Quantum computing and wallets: what can actually be protected
Shor, Grover and what a wallet can or cannot protect from a quantum adversary. Why on-chain signatures are not in the wallet hands.
Separating threat from architecture
Quantum computing in crypto is a topic where almost everything you read is wrong in one of two directions: it either treats the threat as imminent, or pretends it does not exist. Both readings block the correct decision, which is progressive preparation.
This is the technical part. The version for people who just want to know what to do is in post-quantum security: what it covers and what it does not.
Two algorithms, two very different impacts
What changes with a sufficiently large quantum computer is not "everything". It is two specific things.
Shor solves factoring and discrete logarithms in polynomial time. That hits the asymmetric cryptography in use: RSA, elliptic curves — therefore ECDSA (Bitcoin, Ethereum) and EdDSA (Solana). The practical effect is that the private key becomes derivable from the public key. It is not a gradual weakening; it breaks the premise.
Grover gives a quadratic speedup in search. That hits hashes and symmetric ciphers, but far more mildly: a 256-bit search space drops to the equivalent of 128 bits of effort, which remains out of reach. That is why SHA-256 is not in the same risk category as ECDSA.
The architectural consequence: the risk concentrates on exposed public keys, not on the whole stack.
Why a wallet cannot fix on-chain signatures
This is the line separating engineering from marketing.
A blockchain's signature scheme is part of its consensus rules. The node validates ECDSA because the protocol says it validates ECDSA. A wallet producing an ML-DSA signature for a Bitcoin transaction would be producing an invalid transaction — not a safer one.
Changing that requires a protocol change, on every network, with consensus coordination. NIST has done its part: the post-quantum cryptography project standardized the schemes, with FIPS 204 for digital signatures and FIPS 203 for key encapsulation. Adoption in networks is a different scale of problem, and will take years.
So: any wallet advertising "post-quantum signatures for your crypto" is describing something it does not control.
What genuinely is in the wallet's hands
There is a whole layer where the wallet picks the algorithm on its own — and where the choice matters today, not in ten years:
1. Encrypted key backup. This is the one quantum scenario with immediate relevance, and it has a name: harvest now, decrypt later. An adversary copies an encrypted blob today and keeps it. If the cipher used is vulnerable to a future advance, the secret has an expiry date. Key backups are exactly the kind of data that justifies resistant encryption now, because their value does not expire.
2. Device binding and proof of possession. Proving that a device belongs to an account is the wallet's internal protocol. No network dictates the format.
3. The channel to its own services. Same situation.
In VKX Wallet those three use ML-DSA-65 — level 3 of the scheme standardized in FIPS 204, formerly CRYSTALS-Dilithium — via noble-post-quantum, with keys derived per wallet rather than one global identity. The backup encrypted with that protection is part of the Quantum Shield plan, which is paid.
The cost nobody mentions
Post-quantum cryptography is not free in resources. ML-DSA-65 has public keys and signatures in the kilobyte range, against 64 bytes for an elliptic-curve signature. In a mobile app that means more bytes to store, transmit and verify.
That is why the correct decision is not "use it everywhere", but use it where the data has a long life. Key backup: yes. Every balance request: no. Applying it uniformly would be bad engineering dressed as security.
What this changes for users
Nothing, day to day. And it should be that way: a well-executed cryptographic transition is invisible.
What changes is exposure to a risk that only shows up later. In 2026 the real loss vector is still phishing, malicious contract approval and badly stored recovery phrases — covered in how to protect your digital assets. The post-quantum layer replaces none of that; it covers a different risk, further out.
FAQ
Does a quantum computer break SHA-256? Grover gives a quadratic speedup, reducing 256 bits to the equivalent of 128 bits of effort — still out of practical reach. It is not the same risk as ECDSA.
Is an address that never spent better protected? On networks where the address is a hash of the public key, the public key is only revealed when spending. That reduces exposure, but is not a complete security strategy.
Why not use post-quantum for everything? Because keys and signatures are orders of magnitude larger. It makes sense where data has a long life, like backups; not on every operation.
What level is ML-DSA-65? It is the middle of the three levels defined in FIPS 204, chosen for its balance between security margin and size.
When will networks migrate? It depends on each network and requires consensus change. There is no date, and anyone announcing one is speculating.
Next step
If you want the practical version, it is in post-quantum security: what it covers and what it does not. VKX's security architecture is at security architecture.
Disclaimer: this content is informational and educational and does not constitute investment advice.