Why PQ1 is a 10x over the current hardware wallet landscape

Last updated Jul 28, 2026

The problem with hardware wallets today

Every consumer hardware wallet currently on the market signs with elliptic-curve cryptography. The same ECDSA schemes that Vitalik has publicly estimated have a 20% chance of being broken before 2030, and that Google has set an internal 2029 deadline to migrate away from across their own infrastructure.

As of now, ECDSA is not broken, but three things should force every self-custody user to think seriously about what their next hardware wallet looks like:

Harvest-now-decrypt-later is already happening. Every transaction you’ve ever signed exposes your public key on-chain. A sufficiently large quantum computer can retroactively derive the private key from a public key. If you’ve ever made a single transaction, your funds are at risk, and 99.9% of wallets have. Also, with a fast enough quantum-computer, an attacker could derive your private key from a tx that is in the mempool and outbid you, stealing your funds when you make your first transaction.
Migration takes years, not weeks. This is why Google’s 2029 deadline exists. They don’t think Q-Day is 2029; they think migration takes that long.
SPHINCS became a standardized post-quantum signature scheme. And Ethereum’s account abstraction (ERC-4337) gave us a way to use it, without a hard fork.

The pieces are here. What’s been missing is a hardware wallet that actually assembles them, and one that does so in a way you can verify, not trust.

We built PQ1™ on four key architectural decisions. Each one is a direct response to a specific failure we’ve watched crypto ship for the last decade. Together, they make PQ1™ the first hardware wallet that is materially more secure than anything else on the market, and the last one you’ll ever have to migrate to.

Innovation 1: Post Quantum SPHINCS signatures via ERC-4337

A post-quantum hardware wallet that cannot sign post-quantum transactions is marketing, not engineering. Several competitors have announced “quantum-resistant” or “updated with post-quantum keys” product lines in recent years. None of these wallets sign transactions with a standardized post-quantum algorithm today, they merely employ “post-quantum signed” updates. This protects the device, not the assets secured by it.

PQ1™ secures the assets with post-quantum signatures. We implement SPHINCS, the gold standard in PQC as the primary signature scheme, and we surface it to the user through an ERC-4337 smart-wallet. This is the exact architecture Vitalik named in his 2026 Ethereum quantum-resistance roadmap as the practical migration path for every Ethereum user.

There are three reasons this matters:

1. SPHINCS is hash-based. Breaking it requires breaking the underlying hash function, which is a strictly weaker cryptographic assumption than breaking an elliptic-curve discrete log. It is not reliant on unproven hardness assumptions like lattice schemes. It is conservative cryptography.

2. ERC-4337 makes the gas cost tractable. Pure on-chain SPHINCS verification on L1 is expensive because the signatures are large (roughly 8–50 KB). Using our gas friendly SPHINCS-C10 implementation, verification happens inside the smart wallet, and gas is paid once for the verification logic (~197K gas in our benchmarks, ~62K if batched with three or more ops), and the signature itself lives in the UserOp. On L2s like Base and Arbitrum, this is negligible.

3. PQ1™ is not just a post-quantum signer, it is a migration device. While you don’t need to migrate today, having a wallet on your desk to which you can migrate to in minutes when the time comes, is insanely valuable.

Innovation 2: Reproducible builds with 8-word bootloader verification

If there was ever a time for hackers to exploit funds, it would be prior to migrating to a secure device like the PQ1™. Some hardware wallets even state that updates could include the extraction of private keys. This is an explicit attack vector, and it is the reason why the PQ1™ is built differently.

A closed-source hardware wallet is asking you to take two things on faith at once:

That the firmware does what the vendor says it does,
That the firmware running on your device is the firmware the vendor claims to have shipped.

You cannot verify either. The only security guarantee you have is the vendor’s reputation.

PQ1™ replaces both acts of faith with a single act of verification.

Our firmware, bootloader, and build pipeline are fully open source. Anyone can compile the firmware themselves, from source, and produce a bit-for-bit identical binary to what we ship. This is what “reproducible builds” means in the strict sense, the same source always produces the same binary, for anyone, anywhere.

On every boot, PQ1™ displays an 8-word bootloader hash, a human-readable digest of the firmware running on the device. You compare those eight words to the hash of the firmware you built yourself (or to a hash published by security researchers who built it). If they match, the device is running the code you expect. If they don’t, something has changed.

This is a fundamentally different trust model. Other wallets’ closed-source secure element means nobody can verify what is running on the device, not the company’s own customers, not independent security researchers, not even regulators. Our reproducible-build pipeline means anyone can verify. No other hardware wallet currently provides this.

Innovation 3: Dual EAL6+ enclaves with XOR-split seed from two different vendors

Every single-enclave hardware wallet publicly researched has eventually been broken. This is not a hypothetical. Kraken Security Labs demonstrated a glitch attack on Trezor’s STM32 in 2020. Ledger’s own Donjon team has published side-channel research against competing and predecessor chips. Every one of these attacks relied on compromising a single piece of silicon.

