Panoramic Research Report: Is the Crypto World Ready to Face Quantum Attacks?

Original | Odaily Planet Daily (@OdailyChina)

Author | jk

What You Need to Know Before Reading: Clarifying Five Key Points

This report does not assume that readers have knowledge of cryptography or quantum physics; if you are only interested in the conclusions, you can skip directly to "Core Findings". Before diving into the main text, we will clarify five key concepts using everyday analogies.

1. What is the "Key" in Cryptocurrency?

Your Bitcoin or Ether does not exist in a file but is registered under a certain address on the blockchain. To spend this money, you must present a "digital signature" to prove to the entire network that you are the owner of this address. Generating a signature requires a private key, which only you know; verifying the signature uses a public key, which is public and can be used by anyone to verify.

You can think of it as a signature sample kept by a bank: the bank has your signature sample (public key), and when someone comes to withdraw money, the bank checks the handwriting against the sample (verifying the signature), but no one can imitate your exact signature just by looking at the sample (deriving the private key). This mechanism is reliable today because deriving the private key from the public key is mathematically considered infeasible. The threat of quantum computers lies in their potential to make this "impossible task" feasible.

2. What Has Changed with Quantum Computers?

Traditional computers crack passwords like a person trying each key from a large bunch, and no matter how fast they try, it would take astronomical amounts of time. Quantum computers do not try faster; they use a different approach to solving problems: for a specific class of mathematical problems, Shor's algorithm proposed in 1994 can reduce the time from "the age of the universe" to "minutes to hours".

It is important to emphasize that quantum computers are not omnipotent. They do not have advantages for the vast majority of everyday computing tasks. Unfortunately, the type of problems they excel at happens to be the foundation of public-key cryptography (including RSA and elliptic curves) that the internet and blockchain rely on today. In contrast, hash functions (which can be understood as a one-way meat grinder that turns any input into a fixed-length fingerprint) will only be slightly accelerated by quantum algorithms, making security mechanisms based on hashes relatively robust. This explains why most post-quantum solutions are leaning towards "hash-based" approaches.

3. Why Say "No Need to Panic, But Must Not Ignore"?

Currently, quantum computers are far from threatening Bitcoin. It takes about 500,000 physical qubits to crack a Bitcoin key, while the most advanced public chips only have about a hundred, a difference of thousands of times. So today, no one can steal your coins using quantum computers.

However, there are two unsettling factors on the timeline. First, the migration itself is extremely time-consuming: changing the entire blockchain to a new signature system requires coding, auditing, testing, coordinating a network-wide upgrade, and getting hundreds of millions of users to move their assets, which is generally believed to take five to ten years. Second, the estimated numbers are rapidly declining: a year ago, it required millions of qubits (which can be simply understood as the computational power needed for quantum computers to crack the blockchain), and this year it has dropped to less than 500,000. This is like building a bridge that takes ten years while the flood's arrival is unpredictable; the reasonable approach is to start now rather than wait for the water to rise.

4. Why Are Some Coins More Dangerous?

Whether the coins in an address are at risk depends on whether the public key has already been disclosed. You can think of it as a sealed envelope: many addresses store not the public key itself but the hash fingerprint of the public key, which is like sealing the public key in an envelope that only gets opened when you spend the money. As long as the envelope remains sealed, quantum computers have no way to attack.

The problem is that some addresses have already opened their envelopes. Certain early Bitcoin addresses (including those from the Satoshi era) directly write the public key on the chain without an envelope; many users reuse the same address, and when they spend money for the first time, the envelope is opened, leaving the remaining coins in the same address with the public key still exposed. These are the "exposed" assets repeatedly mentioned in the report, accounting for about one-third of the total Bitcoin supply. Additionally, even for sealed envelopes, during the brief window when you initiate a transfer and the transaction has not yet been confirmed, the public key will also be broadcasted, creating a fleeting but not impossible opportunity for attack.

5. What Does "Post-Quantum" Really Solve?

The solution is not complicated: replace it with a lock that quantum computers cannot open. Several candidate solutions have been proposed in academia, such as hash-based signatures and lattice-based signatures, and standardization is expected to be completed by the U.S. NIST in 2024. The real difficulties lie in the next three issues: the new locks are larger and heavier, with signature sizes being 10 to 40 times that of the current ones, directly slowing down transaction speeds and increasing costs; changing locks requires consensus across the entire network, which is precisely the hardest part for decentralized networks; and for coins whose owners have already gone missing and will never come back to change locks, whether to freeze, destroy, or leave them as they are, no solution can satisfy everyone.

