PQ1 and the Quantum Vault Problem: How Freedom Factory Built a Wallet the EVM Can't Open Yet
Ansemtoshi
Over the past week, crypto's most interesting hardware story wasn't a new Ledger skin. Markus Haas, CEO of Freedom Factory — the team behind the ethOS mobile operating system — sat down on Unchained to announce PQ1, a hardware wallet he calls the first quantum-secure device of its kind. The twist isn't the algorithm. It's the instruction manual: Haas says you can build the entire thing yourself, comparing an eight-word checksum against open-source code to verify the device hasn't been tampered with. For a category built on trust-in-a-box, that's either a revolution or a liability.
To understand PQ1, you need the current hardware wallet baseline. Ledger has sold over six million devices on a model that combines a certified Secure Element chip with closed firmware. Trezor offers open-source code but still routes trust through manufactured hardware. Both rely on ECDSA, the elliptic-curve signature scheme that has protected Bitcoin and Ethereum for over a decade. The threat model is straightforward: a sufficiently advanced quantum computer running Shor's algorithm could reconstruct private keys from public addresses. NIST has coordinated migration standards since 2016, and in 2024 standardized SPHINCS+ — a hash-based signature scheme — as the conservative fallback option. The incumbent hardware makers have been slow to respond. Ledger's roadmap mentions quantum research in abstract terms, but no shipping product from the major vendors has integrated a post-quantum signature scheme. That gives PQ1 a genuine first-mover claim — even if the underlying algorithm is standardized rather than novel.
Freedom Factory chose exactly that. The CEO's rationale is that hash-based signatures rely only on collision resistance and preimage resistance, properties that have survived over forty years of cryptanalysis. Lattice-based schemes like Kyber and Dilithium are faster and produce smaller signatures, but their mathematical hardness assumptions are roughly two decades old. That trade-off mirrors NIST's own prudence: SPHINCS+ was deliberately positioned as the cautious backup. For a device whose entire value proposition is 'your keys survive the future,' choosing the most battle-tested primitive is logically consistent. The problem begins when that primitive meets the Ethereum Virtual Machine.
Signature size is the first collision. SPHINCS+ signatures run into the kilobyte range; ECDSA produces just 64 bytes. On an EVM chain, where calldata and storage are priced by the byte, a post-quantum signature could multiply transaction costs by an order of magnitude. On a congested L2, where users are already price-sensitive, a kilobyte-scale signature could be the difference between a viable transaction and an economically irrational one. The launch materials don't disclose PQ1's exact signature size or signing latency — a conspicuous omission for a product claiming to support 'all EVM chains.' My prior work auditing validity proofs for a Layer 2 foundation taught me this is not a cosmetic issue. It's a protocol-level constraint. You cannot bolt a hash-based signature onto an Ethereum transaction unless the chain itself knows how to verify it.
That is the elephant the narrative avoids. The EVM cannot verify post-quantum signatures today. A wallet-generated quantum-safe address would be a new address type, not a standard EOA. Ordinary dApps, indexers, and relayers would require a supporting compatibility layer. 'Supports all EVM chains' likely means 'can custody assets on those chains,' not 'can interact with everything on those chains.' In practice, PQ1 users may be able to hold funds but not deploy them in DeFi without infrastructure that doesn't exist yet.
Then there's the eight-word check. It appears to be a manual firmware verification mechanism: the user compares the words displayed on the device screen against expected values hardcoded into the open-source repository. It's an elegant attempt to replace a certificate chain with decentralized distrust. But the unexamined components are the ones that matter most — the random number generator, the secure element, the physical tamper defenses. The article says nothing about whether those are open or auditable. Self-building eliminates supply-chain trust only if every component is equally verifiable, and a user with a soldering iron introduces failure modes no factory QA process would tolerate. Trust isn't removed; it's transferred to the least-equipped party in the transaction.
This also explains the Bitcoin exclusion. It's tempting to read it as a market miss — and it is, since Bitcoin represents the largest hardware wallet user base. But the technical reality is more interesting: Bitcoin's UTXO model and frozen address format make post-quantum migration far more invasive than on Ethereum, where account abstraction is already on the roadmap. Haas framed the exclusion as deliberate design. It's also a pragmatic admission of where migration is even feasible.
Now the contrarian angle: the self-build ethos is a security downgrade for most users, not an upgrade. Hardware security has historically been about removing human error, not amplifying it. The eight-word ritual is exactly the kind of flow phishing attackers will imitate, and a community built around DIY hardware will inevitably produce wallet-draining soldering accidents. Pre-assembled units still carry the supply-chain risk that self-building supposedly eliminates, and Freedom Factory has disclosed neither its manufacturing partners nor its firmware update mechanism. I understand the ideological appeal — I wrote 40 pages on delegated proof-of-stake centralization in 2017 for the same reason — but decentralization of manufacturing is not the same as decentralization of security.
And the timeline deserves honesty. Expert consensus still places Q-Day — the moment a quantum machine breaks ECDSA — roughly ten to twenty years out. PQ1 is insurance for a fire that hasn't started. That doesn't make it irrational; long-term holders rationally buy insurance. But calling a device 'quantum-secure' while the underlying chain cannot process its signatures is like selling a vault whose lock only the manufacturer's future protocol can open. Better to frame it as what it actually is: a premature, principled bet on a migration that hasn't begun.
The real signal isn't PQ1. It's that quantum resistance will eventually be a protocol feature, not a product niche. Hardware can signal intent, but it can't drag an entire stack forward. The projects worth tracking are those building signature-algorithm abstraction into the base layer — the forgotten cousin of account abstraction. History rhymes, but the code doesn't. And the code won't change until the cost of waiting exceeds the cost of migrating. Freedom Factory just made that bet public. Now we watch whether anyone else shows up.