Eight Words, No Secure Element: Inside Freedom Factory's Quantum Wallet Gambit

Markus Haas wants you to build his company's hardware wallet from scratch. Not metaphorically — literally. Solder the board. Flash the open-source firmware. Then verify the device is authentic by checking eight words on its screen against the expected values in the code. That's the security model behind PQ1, the self-proclaimed "first quantum-secure hardware wallet" from Freedom Factory, the team behind the ethOS mobile operating system. I've audited enough hardware wallet claims to know what usually sits at the center of these pitches: a certified secure element chip, a third-party audit, a warranty. PQ1's pitch is different. It says: don't trust us. Build it yourself. That's either the most honest thing I've heard from a wallet vendor in years, or a way to shift responsibility for unstated security gaps onto the user. Probably both. The product sits at an unusual intersection. On one side, the quantum threat timeline: experts generally place Q-Day — the moment a quantum computer can break ECDSA — at ten to twenty years out. On the other, NIST's post-quantum standardization effort, which concluded with SLH-DSA, better known as SPHINCS+, placed a hash-based scheme at the conservative end of the spectrum. PQ1 uses hash-based signatures like SPHINCS+ rather than lattice-based alternatives such as Kyber or Dilithium. The choice is defensible. Hash-based signatures rest on the collision resistance and one-wayness of hash functions — properties that have survived more than four decades of cryptographic scrutiny. Lattice schemes are more efficient and produce smaller signatures, but their hard problems only carry roughly twenty years of analysis. For a device designed to protect assets across a long holding window, choosing the older, slower math is the prudent move. The irony: the wallet's ambition is long-horizon security, yet its only supported networks are Ethereum and EVM chains. Bitcoin, the asset with the longest institutional holding horizon, is explicitly excluded. The stated reasons are technical. The strategic reasons are murkier. Consider how the product is being introduced. The launch appeared on Unchained, a podcast read by crypto-native users and developers — not CoinDesk, not CNBC. The venue tells you who Freedom Factory believes its buyer is: a person who already understands the difference between hash-based and lattice-based cryptography, or at least wants to. The company also paid for the privilege of attention — the episode doubles as a promotion for Unchained's paid subscription, which signals a marketing budget in a bull market where attention costs more than code. A hardware company that spends on narrative before it publishes a third-party audit is making a deliberate bet: ideology first, evidence later. In my years reviewing custody infrastructure for institutional clients, I've learned to ask three questions about any hardware wallet. What is the trust root? Can the vendor push malicious updates? And what happens when the user makes a mistake? PQ1's answers are revealing. Trust root: usually a secure element chip. PQ1 doesn't confirm one. The launch conversation never mentions a secure element, tamper resistance, or side-channel defense. Instead, the security narrative revolves around an eight-word check. The most reasonable interpretation: during initialization, the device displays a phrase users compare against values recorded in the open-source code, verifying firmware integrity. It's a decentralized substitute for a certificate chain. I understand the appeal. But the verification only confirms what the code does — not that the physically manufactured components weren't compromised. If the randomness source is malicious, eight words won't catch it. In my experience auditing failed projects, the component that kills users is rarely the headline algorithm. It's the unglamorous parts: the random number generator, the firmware update path, the supply chain. Update path: unmentioned. Key management: unmentioned. Random number generator: unmentioned. The disclosure has the shape of a product optimized for narrative, not security review. Then there's the EVM compatibility problem — the biggest technical risk that launch coverage doesn't want to discuss. Hash-based signatures are large. SPHINCS+ signatures run into the kilobyte range; ECDSA takes 64 bytes. On Ethereum, calldata is priced per byte. A post-quantum signature transaction could cost multiples of a standard transaction in gas — before the more fundamental issue that current EVM chains cannot natively verify hash-based signatures at all. PQ1 likely generates a new address type, not a standard EOA. If that's correct, "supports all EVM chains" means "can hold assets on EVM chains," not "can transact seamlessly with every dApp." A user who discovers they can store funds but not efficiently interact with DeFi has bought a very expensive vault. The original launch material itself flags this ambiguity. The gas problem doesn't stop at layer one. Any chain that settles data back to Ethereum inherits the same cost multiplier. I've spent the past two years watching rollup operators bleed money on proving costs in a low-fee environment; the economics of a kilobyte-scale signature on a data-availability layer are uglier still. Quantum-secure transactions, as currently designed, carry a structural tax that no subsidized sequencer can permanently absorb. That's not a criticism of the math. It's a warning about the economic layer that still has to wrap around it. Now consider the build-it-yourself model. I've sat with clients who believe self-custody means being their own bank. The subset who can also be their own hardware engineer is vanishingly small. Soldering is a skill. Electrostatic discharge is an enemy. A poorly assembled board is a security hole. The open-source, self-build approach removes supply chain trust for an elite few — and transfers nothing but risk to everyone else. From a vendor perspective, this is elegant: if you built it yourself and lost your keys, whose fault is it? The legal team is smiling. From a security perspective, it's a downgrade disguised as empowerment for 99.9 percent of potential users. Here is the uncomfortable conclusion. PQ1 isn't solving a present problem; it's selling insurance against a future one — Q-Day insurance with a ten-to-twenty-year maturity. Insurance is bought by the disciplined. Emotion is the asset; discipline is the hedge. In this cycle's euphoria, the market doesn't buy insurance; it buys upside. The institutions that genuinely need long-horizon quantum protection won't touch a wallet with no secure element confirmation, no third-party audit, and a DIY hardware model. The 2022 cycle drilled that lesson into me personally: the products that survived the liquidity contraction were the ones bought out of discipline, not fear. Fear-bought insurance gets lapsed the moment prices recover. Discipline-bought insurance compounds quietly. And then the Bitcoin exclusion. The CEO's technical explanation — Bitcoin's UTXO model and fixed address format make post-quantum migration genuinely harder — is plausible. But here's the market fact: Bitcoin remains the largest hardware wallet market. Post-ETF, the asset has become Wall Street's toy, yet the self-sovereign Bitcoin holders who actually buy hardware wallets remain the most sympathetic audience for a trust-minimized, open-source device. Excluding them means a product with a disruptive security philosophy deliberately avoids its own biggest pool of potential buyers. The engineering call is sound. The commercial logic is harder to defend. Freedom Factory has placed a bet that narrative timing will outrun technical maturity. By my estimates, it's two to five years early. Watch the competitive response: if Ledger or Trezor publishes a quantum-resistant roadmap within eighteen months, PQ1's first-mover advantage evaporates. Watch for the next IBM or Google quantum milestone that forces the industry's hand. And most importantly, watch for a third-party audit. If it arrives, the conversation changes. If it doesn't, eight words on a screen will never be enough — no matter how cleanly you soldered the board. Look at this from the macro angle as well. Quantum-secure custody will eventually become a table-stakes feature for institutional allocators, the way multi-sig became standard after the Mt. Gox collapse. The question is whether PQ1 is remembered as the first credible demonstration of that future, or a footnote that proved how far the industry still had to go. Hardware narratives don't drive cycles. Trust architecture does. And none of that architecture matures without public audit. Noise fades. Structure stays. This structure has a credible math story and an unproven physical one. The signal exists. The verification doesn't.