Will Quantum Computers Break SafePal?

Will quantum computers break SafePal? It is a precise, answerable question, and this article works through it methodically. SafePal uses the same elliptic-curve signature scheme underpinning almost every major hardware and software wallet today. That scheme has a known theoretical vulnerability to sufficiently powerful quantum hardware. Below, we examine how the attack works, what conditions must be met, where expert timelines currently stand, what SafePal holders can do in practice, and how wallets designed from the ground up with post-quantum cryptography differ from the current generation of devices.

How SafePal Secures Private Keys Today

SafePal wallets, including the S1 hardware wallet and the SafePal Software Wallet app, generate and store private keys using standard elliptic-curve cryptography. Specifically, they rely on:

• ECDSA (Elliptic Curve Digital Signature Algorithm) with the secp256k1 curve for Bitcoin, Ethereum, and most EVM-compatible chains.
• Ed25519 for some Solana and Cosmos-based assets.
• BIP-32 / BIP-39 hierarchical deterministic key derivation, where a 12- or 24-word seed phrase generates all child keys.

The security of these schemes rests on the discrete logarithm problem on an elliptic curve. A classical computer cannot derive a private key from a public key in any practical timeframe because the problem scales exponentially with key size. A sufficiently capable quantum computer, however, changes that equation fundamentally.

The Role of the Public Key

Every time you send a transaction, your wallet broadcasts a signature generated from your private key. In many transaction flows, the corresponding public key is also revealed on-chain. Once a public key is exposed, an attacker who possesses a large-scale quantum computer could theoretically run Shor's algorithm to reverse the elliptic-curve discrete logarithm and recover the private key.

For addresses that have never sent a transaction, the public key is not yet revealed. Only the hash of the public key is public. This distinction matters for the realistic threat model, as discussed below.

What SafePal's Hardware Secure Element Does and Doesn't Do

The S1 uses an EAL5+ certified secure element to isolate the private key from the host device. This protects against classical side-channel attacks, malware, and physical tampering. It does not change the underlying cryptographic algorithm. If the signing algorithm is broken, the secure element's physical isolation becomes irrelevant for that specific threat vector.

---

Understanding Shor's Algorithm and the Q-Day Concept

Shor's algorithm, published in 1994, demonstrates that a quantum computer operating with enough stable, error-corrected qubits can solve the integer factoring problem and the discrete logarithm problem in polynomial time. For ECDSA on secp256k1, breaking a 256-bit private key is estimated to require roughly 2,330 logical qubits running in a fully error-corrected state, according to research from the University of Waterloo and updated estimates published in 2022 by researchers at Sussex.

Q-day is the informal term for the point at which a quantum computer capable of executing this attack actually exists and is accessible to a motivated adversary.

The Gap Between Logical and Physical Qubits

Current quantum hardware operates with physical qubits, which are noisy. To construct one reliable logical qubit, existing error-correction codes require anywhere from several hundred to several thousand physical qubits depending on the target error rate and the correction scheme used. IBM's 2023 Heron processor topped out at 133 physical qubits. Google's Willow chip, announced in late 2024, reached 105 physical qubits with improved error correction.

Bridging the gap from ~100 noisy physical qubits to the thousands of stable logical qubits needed to attack secp256k1 is not a matter of a few product generations. Most credible estimates from cryptographers and national security agencies place a cryptographically relevant quantum computer (CRQC) at 10 to 20 years away, with 2035-2040 as a commonly cited central scenario. Some outlier estimates suggest it could happen sooner under sustained government investment, but no mainstream security body has moved their guidance to "imminent."

---

What Would Have to Be True for SafePal to Be Broken

For a quantum computer to break a SafePal-secured address, all of the following conditions must hold simultaneously:

1. A CRQC exists. Thousands of logical, error-corrected qubits running Shor's algorithm reliably. This does not exist today.
2. The attacker has access to it. Even after a CRQC is built, early access will be extremely restricted. Nation-state actors are the most plausible first users.
3. Your public key is exposed on-chain. Addresses that have sent at least one transaction have revealed their public key. Addresses that have only received funds have not.
4. The attack window is open. A transaction takes minutes to confirm on most chains. An attacker must break the private key faster than the network finalises the transaction, or target long-lived exposed public keys.