Common Misunderstandings

One misunderstanding is that "once quantum computers appear, all cryptocurrencies will become worthless." In fact, the threat is to the signature process, and the network can respond by upgrading the signature scheme; the progress varies across different chains, and the risks are not equal.

Another misunderstanding is that "quantum computers will make mining meaningless." Mining relies on hash calculations, and quantum algorithms only provide limited acceleration, which will not overturn proof of work.

A third misunderstanding is that "this is science fiction and has nothing to do with me." Currently, quantum computers cannot crack Bitcoin, but regulatory bodies, custodians, and ETF issuers have already included it in their official risk lists, and the migration time window has been written into policies in various countries.

Core Findings

The crypto industry is significantly better prepared for quantum attacks than a year ago, but there are still very few post-quantum protections that can be practically used on the mainnet, and overall, it is not ready.

The blockchain relies on private key signatures to prove asset ownership, and the security of the signatures is based on the mathematical problem of the elliptic curve discrete logarithm. Classical computers cannot solve this problem in a feasible time, while a sufficiently large quantum computer with error correction capabilities, using Shor's algorithm, could theoretically derive the private key from the public key and then transfer someone else's assets. Post-quantum cryptography refers to signature and encryption schemes that are considered secure even in the face of quantum computers.

"Elliptic curve discrete logarithm" sounds abstract, but it can be understood with a more relatable analogy. Imagine there is a public starting point on a uniquely shaped grid, and you jump a certain number of times according to fixed rules from the starting point, landing at a certain position. Your private key is the number of jumps, an extremely large random number; your public key is the final landing position, which will be made public. Knowing the number of jumps makes it easy to calculate the landing point; a few hundred calculations can complete it; conversely, just seeing the landing point and trying to figure out how many jumps were made requires testing all possible jump counts one by one, and there is currently no better method. The curves used by Bitcoin and Ethereum have possible jump counts of about 2 to the power of 256, which is an astronomical number; even using all the computers in the world, it would not be possible to try them all within the lifespan of humanity or even the universe. This is why the private key cannot be derived from the public key by others.

The threat posed by quantum computers is that they do not need to try each possibility one by one. Shor's algorithm takes advantage of the properties of quantum superposition to examine a large number of possible counts simultaneously and extract the underlying patterns from the jump process, compressing what would normally require astronomical steps into a manageable amount of computation. In other words, classical computers are like trying to fish a needle out of the ocean drop by drop, while quantum computers find the patterns where the needle is located.

Specifically, in a real attack, the process roughly consists of three steps: first, the attacker reads the public key of a certain address from the blockchain; second, they use a sufficiently large quantum computer to calculate the corresponding private key; third, they use this private key to forge a legitimate signature, transferring the coins from that address to their own. The network cannot distinguish whether this signature is genuine or not because it is mathematically identical to the one signed by the owner. This is why the report repeatedly emphasizes "whether the public key has been disclosed": if the public key is not public, the first step of the attack cannot begin.

When Will the Threat Arrive?

In the past year, estimates of the quantum resources needed to break cryptocurrencies have significantly decreased. A white paper released by Google Quantum AI in March 2026 (co-authored by Dan Boneh from Stanford University and Justin Drake from the Ethereum Foundation) provided two sets of attack circuits targeting the secp256k1 curve, requiring no more than 1,200 and 1,450 logical qubits, respectively. Logical qubits refer to qubits that have undergone error correction and can compute reliably. In terms of actual hardware, with an error rate of about one in a thousand on superconducting circuits, the required physical qubits are less than 500,000, and a complete run takes about 18 to 23 minutes. Since about half of the calculations can be completed in advance, once a public key is disclosed during transaction broadcasting, the attacker only needs about 9 minutes to derive the private key. CoinDesk reported that this means the attacker has about a 41% chance of redirecting funds before the original transaction is confirmed. Forbes believes this result has reduced the previous estimates of millions of physical qubits by about 20 times.

Qubits can be simply understood as the computational power needed by quantum computers to crack the blockchain, and correspondingly, Q-day refers to the day when a sufficiently powerful quantum computer appears.

Craig Gidney pointed out in a preprint in May 2025 that the number of noisy qubits required to crack RSA-2048 has dropped to less than 1 million, while his estimate with Ekerå in 2019 was 20 million. Another preprint submitted by Caltech, Oratomic, and UC Berkeley on the same day as the white paper claimed that 10,000 to 26,000 qubits might be sufficient using neutral atom routes, but this conclusion is based on simulations and has not been validated by hardware. Additionally, Google has not disclosed the attack circuits themselves, only using zero-knowledge proofs to demonstrate the validity of the circuits, which is the first instance of "responsible disclosure" in this field.

