Bitcoin and Ethereum Are Betting on Old-School Hash Functions, Not NIST's Favorite Quantum-Proof Math

Quantum computers that can break Bitcoin's encryption don't exist yet. Nobody knows when, or if, they will. But the people who build the cryptography underneath Bitcoin and Ethereum aren't waiting to find out the hard way.

The National Institute of Standards and Technology finalized its first post-quantum cryptography standards in August 2024. Two digital signature schemes came out of that process, and they work on fundamentally different bets about what math will still be safe in a quantum future.

The first is ML-DSA, formalized as FIPS 204 and built on an algorithm called CRYSTALS-Dilithium. It's lattice-based, meaning its security depends on how hard it is to solve certain geometric problems in high-dimensional space. According to Ledger CTO Charles Guillemet, this has become the default choice across most of the tech industry outside crypto.

The second is SLH-DSA, formalized as FIPS 205 and built on an algorithm called Sphincs+. Its security rests entirely on hash functions, the cryptographic building blocks used since the earliest days of computing. No new mathematical assumption required.

Bitcoin and Ethereum developers, per Guillemet, are gravitating toward the hash-based option, not the one winning everywhere else.

Why hash functions, not lattices

Guillemet's explanation is straightforward. Sphincs+ doesn't ask anyone to trust a mathematical idea that hasn't been stress-tested for decades. Its security traces back to hash functions like SHA-256 and SHAKE, tools Bitcoin and Ethereum have relied on since their creation.

Lattice-based cryptography is newer territory. The math is taken seriously by NIST and the broader cryptography community, but it hasn't accumulated the same decades of adversarial testing that hash functions have. For a system securing enormous value with no central authority to patch a bad assumption after the fact, that difference matters more than it would for a corporate VPN.

Bitcoin currently secures transactions using the secp256k1 elliptic curve. Ethereum uses a comparable elliptic curve scheme. Both are fast and well understood. Both are also exactly the kind of math that Shor's algorithm, running on a sufficiently powerful quantum computer, is theoretically capable of breaking, letting an attacker derive a private key from a public one.

That's what's driving this work. Nobody in these sources claims a quantum computer capable of that exists today. The work is preventive, not reactive.

The tradeoff nobody gets around

Sphincs+ isn't free. Its signatures are much larger than the elliptic curve signatures blockchains use now, and on a blockchain, size is money. Bigger signatures mean higher storage costs, more bandwidth, and a tougher economic calculation for anyone running a node.

Ethereum researchers have been exploring optimized Sphincs+ variants aimed at making verification more tractable inside the Ethereum Virtual Machine, according to Guillemet's account. That work is ongoing, not finished, and there's no announced timeline for when, or whether, a hash-based signature scheme gets adopted at the protocol level for either network.

For Ledger, the calculus is more immediate. The company's security team is actively building post-quantum cryptography into its hardware wallet firmware, targeting the secure software elements that handle key storage and signing. Guillemet has indicated that Ledger plans to ship firmware support for both ML-KEM, the post-quantum key encapsulation mechanism, and ML-DSA by the end of June 2026. ML-KEM handles key exchange, while ML-DSA handles signatures, together covering both the communication channel and the authentication layer of a hardware wallet.

What's actually unresolved

Bitcoin and Ethereum are not adopting post-quantum signatures on any fixed schedule. This is R&D and standards-setting, not a network upgrade in progress. Migrating either blockchain's signature scheme would require broad developer consensus and, in Bitcoin's case, the kind of contentious process that any protocol-level change historically triggers.

Migration to post-quantum schemes will likely also require existing wallet holders to move funds to new addresses generated under the new standards, similar to how early Bitcoin users moved from uncompressed to compressed public keys.

The bigger open question is timing risk. If a cryptographically relevant quantum computer arrives faster than the migration work gets done, old wallets holding funds under exposed public keys would be vulnerable retroactively. That's a scenario security researchers have flagged for years without a firm date attached to it, and it's the reason Guillemet and Ledger are treating this as engineering work to do now rather than a problem to defer.

There's no confirmed date for when Ethereum's optimized Sphincs+ work concludes, and no indication either Bitcoin or Ethereum has committed to a hard fork implementing any of this. Anyone claiming otherwise is ahead of what's actually been announced.