Wallets with post-quantum cryptography.

[satscraper]

Feeling like the time is right to open the thread dedicated to wallets supporting post‑quantum cryptography (PQC).

SciChain was probably the first wallet to declare quantum resistance using ML‑DSA‑44 (NIST FIPS 204). Then came Qastle, and now we have BMIC.

In addition, several manufacturers such as SEALSQ, QuantumEmotion, and SatoshiLabs ^{with their newest TROPIC01} have begun producing PQC‑secure chips. So we should expect the appearance of new wallets centered on PQC.

Given this, I took the liberty of compiling a list of post‑quantum wallets currently available to users:

• SciChain
• Qastle
• BMIC
• *Trezor Safe 7
• To be continued

*) After the release of firmware focused on PQC.

Please feel free to add any relevant information that may help expand this list.

[Pmalek]

I think it's premature to be creating wallets and solutions for a post-quantum area when Bitcoin hasn't even started discussing a post-quantum algorithm to migrate to yet. Certain people have made suggestions and released information, but that's about it. Have Bitcoin developers started making any concrete steps? The community needs to reach a new consensus on the future algorithm and signature scheme, and if I remember correctly, those who call themselves or are considered experts on the matter don't think any of those post-quantum algorithms are optimal for Bitcoin. They increase signature sizes by a lot.

Right now we are just guessing what harm quantum computers will make and guessing which implementations will keep Bitcoin safe from them.   

[BlackHatCoiner]

I agree with Pmalek. It's good to be aware, but implementing these algorithms at the firmware level, when there's far from consensus on the mitigations of bitcoin at the main layer, is not sitting well to me. At best, they can make it infeasible for a quantum computer to decrypt sensitive information stored on those devices. However, that requires an enormous leap in assumptions: (1) that a quantum computer capable of factoring a sufficiently large number of bits actually exists, and (2) that such a computer would target the encryption on those devices rather than attacking cryptography that directly secures millions of bitcoin in the first place.

[satscraper]

/|\

I am on the opposite side of this matter. When it comes to any threat it is always better to be prepared before it appears.

To stand against quantum computers wallets will need the large quantum‑resilience stack that includes technologies like QRNG, PQC, PQA, and more. None of this can be created with the wave of magic wand. Therefore, wallet developers must start selecting the top solutions now, and to do that, they must begin developing them immediately.

Regarding the relevant changes at the blockchain level, they are certainly needed. ^{AFAIK, some blockchains are already at the testing stage}.

[ABCbits]

AES-256 is probably common encryption cryptography and deemed as QC resistant[1].

• SciChain
• Qastle
• BMIC

Those 3 wallet appear to be closed source, with some reliance to their server. In addition, the first 2 are subscription based. Personally i would just stay away from all of them.

[1] https://crypto.stackexchange.com/a/7869

[BlackHatCoiner]

I am on the opposite side of this matter. When it comes to any threat it is always better to be prepared before it appears.

Always be prepared, but how prepared are you for one of those quantum algorithms to be broken by a classical computer? It's not clear to me how secure and robust all these mathematical pieces are. They are definitely less than the encryption we already use for decades. In security, when replacing an option with another, you should consider all the implications. A quantum computer breaking old encryption is one. What about finding a vulnerability in one of these encryption schemes, and breaking it with a classical computer, before quantum computers are even a thing?

And I didn't even notice they're closed source. Big red flag.

[satscraper]

AES-256 is probably common encryption cryptography and deemed as QC resistant[1].

• SciChain
• Qastle
• BMIC

Those 3 wallet appear to be closed source, with some reliance to their server. In addition, the first 2 are subscription based. Personally i would just stay away from all of them.

[1] https://crypto.stackexchange.com/a/7869

Sure, you are free to stay away from those wallets.

BTW, QRC is not the only requirement for  wallet to be considered quantum‑resilient. Any seed generated by poor classical RNG can undermine security and make the wallet vulnerable even to attacks from ordinary machines. QRNG protects wallets from this vulnerability.

should consider all the implications.

Definitely, we should. But before making any conclusions, things need to be tested and for testing the working stuff is required.

P.S. When Columbus sail to discover America various people also discourage him from doing so.  

[coinrifft]

I'm no expert but I have found this wallet who claims to be:

is built from the ground up with Post-Quantum Secure (PQS) cryptography, making it NIST Compliant and future-proof against even the most sophisticated attacks

https://wallet.ncog.earth/

It's a open source and here is the official github repository:

Code:

https://github.com/Ncog-Earth-Chain

extension and or wallet:

Code:

https://addons.mozilla.org/en-GB/firefox/addon/ncog_wallet/

Disclaimer: I'm not connected to this project. There is one bad review, but not sure if this is true or not, discretion is advise.

[ABCbits]

It's a open source and here is the official github repository:

Code:

https://github.com/Ncog-Earth-Chain

extension and or wallet:

Code:

https://addons.mozilla.org/en-GB/firefox/addon/ncog_wallet/

Disclaimer: I'm not connected to this project. There is one bad review, but not sure if this is true or not, discretion is advise.

Something is odd. Mozilla website says it's last updated 2 months ago

Last updated
2 months ago (4 Nov 2025)

But their repository seems to be last updated 3 years ago. I don't think i got wrong repository, since it's the only one with keyword "wallet".

[Forsyth Jones]

I don't see the need to worry about the quantum threat advancing on the current BTC cryptography and the security of wallets without this technology.

Aside from Trezor Safe 7, I've never heard of the names mentioned, and now that I've see they're closed source, I shouldn't waste my time with those wallets.

Various factors must be considered to see if the effort of implementing a post-quantum algorithm in Bitcoin or wallets is worthwhile:

What if the signature size increases absurdly?

Will it generate a new type of address? (One more?? This is already becoming annoying), the way wallets (except for Bitcoin Core, which is much more optimized and applied in the best way) manage these addresses is already confusing. For some wallets, you have to create several keystore wallets just to have a different type of address. Imagine the confusion when there are 10 new addresses, and the ton of difficulties falling mainly on newer users who already had trouble recovering balances in wallets?

For some wallets, you have to create several keystore wallets just to have a different type of address.

This has always been my criticism of current wallets, but it seems I'm the only one talking about it here.

And without even mentioning the quantum-ready feature of the Trezor Safe 7, in my view it's a wasted resource that won't serve any purpose and only made the product more expensive. When the quantum threat becomes a reality, either the Safe 7 will already be obsolete or Trezor will have already launched new models. They could have focused on some features the community needs more, such as the encryption options available in Coldcard, Passport, Krux, support for air-gap...

Naturally, the developers and the community will know when to look at this, as will the entire banking industry and all the basic infrastructure (networks, internet).

[satscraper]

I don't see the need to worry about the quantum threat advancing on the current BTC cryptography and the security of wallets without this technology.

I would recommend reading this ^{in my view very informative} document from MasterCard. It explains that “harvest‑now, decrypt‑later” attacks are already happening and includes plenty of information on the things you’re concerned about  ^{such as key sizes and signature sizes}. I assume that after studying this document thoroughly you might reconsider your position. But of course, if you never send from the addresses where you keep your stash and the size of the latter isn’t critical for you, then you may remain to be not worried.