Screenshot from Google’s paper, source: arxiv

However, the reason not to panic is that there is still a significant gap between the current hardware situation and the above estimates. Google's Willow chip has only 105 qubits, and in public demonstrations, the largest elliptic curve key successfully cracked was only 15 bits, while Bitcoin uses a 256-bit key. The Q-Day award issued by Project Eleven is also controversial, as Bitcoin developers believe that this output is not significantly different from random guessing.

Regarding when machines with actual cracking capabilities will emerge, experts generally estimate it will be in the early to mid-2030s, with risks also present before 2030. The Coinbase Advisory Council stated that there is no certainty that such machines will not appear by the 2035 migration deadline set by NIST. Charles Hoskinson believes there is more than a 50% chance that commercial-grade quantum computers will appear before 2033, while Nic Carter estimates that Bitcoin will be vulnerable to attacks by 2035 with a probability of 70% to 80%. Google has set its post-quantum migration timeline for 2029.

Nature of Risks and Scale of Exposure

For public ledgers, the main risk is signature forgery, meaning that an attacker could derive a private key and steal assets under the premise that the public key has already been exposed, rather than the industry’s common narrative of "collecting first, decrypting later." Assets associated with public keys that have appeared on-chain are in a state of "static exposure" from the day large quantum computers emerge; assets that are only represented by hash values and have never been spent are exposed only during the brief window when transactions are broadcast until they are confirmed. The threat of "collecting first, decrypting later" primarily falls on privacy coins, as transactions recorded today may be retroactively de-anonymized in the future. The hash functions themselves are not the weak link: SHA-256 and Keccak only lose square-root-level security strength in the face of quantum algorithms, and proof-of-work mining and hash-based commitments remain generally secure, which is why most post-quantum solutions tend to be hash-based.

The scale of exposed assets is quite considerable. The Coinbase Advisory Council estimates that approximately 6.9 million BTC (about 32% of the total supply) have public keys exposed on-chain, with about 1.7 million located in around 20,000 early P2PK addresses and about 5 million originating from address reuse, including some cold wallets of major exchanges. The ratio provided by the author of BIP-361 is slightly higher, claiming that over 34% will be exposed by March 1, 2026. In contrast, Ripple claims that only 0.03% of XRP is stored in dormant accounts with exposed public keys. The differences in figures among various parties primarily stem from different statistical criteria regarding P2PK, address reuse, and Taproot outputs.

Progress and Differentiation Among Chains

In terms of actual progress, various chains have clearly differentiated. QRL has been running with native post-quantum signatures since 2018, Algorand will launch native Falcon accounts in August 2026, NEAR will launch ML-DSA accounts in July 2026, Starknet's Falcon accounts are already running on the mainnet but have not yet been audited, and Tezos's related code has entered the mainnet with upgrades but is turned off by default. Ethereum (around 2029), XRPL (2028), Sui (first quarter of 2027), Stellar and Hedera (around 2027) have established timelines, while Solana has chosen Falcon but has not set a timetable, and Cosmos SDK has released support but requires activation by each chain. Bitcoin's two related proposals are still in draft form and lack activation pathways; Cardano is still in the research phase; Monero, Avalanche, and BNB Chain have no formal plans.

Account abstraction is the most significant structural difference. Accounts can change signature schemes independently without requiring a network-wide fork (Starknet, Algorand, NEAR, Sui, Aptos, and Ethereum after the implementation of EIP-8141), allowing users to migrate individually; Bitcoin's account model does not possess this flexibility, migration can only rely on new address types and years of voluntary transfers.

The Challenge of Governance: How to Ensure Everyone Acts in Unison?

The cryptographic schemes themselves have standards to follow; the real unresolved issues are governance and engineering problems.

First is how to coordinate soft forks or hard forks to synchronize upgrades across the entire network. Secondly, how to handle assets that have not migrated, including about 1.7 million BTC from the Satoshi era, whether to freeze, revoke, or maintain the status quo, with only a few chains having made clear statements on this. Thirdly, new signatures will be 10 to 40 times larger than the existing 64-byte signatures, which will directly burden transaction throughput and increase costs. Ripple points out that Dilithium signatures are about 40 times larger than existing signatures; the Coinbase Advisory Council warns that post-switch block sizes could swell by up to 38 times; Hoskinson cautions that an early switch for Cardano could reduce network speed by about 10 times.

Standards and Regulation

Traditional finance and government departments have already provided clear migration timelines, and various chains in the crypto industry are being pushed to act in this context. The most critical is the post-quantum standard from the U.S. NIST, which defines the signature schemes that can be selected for blockchain and sets the deadline for phasing out old algorithms.

