EP - 115

Quantum Is Not Here Yet. The Trust Problem Is.

with

Charles Guillemet
CTO @ Ledger

Jun 09, 2026

On this episode of The Ledger Podcast, Ledger CTO Charles Guillemet sits down with Mo El-Sayed for a wide-ranging technical masterclass on post-quantum cryptography (PQC)—one of the most consequential challenges facing both the internet and the blockchain ecosystem. Together, they unpack what quantum computers actually are, why recent research from Google has compressed the perceived timeline for cryptographic risk, and what the path to migration looks like for centralized systems versus the uniquely difficult consensus problem facing Bitcoin and other decentralized networks.

“The risk is not Q-Day itself. The risk is losing trust in our systems before, and not migrating before the day.” — Charles Guillemet

Watch the full episode below:

Key Highlights:

A Different Kind of Computer: What Quantum Actually Means

Before assessing the threat, Charles draws a critical distinction that is often misunderstood: a quantum computer is not simply a faster classical computer—it is a fundamentally different kind of machine.

Where classical computers operate on bits that are either 0 or 1, quantum computers use qubits that leverage quantum physical phenomena like superposition and entanglement to perform operations that classical hardware cannot replicate. This requires maintaining quantum states at temperatures approaching absolute zero (-273°C), which is why those iconic gold-coated quantum computers are, as Charles explains, essentially large refrigerators with a small specialized chip at the bottom.

The implications for cryptography are not about speed but about paradigm: Shor’s algorithm, developed in the 1990s, theoretically enables a sufficiently powerful quantum computer to break asymmetric cryptography—including ECDSA, the elliptic curve signature algorithm underpinning nearly every blockchain transaction on Bitcoin and Ethereum.

AI, by contrast, does not change the underlying mathematics that make classical cryptography secure; it cannot brute-force what the laws of physics protect. What AI can do—and is already doing—is accelerate the research needed to build quantum computers and to refine Shor’s algorithm itself.

How close are we to breaking modern cryptography? What would be the impact of PQC on hardware?

These questions are generating big headlines, so I addressed them at EthCC.

The good news – the solution exists. The bad – urgency is lacking. 🧵

(🎥video link on last tweet) pic.twitter.com/QIQNjlAKAm

— Charles Guillemet (@P3b7_) April 9, 2026

The Google Paper That Changed the Conversation

The urgency of this episode is anchored in a specific research development. Google published a paper demonstrating that ECDSA can be broken with far fewer qubits than previously estimated—a significant compression of the theoretical threshold for “cryptographically relevant” quantum computing. Notably, the paper was published without explaining the methodology behind its results, a departure from standard scientific practice.

Google initially planned to publish the full methodology, but instead released a zero-knowledge proof of the result. This cryptographic approach lets others verify the outcome without learning how it was produced.

The open-source community rapidly responded by building an incentive mechanism that used the ZK proof verifier as a reward function for large language models doing reinforcement learning. Within days, researchers were able to surpsass Google’s result. As Charles notes, this is AI and cryptographic research interacting in real time:

“AI can help us migrate. Let’s not see AI as a threat—nor quantum computers as a threat.”

Trust Erodes Before Systems Break: The Real Risk

Charles and Mo converge on a framing that reorients the entire conversation: the question is not when a quantum computer will break Bitcoin—it is when trust in the current cryptographic foundation begins to erode. Trust can collapse before the technical event occurs, and a collapsing trust model in a system worth trillions of dollars is itself a catastrophic outcome.

The National Institute of Standards and Technology (NIST) published its post-quantum cryptography standards in 2024, mandating that all critical applications transition to PQC by 2030, with a 2035 deadline for the long tail. For centralized institutions—banks, governments, telecommunications infrastructure—the path is clear even if complex: there is a central authority that can mandate and enforce the migration.

Charles draws a parallel to the Y2K bug, noting that while the scope of PQC migration is far larger, the same principle applies: the industry knew, spent resources, and solved it.

“We don’t have time,” he says, pointing out that two years of the six-year NIST window have already passed with most of the industry having done very little.

