Mentioned in This Article
1. Foundation bets on wireless with the Passport Prime wallet
Foundation co-founder and CEO Zach Herbert is publicly explaining QuantumLink, the encrypted Bluetooth protocol built into the company's Passport Prime wallet, as the hardware maker moves away from the QR-code air gap that defined its earlier devices. The design pairs a physically separate Bluetooth chip with CRYSTALS-Kyber, a post-quantum key exchange, and ChaCha20-Poly1305 message encryption.
The shift is notable because Foundation built its standing among self-custody users on a strict rule: the device that holds private keys should not talk to anything over a cable or a radio. With the Passport Prime hardware wallet, the company is arguing that a carefully isolated wireless link can deliver the convenience of a live connection while keeping most of the security properties that an air gap provides, and adding protection against a threat that does not yet exist at scale: quantum computers able to break today's public-key cryptography.
Herbert's explanation lays out three promises at once. Users get a real-time connection between the wallet and their phone. The radio that carries that connection is walled off from the part of the device that guards the keys. And the handshake that sets up the encrypted channel is designed to hold up even against an adversary equipped with quantum hardware.
2. Why hardware wallets avoided radios in the first place
For years, the most cautious advice in Bitcoin self-custody was to keep a signing device completely disconnected. An air-gapped wallet never joins a network, never pairs with a phone over a radio and never plugs into a computer. Data still has to move in and out, because a wallet must receive the details of a transaction and return a signature, but it moves through a channel that an attacker cannot easily reach from a distance.
Foundation's earlier approach used QR codes for that job. One screen displayed a code and the other device's camera scanned it. Nothing about the exchange involved a wire or a wireless signal, which meant there was no persistent link that malware on a phone or laptop could exploit to probe the wallet. The cost was friction: every step that required the two devices to share information meant pointing a camera at a screen, sometimes repeatedly for larger transactions.
Radios carry a reputation problem in security circles for a reason. Bluetooth stacks are large and complex pieces of software, and complexity creates room for bugs. A wallet that exposes its main processor to a wireless protocol hands a remote attacker a potential entry point, which is exactly what the air-gap philosophy was meant to eliminate. Any company that adds Bluetooth to a device holding private keys has to answer the question of what happens if the radio itself is compromised.
3. How does QuantumLink keep the Bluetooth chip away from the keys?
QuantumLink isolates the radio on its own dedicated chip, physically separate from the security processor that runs KeyOS, the Passport Prime operating system. The Bluetooth chip moves traffic between the wallet and the phone, but every message is already end-to-end encrypted before it reaches the radio, so the chip carries data it cannot read.
That separation is the core of Foundation's argument. In a conventional design, a flaw in the wireless stack could give an attacker a foothold on the same processor that handles keys and signing. In the Passport Prime layout, the radio is treated as an untrusted courier. It sits outside the trusted boundary, handles only ciphertext and hands that ciphertext to a security processor that decides for itself what to accept.
Foundation states that KeyOS accepts only properly authenticated messages and discards anything else. The operating system can also switch QuantumLink off, cutting power to the Bluetooth chip so that wireless communication becomes impossible. Users who prefer the older model can disable Bluetooth entirely and rely on other connection methods, including the QR codes Foundation has long used.
The company's position is that even a malicious or compromised Bluetooth chip would be left holding encrypted traffic, with no ability to read it or to slip commands past the security processor. Whether that holds in practice depends on the implementation details, but the architecture is designed so that the radio's integrity is not something the user has to trust.
4. The cryptography: CRYSTALS-Kyber and ChaCha20-Poly1305
Two cryptographic tools work in sequence inside QuantumLink. CRYSTALS-Kyber handles key exchange, the step in which the wallet and the companion app agree on secret material without sending it in the clear. ChaCha20-Poly1305 then encrypts and authenticates the individual messages that pass between them.
A simple way to picture the division of labor is that Kyber builds the lock and ChaCha20-Poly1305 protects each conversation that passes through it. Foundation says each message is protected with its own symmetric key under ChaCha20-Poly1305, a widely deployed cipher valued for its speed in software and its built-in integrity check, which lets the receiver detect any tampering.
Kyber is the post-quantum piece. It belongs to a family of lattice-based algorithms that cryptographers consider resistant to attack by quantum computers as well as classical ones. The algorithm was later standardized by the US National Institute of Standards and Technology under the name ML-KEM, so the same scheme may appear under either label. Foundation chose it for the wallet's key pair instead of elliptic curve cryptography, the approach that secures most of today's wireless and internet connections.