A single enclave is a single point of failure.

PQ1™ splits the seed across two EAL6+ certified secure elements, sourced from two entirely different vendors with entirely different supply chains. The seed is stored as an XOR of two random halves, one in each enclave. Knowledge of one half provides zero information about the other. This is information-theoretically secure, not merely computationally hard.

To extract the key, an attacker must:

Compromise two separate pieces of silicon from two separate vendors, and
Do so in the same device, without triggering any of the layered physical tamper detection, and
Succeed in a scenario where no single public research attack has yet defeated dual-vendor architecture.

The common rebuttal is that two enclaves double the attack surface. This is true in the sense that there are two pieces of silicon to attack. It is false in the sense that matters: both must fall for the seed to leak. This is strictly stronger than any single-enclave design.

Dual-vendor, XOR-split seed is new to consumer hardware wallets. Competitors who cite “multiple secure elements” in their marketing typically use three chips from the same vendor, which, if that vendor has a supply-chain compromise, fails catastrophically.

Different vendor, different supply chain, different attack geometry. That is our design goal.

Look at the last dozen major hardware-wallet-adjacent exploits of the past two years. Inferno Drainer. The 2025 Bybit Gnosis blind-signing attack. The WazirX multisig drain of 2024. The Wintermute Profanity incident.

In almost every case, the user’s hardware wallet did exactly what it was designed to do: it asked for approval, the user approved, and funds were drained. The root cause was that the user had no meaningful way to understand what they were approving. Most hardware wallets show a hexadecimal blob ``` 0x5a1f... ``` and ask the user to trust that the app is telling them the truth about what that blob does.

Blind signing is the largest exploitable attack surface in all of self-custody. And the industry has normalized it.

PQ1™ replaces blind signing with locally-verified clear-signing. Every Cowswap and most safe transactions intent is reduced to a human-readable summary that the device itself proves corresponds to the on-chain operation:

“Sell 100 USDC for at least 0.4 WETH on CoW Swap”

Not a hash. Not a hex blob. Not a “trust this app” prompt. The actual trade intent, verifiable on-device.

Clear-signing is not a feature. It is the single most consequential security decision in a hardware wallet’s UX. PQ1™ is the first consumer device that makes it work for arbitrary smart-contract calls.

Open hardware, open software, fully inspectable

Each of the four innovations above is a big step above current hardware wallets, but together they’re held up by something more fundamental: everything on PQ1™ is open and verifiable, end to end.

This is not an open-source-as-marketing label. It is fully verifiably open-source with the chops to prove it. Specifically:

Hardware schematics are public. The PCB design, the component list, the secure-element pinouts, the tamper-detection circuitry. You can reconstruct the device from its published design files in our Github repo.
Firmware is published under GPLv3.
Bootloader is published under GPLv3.
Smart contracts (the AA wallet, the SPHINCS verifier, the paymaster) are published under AGPL, under security review by Trail of Bits, and deployed with verified source on every chain we support.
Build pipeline. Anyone can produce the shipping firmware binaries byte-for-byte.
Reference firmware-hash tooling lets you derive the 8-word bootloader hash from any source tree, so you can verify your device matches your build in 30 seconds.

That means every PQ1™ device that ships is simultaneously a consumer product and a subject of continuous, adversarial, public security research. The device gets more trustworthy every month as researchers examine more of it.

A closed-source device cannot benefit from this feedback loop; nobody outside the vendor can look at it. We want everything to be laid out in the open, so you can verify it yourself, not just trust us.

Why nobody has built this yet

Hardware wallets are a durable-goods business with high trust friction. Vendors are incentivized to ship the same architecture year after year with new industrial design, because every architectural change risks breaking customer confidence. The result is that the category has stagnated while the threat model has evolved.

PQ1™ is designed from the opposite direction: we started by asking what the threat model will look like in 2029, quantum-emergent, AA-native, clear-sign-required, verifiability-mandatory, and we built backwards from there.

What this means for you

If you’re using a hardware wallet today, you have three options:

You can stay with what you have. ECDSA is fine today. If quantum-emergent attacks arrive later rather than sooner, if your addresses stay unused, if your hardware vendor never ships a compromised firmware update, you will probably be fine. Many people will make this bet.

You can wait to migrate. Every major vendor is likely to announce a “quantum-safe” SKU over the next 18 months. Some will be real. Most will be closed-source firmware claims with no verification path. You will need to evaluate each one against the four questions we’ve built PQ1™ to answer: Is the firmware open source? Is the build reproducible? What is the signature scheme? Dual-enclave or single?

Or you can migrate now, at the only point in hardware-wallet history where a device exists that answers all four questions correctly, and where migrating is cheap, unforced, and verifiable.

PQ1™ is that device.

They ask you to trust. We let you verify.

Post-quantum. Open source. Yours.

PQ1™.