shor’s algorithm if a practical quantum computer capable of running it existed, which it does not. Therefore, the warning is a forecast about coordination difficulties, not a technical estimate that funds are presently exposed.

Bitcoin Keys and Their Exposure

Not all coins face the same level of risk. Bitcoin addresses conceal the public key behind a hash until the coins are spent. An address that has never been used for a transaction only reveals a hash, which Shor’s algorithm cannot reverse.

Exposure occurs when a public key becomes visible. Addresses that are reused expose their public keys after the first transaction. During the interval between a transaction’s broadcast and its confirmation, the public key is public. An attacker with a functional quantum computer could attempt to find the private key before the transaction settles. Przemek Chojecki’s overview of ECDSA and SHA-256 exposure elaborates on this pattern.

Dormant coins present the most challenging scenario. Many older outputs used “pay-to-public-key” formats, which permanently expose the key. Their holders may have lost their keys, passed away, or simply have no intention of moving the coins. No protocol change can compel these coins to migrate, and no consensus has been reached on how the network should handle them.

Requirements for a True Migration

Selecting a signature scheme is the simpler aspect. NIST has already standardized post-quantum algorithms in FIPS 203, 204, and 205, providing available candidates. Bitcoin’s draft proposals, BIP 360 (Pay-to-Merkle-Root) and BIP 361, are both in the official BIP repository as drafts. They suggest a gradual transition away from legacy ECDSA and Schnorr once post-quantum schemes are ready.

The engineering cost is reflected in size. SHRINCS stateful signatures range from 548 to 4,619 bytes, while its stateless fallback reaches 5,777 bytes. A Schnorr signature, by contrast, is 64 bytes. Larger signatures lead to larger transactions, higher fees, and increased strain on nodes. There are no verified figures yet for the total fee impact or the number and value of exposed outputs; therefore, any specific numbers should be considered estimates.

Wallet software introduces its own complexities. Guillemet pointed out that established features, such as non-hardened BIP32 derivation and Schnorr-based threshold signing, do not easily translate to hash-based signatures. The compact SHRINCS path prohibits one-time key reuse, meaning that restoring from an old backup or a cloned device could result in lost funds. Hardware wallets might also experience longer signing times and higher memory demands. Exchanges, custodians, and miners would each need to test and implement support before holders could safely move their assets.

Why the Timeline Spans Years

Each stage builds upon the last. Protocol design must be finalized and secure proofs obtained. Code needs to be written and reviewed. Testnet trials follow, then activation, and finally, opt-in adoption across a network not controlled by a single entity. After this, the community would need to establish deadlines for legacy outputs and rules for users who do not migrate. Coordination is the primary bottleneck, as Guillemet noted, because protocol changes cannot protect funds that users fail to move.

Researchers do not entirely agree on the urgency. Bitcoin.com reported in February 2026 that not everyone accepts the “Bitcoin has time” perspective, with Core developers, cryptographers, and wallet providers having differing views on how soon action is needed.

What Quantum Hardware Progress Reveals (and Doesn’t)

Hardware advancements contribute to the uncertainty rather than resolving it. Altera and Riverlane announced real-time quantum error-correction work on Agilex 7 FPGAs, indicating that error correction still relies on specialized control hardware and low-latency processing.

Fujitsu’s OpenQARP release demonstrates that quantum software development continues to depend on simulators and hardware roadmaps, rather than production machines. These are company-reported claims. Neither demonstrates any capability to attack Bitcoin, nor do they show quantum advantage against ECDSA or Schnorr.

A Checklist for Holders and Infrastructure Providers

Begin by assessing your exposure. Identify any reused addresses and any outputs that have already revealed their public keys. Monitor which wallets and exchanges commit to standardized post-quantum options aligned with NIST’s FIPS standards.

Be cautious of proprietary schemes advertised as unbreakable, as post-quantum cryptography is believed to be secure, not proven so. PQC is not QKD, and neither can substitute for the other. Consider every migration timeline uncertain until independently verified. Though the threat is not yet here, the work to prepare for it is ongoing.