5. Why post-quantum encryption matters for a Bitcoin wallet
The concern behind the design is that a sufficiently powerful quantum computer could run algorithms capable of breaking the elliptic curve and RSA systems that underpin much of modern encryption. No machine capable of doing that exists today, but security engineers worry about a strategy often described as harvest now, decrypt later: an adversary records encrypted traffic now and stores it until the hardware to crack it arrives.
For a wireless link between a wallet and a phone, that risk applies to the handshake. If the initial key exchange relied on classical elliptic curve math, a recording of it could, in principle, be unlocked years later, exposing whatever passed through the channel. By using Kyber for the handshake, Foundation aims to keep that initial exchange secure against both present-day and future attackers.
Symmetric ciphers such as ChaCha20 are generally regarded as far less exposed to quantum attack than public-key schemes, which is why the post-quantum upgrade is concentrated on the key exchange. The combination is meant to make the whole channel resilient, not just the part that is easiest to defend today.
It is worth separating this from the broader debate over Bitcoin itself. QuantumLink protects the communication link between a wallet and a phone. It does not change the signature scheme that the Bitcoin network uses to authorize spending, which is a protocol-level question that sits outside any single hardware vendor's control. The wallet protocol addresses one layer of the quantum question, the transport layer, rather than the whole stack.
6. Pairing over QR codes keeps the radio blind
Before any Bluetooth traffic flows, the wallet and the Envoy companion app exchange public key material out of band, through a QR code displayed on the Passport Prime screen and scanned by the phone. Because that exchange never touches the Bluetooth link, the radio chip never sees the values used to set up the encrypted tunnel.
The pairing step is where the old and new approaches meet. Foundation has not abandoned QR codes; it has repositioned them. Instead of using the camera for every interaction, the camera is used once, at the moment when trust is established. After that, the Bluetooth link handles day-to-day traffic inside a channel whose keys were agreed on without the radio's involvement.
This matters for a specific class of attack. If the keys were negotiated over Bluetooth, a compromised radio or a nearby attacker might try to insert itself between the two devices during setup. Moving that exchange to a visual channel that the user controls directly closes off that route, and it means a compromised chip would only ever handle traffic it has no means to decrypt.
7. What QuantumLink does for everyday Passport Prime users
In practical terms, QuantumLink replaces repeated QR scanning with a live Bluetooth connection to Envoy, Foundation's companion app. Herbert describes the link as handling onboarding, transaction signing, firmware updates and syncing between the wallet and the phone, tasks that previously required the user to shuttle codes between screens.
Firmware updates are a good example of the convenience on offer. With a QR-only device, delivering a new version of the operating system is a slow and awkward process. Foundation says KeyOS updates can be delivered wirelessly over QuantumLink, which lowers the effort required to keep a device current, a meaningful consideration given that outdated firmware is itself a security risk.
For onboarding, the user scans the QR code on the device with Envoy, the app sends back its own public key, and an encrypted tunnel is established. From that point, the phone and wallet can interact in real time, which brings the experience closer to the mainstream consumer devices that many newer Bitcoin holders are used to.
8. Who designed the protocol and when it arrived
Foundation publicly introduced QuantumLink on January 23, 2025. The company developed the protocol with Blockchain Commons, a group that works on open specifications for wallet interoperability and security, which took part in the design work.
Passport Prime went on to ship with QuantumLink built in, making the protocol a standard part of the device rather than an optional add-on. Earlier generations of Passport relied exclusively on a QR-code air gap with no wireless communication, so the new device marks a clear break in the product line's approach to connectivity.
9. The open question: can the isolation be proven in practice?
Discussion among self-custody users has focused on the risks that come with any Bluetooth-capable device holding keys. Foundation's answer is architectural, and the burden now falls on the company to show that the hardware separation it describes works as intended in real-world conditions, not only on a design diagram.
That is the familiar trade-off at the center of the Passport Prime story. An air gap is easy to explain and easy to verify: if there is no radio, there is nothing to attack over the air. A layered design with an isolated chip, out-of-band pairing and post-quantum encryption can offer far better usability, but its safety rests on the correctness of several components working together.
For now, Foundation is betting that buyers will accept that trade if the engineering is sound, and that the option to switch Bluetooth off entirely will reassure those who are not yet convinced. Herbert's public explanations of QuantumLink are part of that case, as the company tries to persuade a cautious audience that a hardware wallet can connect wirelessly without giving up the security that drew users to Foundation in the first place.