The Industry's Gold Standard: NIST Standards

NIST is the National Institute of Standards and Technology in the United States, under the Department of Commerce, responsible for setting technical standards. Its standards in the field of cryptography (such as AES, SHA hashes) are widely adopted globally. In August 2024, it will release the first batch of post-quantum cryptography standards, so most blockchain post-quantum solutions will be based on it.

NIST officially released three post-quantum standards on August 13, 2024, with a fourth still in development. FIPS 203 (ML-KEM) is a key encapsulation mechanism for encrypted communication, not a signature scheme. FIPS 204 (ML-DSA, formerly Dilithium) is a lattice-based signature, with signature sizes ranging from approximately 2.4 to 4.6 KB, currently the most common default choice. FIPS 205 (SLH-DSA, formerly SPHINCS+) is a hash-based signature, with the most conservative security assumptions, but signature sizes reach approximately 7.8 to 50 KB. The draft FIPS 206 (FN-DSA, formerly Falcon) is also lattice-based, with Falcon-512 signatures being only about 0.7 KB, the most compact of the three, and Hedera expects it to be completed around early 2027 based on an analysis from April 2026. For reference, Bitcoin's Schnorr signatures and Solana's Ed25519 signatures are only 64 bytes.

NIST's published standards, source: NIST official website

NIST's transition guidelines state that public key algorithms vulnerable to quantum attacks will be deprecated by 2030 and banned by 2035. The commonly referred "2035 deadline" in the industry originates from this.

Institutional Disclosures

At the institutional level, organizations have begun to incorporate quantum risks into formal documents. BlackRock expanded the quantum risk factors in the prospectus of its iShares Bitcoin Trust (IBIT) on May 9, 2025, with similar wording in its Ethereum products, warning that quantum computing could render Bitcoin's cryptography ineffective. VanEck similarly issued warnings regarding BNB Smart Chain in the prospectus of its BNB ETF in 2026. Such disclosures are standard risk warnings and not predictions for the future, but they indicate that quantum preparedness has become part of the due diligence for custodians and ETF issuers.

Preparations by Various Entities

Coinbase: Setting the Tone for the Industry with an Independent Advisory Council

Coinbase is one of the most important institutions pushing the quantum topic into mainstream discussion in 2026. Its approach is to invite external experts to form an independent council, publicly release analyses, and require various chains to express their positions early.

The Coinbase Independent Quantum Computing and Blockchain Advisory Council was established in January 2026, with its first paper published on April 21, 2026, spanning about 50 pages. Members include Scott Aaronson, Dan Boneh, Justin Drake, Sreeram Kannan, Yehuda Lindell, and Dahlia Malkhi. Among them, Boneh and Drake are also co-authors of the aforementioned Google white paper, thus the judgments of the two documents echo each other.

The basic judgment of the paper is that fault-tolerant quantum computers will eventually be built, and the council expresses high confidence in this, but emphasizes that such machines do not currently exist. As for whether they will emerge before 2035, the council believes it cannot guarantee that they will not, thus advocating for preparations to begin now rather than waiting for urgent signals to appear. In terms of exposure scale, the paper estimates that approximately 6.9 million BTC public keys have already been exposed; a follow-up report released in June broke this number down, indicating that about 1.7 million are located in around 20,000 old P2PK addresses, and about 5 million originate from address reuse, primarily belonging to active users, including cold wallets of major exchanges. The paper also warns that switching to post-quantum signatures could cause block sizes to swell by up to 38 times. Unlike the Google white paper, the council is relatively less concerned about pre-confirmation front-running attacks, while the 9-minute attack window provided by Google makes this type of attack a real concern.

The core recommendation for various chains is to make decisions early and announce them publicly: for assets that have not migrated to post-quantum signatures, whether to freeze, revoke, or maintain the status quo. The council itself does not take sides for networks like Bitcoin, but believes that failing to express a position itself poses a risk.

The significance of this document lies in that Coinbase, as a publicly traded company and one of the largest custodians, fulfills its product responsibility while providing the industry with a third-party analysis that can be cited, making quantum preparedness a question that exchanges, custodians, and ETF issuers must address. It should be noted that the council was funded by Coinbase, and its opinions carry significant weight, but readers should not view it as a completely neutral arbiter.

Project Eleven: The Leader in Industry Quantum Security

Project Eleven is currently the most active security firm in this field, conducting research and prototyping while also playing a role in bringing the topic to public attention. Its revenue and influence largely depend on the judgment that quantum threats will become a reality.

In January 2026, the company completed a $20 million Series A funding round. It established a Q-Day prize of 1 BTC, awarded to the first person to crack an elliptic curve key using a quantum computer. On April 24, 2026, the prize was awarded to Giancarlo Lelli, who cracked a 15-bit elliptic curve key on IBM's cloud quantum hardware. There are two key points to note about this result: first, the actual Bitcoin key is 256 bits long, and the 15-bit demonstration is still far from posing a real threat; second, Bitcoin developers believe that this output is not significantly different from random guessing, and the relevant announcement has been annotated by the community.

Risky BTC estimates from Project Eleven, source: Project Eleven

Project Eleven has also collaborated with Ripple and Solana on threat assessments and prototype development, for instance, Ripple's Denis Angell worked with them to complete the ML-DSA prototype on the XRPL AlphaNet testnet. Meanwhile, the company has provided an estimate of approximately 7.1 million exposed BTC public keys.

Overall, Project Eleven offers publicly discussable milestones and prototype code for various foundations to test; at the same time, in terms of commercial interests, the company tends to emphasize urgency.

Preparation and Core Teams of Various Public Chains

The level of preparation varies greatly among different chains. Ethereum has the most organized projects, Bitcoin has the most debates and the least implementation, while Solana has selected an algorithm but lacks a timeline. The following will first look at the three chains with the largest market capitalization, and then discuss other networks with relevant quantum preparations.

Bitcoin: Proposals Exist, but No Activation Path

Bitcoin does not have a foundation, and any changes need to go through developer proposals (BIPs) and gain consensus from miners and the node community. Currently, there are two main proposals related to quantum, along with an emergency plan.

BIP-360 (Pay-to-Merkle-Root, abbreviated as P2MR) was written by Hunter Beast (MARA), Ethan Heilman, and Isabel Foxen Duke, and was merged into the official proposal repository as a draft on February 11, 2026. It introduces a new output type similar to Taproot but removes the path for directly spending with keys, so coins will not expose public keys while idle, with addresses starting with bc1z. This proposal intentionally does not introduce any post-quantum signature schemes, leaving that for future soft fork handling; Heilman has initiated discussions on algorithm agility on the mailing list. BIP-360 also cannot defend against front-running attacks before transaction confirmation.

BIP-361 (Post-Quantum Migration and Sunset of Old Signatures) was written by Jameson Lopp and five others and was released on April 14, 2026, advocating for a phased elimination of old signatures. About three years after activation, sending new funds to vulnerable address types will be prohibited; about five years later, old ECDSA and Schnorr spends will become invalid, resulting in the freezing of corresponding assets; a recovery path based on zero-knowledge proofs may be provided afterward. Critics claim that this plan is authoritarian, and Lopp himself has stated that he does not actually wish to implement it, noting that it is not currently in a position to be adopted.

In simple terms, BIP-360 only adds a new address type that hides public keys; it cannot protect old addresses that have already exposed public keys: those coins still rely on the original ECDSA/Schnorr signatures, which can still be forged after the advent of quantum computers. The only thing that can be done is for holders to transfer coins into new P2MR addresses before Q-Day, after which public keys will no longer be exposed. Coins that are already lost and cannot be transferred (such as P2PK from the Satoshi era) cannot be helped by BIP-360, which is also the reason for BIP-361's proposal to freeze.

Additionally, StarkWare's Avihu Levy designed Quantum-Safe Bitcoin (QSB), with the first transaction being recorded on August 26, 2026, via MARA Slipstream. It adds hash-based locks to transactions through signature grinding, requiring no soft fork, but each transaction costs hundreds of dollars and must be submitted directly to miners, and it is powerless against already exposed keys, serving only as an emergency solution.

Even if BIP-360 were activated tomorrow, each holder would still need to transfer their assets to new addresses, which would occupy years of block space and would have no effect on assets from the Satoshi era. In other words, if Bitcoin does not have a consensus major plan within the next five years, there will be a risk of all addresses from the Satoshi era being attacked. At that time, a hard fork-level consensus split may be needed to resolve it.

Ethereum: The Most Organized Among Large Chains, Targeting Around 2029

The Ethereum Foundation has prioritized post-quantum security, establishing a dedicated team, a dedicated website, and weekly interoperability tests. In January 2026, the foundation formed a post-quantum team led by Thomas Coratger and established two cryptographic prizes of $1 million each; pq.ethereum.org went live on March 25, 2026; and more than a dozen client teams run weekly post-quantum interoperability development testnets.

According to the organization on ethereum.org, four parts need to be upgraded: BLS consensus signatures, KZG data availability commitments, ECDSA account signatures, and the zero-knowledge proof system relied upon by layer two networks. At the consensus layer, the Lean Ethereum proposal replaces BLS with a hash-based leanXMSS signature and aggregates a large number of signatures into a small proof through a minimal zkVM called leanVM to alleviate the issue of overly large signatures. At the account layer, EIP-8141 (Frame Transactions), drafted by Vitalik Buterin and others on January 29, 2026, grants accounts native account abstraction capabilities, allowing each account to decide how to verify signatures, including switching to post-quantum schemes; this proposal has entered the scheduled status for the Hegotá upgrade. Circle's Mira Belenkiy also proposed a post-quantum path for ecrecover, where frame transactions carry post-quantum signatures for contracts to read.

EIP-8141, source: Ethereum official website

In terms of timeline, the core post-quantum infrastructure is targeted for around 2029, with some reports suggesting December 2029. Sources vary on the timing of the Hegotá upgrade itself: early materials indicated the second half of 2026, while ethereum.org updated its statement in July 2026 to 2027.

Overall, this is the most advanced project among large networks. However, before EIP-8141 goes live and wallets support post-quantum signers, ETH holders will not have a protocol-native post-quantum option; old accounts with exposed public keys face the same dilemma as Bitcoin, but overall, if there is no black swan-style quantum attack risk, the upgraded Ethereum network should not be affected by quantum attacks.

Solana: Algorithm Selected, No Timeline

Solana's protection currently mainly resides at the application layer. Blueshift's Winternitz Vault is a hash-based one-time signature vault that has been voluntarily available to users since around January 2025; it is an application rather than a protocol upgrade.

At the protocol layer, the Solana Foundation released a preparation plan on April 27, 2026, disclosing that the Anza and Firedancer client teams independently chose Falcon, reasoning that Falcon-512 has the smallest signature among NIST schemes, and both teams have early implementations. The plan is divided into three phases: continue research; if the threat becomes credible, first provide post-quantum signatures for new wallets; then migrate existing wallets. On October 8, 2026, Technical Vice President Jacob Creech further stated that the so-called bunker mode would not be enabled, nor would there be large-scale migrations.

The risk of this stance is that Solana's addresses are inherently raw Ed25519 public keys, and every account with funds is exposed while idle. The approach of acting only when the threat is credible effectively bets on having enough warning time.

At the same time, Solana announced a partnership with Project Eleven in December 2025, where Project Eleven conducted a complete quantum threat assessment for Solana, covering core infrastructure, user wallets, validator security, and long-term cryptographic assumptions, and outlined mitigation paths and migration options. In addition to the assessment report, Project Eleven also deployed a runnable post-quantum signature system on Solana's testnet to demonstrate that end-to-end quantum-resistant transactions are technically feasible. Solana Foundation's Technical Vice President Matt Sorg stated that the goal is to keep the network secure for decades to come.

Algorand: Although the Chain is Cool, It is the Most Mature in Post-Quantum Deployment Among Major Public Chains

Algorand has been using Falcon signatures to protect its State Proofs (used for cross-chain verification) since 2022. The first Falcon-1024 transaction appeared on the mainnet on November 3, 2025; by August 2026, with the v5.0.0 upgrade, native Falcon-1024 accounts went live on the mainnet, with support from Pera Wallet, SDK, and AlgoKit. By June 2026, the network had processed over 140,000 post-quantum transactions.

According to the roadmap published in June 2026, Algorand plans to achieve Falcon-512, post-quantum multi-signatures, and staking by the end of 2026, and to achieve widespread quantum resilience by the end of 2027. The main gap currently lies in the VRF (Verifiable Random Function) in the consensus core, which remains a classical algorithm; Algorand itself also states that replacing it is the most challenging step. Its cryptographic team includes Chris Peikert and Zhenfei Zhang, who participated in the design of Falcon.

XRP Ledger (Ripple): Four-Phase Roadmap with a Deadline of 2028

Ayo Akinyele from RippleX released a four-phase roadmap on April 20, 2026. The first phase is an emergency recovery plan for Q-Day; the second phase (first half of 2026) involves testing ML-DSA, with Denis Angell having completed a prototype with Project Eleven on AlphaNet; the third phase (second half of 2026) will test on the development network, including hybrid signatures; the fourth phase aims to launch the native amendment before 2028. XLS-295 (ML-DSA-44) remains a draft, with no changes to the mainnet.

The structural advantage of XRPL lies in its native key rotation, allowing active users to change keys without changing addresses, with dormant XRP that have exposed public keys only accounting for 0.03%.

Cardano: Still in the Research Phase

Founder Hoskinson proposed a three-step plan in February 2026: first, complete the research agenda (2025 to 2026); then establish an independent post-quantum proof chain, using Mithril certificates and post-quantum signatures to checkpoint historical states; the integration into the main chain will occur once hardware acceleration matures. He also warned that premature migration could reduce network speed by about ten times. In May 2026, he stated that lattice-based solutions and FIPS 203 to 206 have been included in the roadmap, a governance vote on the quantum plan is underway, and he mentioned the Nightstream project in collaboration with researchers from Google, Microsoft Research, and Linux. Currently, there is no publicly confirmed testnet signature work.

Sui and Aptos: Voluntary Post-Quantum Account Mechanism

Sui announced in August 2026 that everyday accounts will adopt ML-DSA-65, while high-value vaults will use SLH-DSA-SHA2-128s in Move contracts. Both are voluntarily enabled by users and can be derived from existing mnemonic phrases, with the mainnet certification target set for the first quarter of 2027.

Sui's approach is "two locks, two risks." These two schemes come from different mathematical families: ML-DSA-65 belongs to the lattice-based FIPS 204 standard, with a security level of NIST Level 3, used for everyday accounts; SLH-DSA-SHA2-128s belongs to the hash-based FIPS 205 standard, with a security level of Level 1, used for high-value vaults. Placing the latter in Move contracts rather than the protocol core allows Sui to keep pace with the industry's ultimately adopted standards without upgrading the core protocol, while also ensuring that if lattice cryptography is compromised, the hash-based path remains unaffected.

Aptos's AIP-137 was released by cryptography lead Alin Tomescu on December 18, 2025, adding SLH-DSA-SHA2-128s as an optional account type, focusing on its conservative security assumption that relies solely on hashes. This proposal requires governance approval to activate, and does not mandate user migration.

NEAR: Post-Quantum Accounts Now Live on Mainnet

NEAR officially integrated ML-DSA signatures into the mainnet in Protocol 2.13 released on July 20, 2026, with the specific level reported by the media as ML-DSA-65. This makes NEAR the third public chain, after QRL and Algorand, to allow ordinary users to hold post-quantum accounts on the mainnet, and one of the few large networks discussed in this report that has already handed post-quantum capabilities to users.

Mechanically, users only need to send an on-chain transaction to switch their account's key to a post-quantum key, without needing to create a new account or move assets to a new address. Accounts can also hold multiple signature schemes simultaneously, meaning new and old keys coexist. For ordinary users, this design's benefit is low migration costs: there is no need for the entire network to fork simultaneously, nor do they have to wait for new address types and years of asset transfers like Bitcoin; each user can switch at their own pace. This is a concrete manifestation of the structural advantages brought by "account abstraction" on NEAR.

In terms of advancement, Near One collaborates with Ledger, meaning post-quantum keys are expected to be secured by hardware devices; Meteor Wallet has already provided support.

This solution still has some limitations. First, it is voluntary: accounts that have not switched still use the original Ed25519 signatures, with their public keys already exposed on-chain, remaining vulnerable when large quantum computers emerge. Secondly, there is a size cost: ML-DSA signatures are approximately 2.4 to 4.6 KB, while Ed25519 is only 64 bytes, significantly increasing transaction size; this study did not find publicly available data from NEAR on the specific impact on network throughput and fees. Lastly, and most critically, the signatures used for consensus among validators are still classical algorithms, with the goal of post-quantum consensus set for the second half of 2027 (some sources state by December 31, 2027 at the latest), meaning that network-level protection is not complete before then.

Overall, in terms of user-level usability, NEAR is ahead of most large networks; however, overall security ultimately depends on two variables: how many users actually complete the switch and when validator consensus completes the upgrade.

Hedera: Official Roadmap, No Post-Quantum Signatures Yet

Hedera's hash (SHA-384) and encryption (AES-256) already meet post-quantum requirements, but signatures are still lacking. Leemon Baird, Rohit Sinha, and Ed Marquez proposed in an official blog in April 2026: adopt FN-DSA (Falcon) after FIPS 206 is finalized; first implement post-quantum TLS between nodes, then extend to clients; consensus events will use a hybrid signature of Ed25519 plus Falcon; and launch post-quantum user key types around 2027. Currently, no corresponding HIP number has been released.

The roadmap is divided into four steps in order of ease: first, upgrade TLS between nodes to post-quantum or hybrid schemes, then upgrade TLS for client connections, followed by using a hybrid signature of Ed25519 plus FN-DSA for consensus events, and finally launch new user key types. Placing TLS first is because it can mainly be completed by updating software libraries, and Chrome has already enabled hybrid key exchange of X25519 plus ML-KEM-768 by default since April 2024; at the same time, Hedera states that its network security does not rely on TLS, as hashgraph consensus itself provides integrity guarantees independent of the transport layer.

The cost is also size-related. According to third-party interpretations of Hedera's roadmap, FN-DSA signatures are about 1,280 bytes, approximately 20 times that of Ed25519; if ML-DSA-87 is adopted, signatures would be 4,627 bytes, exceeding 70 times. Baird stated in 2022 that Hedera's transactions typically only range from 100 to 200 bytes, and switching to Falcon would result in signatures around 1,300 bytes, which he referred to as a cost that needs to be borne.

Stellar: Phased Plan, Protocol Vote Pending

The Stellar Development Foundation released its quantum readiness plan on June 9, 2026: in 2026, it will first provide ML-DSA-44/65 verification in the form of Soroban host functions, and by the end of 2027, it will launch protocol-level post-quantum signer types. According to media reports, the Protocol 30 (Bell) upgrade includes CAP-87 (ML-DSA in Stellar Core), with validator voting scheduled for November 23, 2026.

Stellar's structural advantage lies in the separation of account identity and signature keys: users can add a post-quantum signer to their account and then remove the old Ed25519 key without needing to transfer balances or update all related systems. However, every Stellar address (including dormant accounts that have never signed) has already exposed its public key, making dormant accounts the most challenging part, and the foundation will open community discussions on this.

The phased content is as follows: the first phase (2026) is to add native host functions to Soroban, supporting verification of ML-DSA-44 and ML-DSA-65, allowing contract accounts to achieve post-quantum authentication through Soroban's account abstraction, with classic accounts not requiring protocol layer changes; enterprise wallets can migrate in 2026, and FN-DSA and HSM support will be added later according to standard finalization.

The second phase (2027) is protocol layer solidification and voluntary migration, allowing ordinary accounts to add post-quantum signers through existing set_options operations, requiring updates for wallets, SDKs, and anchor service providers, with the goal of enabling this capability for every account by the end of 2027. The plan is divided into three phases, and I did not find verifiable details for the third phase. Additionally, there are gaps in zero-knowledge applications relying on pairing and other technologies, and the foundation plans to convene teams working on zero-knowledge applications on Stellar to address this together. The foundation also stated that the SHA-256 hash used by Stellar has been considered post-quantum secure, and XLM holders currently do not need to take any action, citing the U.S. CNSA 2.0 and the EU DORA as regulatory backgrounds in the plan.

Starknet: Focus on Post-Quantum, Some Already Delivered

Starknet's architecture brings inherent advantages: STARK proofs rely on hash functions, and each account is a smart contract that can switch signature schemes independently. Post-quantum accounts based on Falcon have already gone live on the mainnet (implemented by S2morrow using Cairo's Falcon-512), but this implementation has not yet been audited.

The roadmap announced in June 2026 is divided into three phases. The first phase replaces state commitments, address derivation, and configurations that still rely on elliptic curve hashes, which has been partially delivered; the second phase extends this protection to existing contracts; the third phase will follow Ethereum, as bridges and data availability still inherit Ethereum L1's elliptic curve cryptography.

Meanwhile, the Starknet community conducted a non-binding Snapshot vote from October 15 to 22, 2026, with a support rate of 93.52% for the proposal to migrate to an independent post-quantum L1, with approximately 3,236 votes representing about 489 million STRK. CEO Eli Ben-Sasson aims for full quantum resistance by 2027, with a white paper expected to be released in November. Critics argue that detaching from Ethereum means abandoning Ethereum's economic security and relying on Starknet's still immature self-staking mechanism, which is currently in the second phase of four, with validators yet to start producing blocks.

Zcash: Ensure "Recoverability" Before Upgrading

The main risk for Zcash is not theft, but the potential retroactive destruction of privacy: future quantum computers may be able to re-associate today's anonymous transactions on the chain.

ZIP 2005 changed the structure of the notes, allowing for the possibility of freezing the Orchard fund pool, with funds later recoverable into the post-quantum protocol using post-quantum STARK. In the NU7 vote, the proposal received 90.5% support from ZCAP and 94.6% from coin holders (February 2026), with the candidate version launched on the testnet on May 22, 2026. The next steps involve introducing ML-KEM key exchange with Tachyon, followed by building a fully post-quantum fund pool, with ZODL's CEO setting a target of 12 to 18 months starting from May 2026.