This last point is worth emphasising. The most acute vulnerability is not "someone steals your wallet," it is "someone scans the blockchain for addresses whose public keys are known, then derives their private keys once a CRQC is available." Every satoshi or ether sitting in a reused, previously-spent address is permanently at risk from that point forward.

---

Realistic Timeline and What NIST Says

The US National Institute of Standards and Technology (NIST) finalised its first set of post-quantum cryptography (PQC) standards in August 2024, selecting:

• ML-KEM (formerly CRYSTALS-Kyber) for key encapsulation.
• ML-DSA (formerly CRYSTALS-Dilithium) for digital signatures.
• SLH-DSA (formerly SPHINCS+) as a stateless hash-based signature scheme.

NIST's explicit guidance is that organisations should begin migrating now, not when a CRQC is confirmed. The reasoning: migration takes years, and adversaries are already running "harvest now, decrypt later" operations, storing encrypted data today to decrypt once quantum hardware matures. For blockchain assets, the equivalent is recording all exposed public keys from the chain's entire history, ready to attack them once the hardware arrives.

The NSA's CNSA 2.0 suite, released in 2022, set a transition deadline of 2030 for new systems and 2035 for most legacy systems. Wallet infrastructure is not explicitly in scope, but the directional guidance is clear.

---

What SafePal Holders Can Do Right Now

SafePal itself has not publicly announced a roadmap for integrating post-quantum signature schemes as of mid-2025. That is not unusual. No major hardware wallet vendor, including Ledger or Trezor, has shipped PQC signing support for Bitcoin or Ethereum mainnet, largely because the underlying networks have not yet adopted PQC signature standards at the protocol level.

That said, there are concrete steps holders can take to reduce their exposure:

Step 1: Audit Your Address Reuse

• Open your transaction history across all chains.
• Identify any address from which you have sent at least one transaction. That address has a revealed public key.
• Move funds to a fresh, never-used address generated from your existing seed. Do this before a CRQC threat materialises, not after.
• Use a new address for every receive, the default behaviour in Bitcoin's native SegWit and Taproot address types.

Step 2: Understand Your Most Exposed Assets

Step 3: Follow Protocol-Level Developments

Bitcoin developers have begun exploratory discussions around quantum-resistant signature opcodes. Ethereum's roadmap includes a long-term account abstraction path that could accommodate PQC signatures. Subscribe to EIP and BIP mailing lists, or follow researchers like those at the Ethereum Research forum, to track when viable migration paths emerge at the protocol level.

Step 4: Diversify Into Natively Post-Quantum Designs

For holders who want exposure to a wallet architecture designed from day one around post-quantum cryptography rather than retrofitted later, purpose-built solutions are beginning to emerge. BMIC.ai, for example, is a quantum-resistant wallet and token built on lattice-based cryptography aligned with the NIST PQC standards, designed specifically so that Q-day does not represent an existential threat to user funds. Its presale is currently live for those researching this category of asset.

---

How Natively Post-Quantum Wallet Designs Differ

The fundamental architectural difference between a SafePal-style wallet and a natively post-quantum wallet comes down to the signature algorithm selected at design time.

The trade-off is real. Lattice-based signatures are larger, which increases transaction fees and storage requirements. SPHINCS+ signatures are even larger. These are engineering constraints the field is actively working to reduce, but they are not showstoppers for security-first use cases.

---

The Honest Verdict

SafePal is a well-engineered wallet for the current threat environment. Against classical attackers, malware, and physical theft, its secure element and air-gap design provide meaningful protection. Against a future cryptographically relevant quantum computer, it shares the same vulnerability as every other ECDSA-based wallet on the market today.

Whether that vulnerability becomes a practical problem depends on three things: when a CRQC arrives, whether your specific addresses have exposed public keys, and whether the underlying blockchain protocols have migrated to PQC signatures before that date. None of those outcomes are certain, but all of them are worth planning around now, because the blockchain record is permanent and public keys, once revealed, cannot be un-revealed.

The prudent approach is not panic. It is good hygiene now, close attention to protocol-level PQC migration timelines, and a considered decision about whether any portion of your holdings should sit in infrastructure designed with the post-quantum era as a baseline rather than an afterthought.