Bitcoin’s Consensus Problem: The Hardest Migration in Tech

For decentralized blockchains—and Bitcoin in particular—the migration challenge is categorically different. There is no central authority to issue a directive. The community includes participants with sharply divergent views, some of whom still doubt that quantum computing poses any real threat. The technical dimensions of the migration are solvable: Bitcoin would need a new address format, a new signature algorithm, and a defined migration window during which holders must move their UTXOs to post-quantum addresses. But the social consensus required to execute that migration in a decentralized system is far harder to achieve.

Charles outlines the competing algorithm candidates—hash-based signatures like SPHINCS+ and the SHRIMPS variant championed by Adam Back at Blockstream, and lattice-based signatures like Falcon (adopted by Solana and Algorand) and ML-DSA (the broader IT industry standard). Each involves trade-offs in signature size, computational complexity, and compatibility with multi-party computation.

Crucially, even the most compact post-quantum signature takes roughly ten times the block space of today’s ECDSA signatures, which would reduce Bitcoin’s already-limited throughput from approximately seven transactions per second to under one—unless block size is also increased, a debate with its own fraught history. Ledger is actively participating in these technical and social discussions, and Charles expects the most likely outcome to be multiple competing hard forks rather than a unified community migration.

What Happens to Satoshi’s Coins—and Everyone Else’s

One of the episode’s most thought-provoking exchanges centers on what a post-quantum Bitcoin migration should do with wallets that do not migrate. The problem is mathematical: a migration is only as protective as it is complete. If half of all Bitcoin UTXOs remain on ECDSA addresses, a quantum adversary can drain that half—and the resulting market and trust shock would collapse the value of the entire network.

There are three broad options for non-migrating coins:

Leave them alone, which leaves the chain permanently vulnerable)
Freeze and burn them, adjusting the supply narrative from 21 million to approximately 18 million spendable Bitcoin
Freeze and redistribute them.

Charles’s preferred approach is the third: redistribute frozen coins back into the mining reward schedule, extending the security budget available to miners as transaction fees from block rewards alone become insufficient over time. Each option involves trade-offs across decentralization, censorship resistance, and long-term network security—none of them comfortable, but all of them necessary to evaluate now rather than under duress.

Ledger’s Post-Quantum Roadmap: Device-Ready Before Blockchains Are

Ledger is not waiting for blockchain consensus to begin its own migration. Charles outlines a concrete product timeline: by the end of June, Ledger’s firmware will include support for ML-KEM (post-quantum encryption) and ML-DSA (post-quantum signatures) as cryptographic primitives available to developers building on Ledger’s open operating system.

The current generation of Ledger hardware, built on secure elements designed for passport and banking applications, does not include a hardware cryptographic accelerator for the new algorithms, so initial PQC support will be implemented at the firmware level.

Future device generations will integrate this acceleration at the chip level for faster and more secure operations. Separately and independently of blockchain migration, Ledger’s own internal cryptographic stack—used for firmware upgrades and device integrity guarantees—is already being migrated to post-quantum standards. The device will be PQC-ready before any major blockchain completes its migration.

“As long as Bitcoin doesn’t migrate, it doesn’t change anything from a user standpoint. But the device is post-quantum ready.”

Key Predictions:

Charles

The most likely outcome for Bitcoin’s PQC migration is a series of competing hard forks, rather than a unified community-driven upgrade, because achieving social consensus across a fully decentralized network is extraordinarily difficult.
The broader blockchain ecosystem will fragment across multiple post-quantum cryptographic standards, while the rest of the global IT infrastructure converges on ML-DSA.
Post-quantum readiness will become a formal institutional due diligence requirement; organizations in critical infrastructure that have not migrated by 2030 will be non-compliant with NIST standards.
The “harvest now, decrypt later” threat—where encrypted internet traffic captured today is stored and decrypted once a quantum computer is available—is the most pressing near-term risk for sectors beyond crypto, since that data is already being harvested.
Access to quantum computing will eventually become a commodity cloud service, much as GPU access is today, first passing through a phase of government and large corporate exclusivity.

Reading List

Learn more about these topics mentioned in the episode, or explore our library of articles on Ledger Academy: