Original | Odaily Planet Daily (@OdailyChina)

Author | jk

Things to Know Before Reading: Clarify Five Points First

This report does not assume that readers understand knowledge of cryptography or quantum physics; if you only care about the conclusion, you can jump directly to "Key Findings"; before entering the main text, we will first clarify five key concepts using everyday analogies.

1. What is the “key” in cryptocurrency?

Your Bitcoin or Ether does not exist in a file somewhere but is registered under an address on the blockchain. To spend this money, you must present a "digital signature" to prove to the entire network that you are the owner of this address. Generating a signature requires a private key, which only you know; verifying the signature uses a public key, which is public, and anyone can use it to verify.

You can think of it like a signature sample kept by the bank: the bank has your signature sample (public key), when someone comes to withdraw money, the bank checks their handwriting against the sample (verifying the signature), but anyone looking at the sample cannot perfectly mimic the original signature (deriving the private key). This mechanism is reliable today because deriving the private key from the public key is mathematically considered nearly impossible. The threat of quantum computers lies in their potential to make this "impossible task" feasible.

2. What has quantum computing changed?

Ordinary computers crack passwords like a person trying each key from a large bunch one by one; even if they try quickly, they would need astronomical amounts of time. Quantum computers do not try faster; they change the problem-solving approach: for a specific class of mathematical problems, the Shor algorithm proposed in 1994 can reduce the time taken from "the age of the universe" to "a few minutes to a few hours."

It is essential to emphasize that quantum computers are not all-powerful. For most everyday computing tasks, they do not have an advantage. Unfortunately, the problems they excel at are precisely the basis of public key cryptography relied upon by today’s internet and blockchain (including RSA and elliptic curves). In contrast, hash functions (which can be understood as a one-way meat grinder that turns any input into a fixed-length fingerprint) are only slightly accelerated by quantum algorithms, so security mechanisms based on hashes remain relatively robust. This explains why most post-quantum schemes are gravitating towards "hash-based" approaches.

3. Why say “no need to panic, but cannot ignore”?

Current quantum computers are still far from threatening Bitcoin. Cracking one Bitcoin key requires about 500,000 physical quantum bits, whereas the most advanced public chips currently have only about a hundred, a gap of thousands of times. So today, no one will use quantum computers to steal your coins.

However, there are two concerning factors in the timeline. First, the transition itself is extremely time-consuming: to replace the entire blockchain with a new signature system, it requires coding, auditing, testing, coordinating a network upgrade, and getting hundreds of millions of users to move their assets; the industry generally believes this will take five to ten years. Second, the estimated number is rapidly declining: a year ago, it was millions of quantum bits (which can be simply understood as the computational power required by quantum computers to crack blockchain), but this year it has dropped to fewer than 500,000. It’s like building a bridge that takes ten years while the arrival of floods cannot be predicted; the reasonable action is to start construction now rather than wait for the waters to rise.

4. Why are some coins more dangerous?

Whether the coins in an address are at risk depends on whether the public key has already been exposed. You can think of it like a sealed envelope: many addresses store not the public key itself but a hash fingerprint of the public key, which is equivalent to sealing the public key in an envelope, which only gets opened when you spend the money. As long as the envelope is not opened, quantum computers have nothing to work with.

The problem is that some addresses' envelopes have already been opened. Certain early Bitcoin addresses (including those from the Satoshi Nakamoto era) directly wrote the public key on-chain without an envelope; additionally, many users reuse the same address, causing the envelope to be opened the first time they spend money, and the remaining coins still remain in the same address, continuously exposing the public key. These are the "exposed" assets repeatedly mentioned in the report, accounting for about one-third of the total Bitcoin supply. Furthermore, even for sealed envelopes, during the brief window when you initiate a transfer and the transaction has not yet been confirmed, the public key will also be broadcast, presenting fleeting yet possible attack opportunities.

5. What does “post-quantum” actually address?

The solution is not complex: change to a lock that cannot be opened by quantum computers. The academic community has proposed several candidates, such as hash-based signatures and lattice-based signatures, and these will be standardized by the U.S. NIST in 2024. The real challenges lie in the next three issues: new locks are larger and heavier, signature sizes are 10 to 40 times bigger than current ones, which directly slows down transaction speed and increases costs; changing locks requires consensus across the entire network, and decentralized networks tend to struggle to unify opinions; and for those coins whose owners have already disappeared and will never change locks, it raises the question of freezing, destroying, or keeping them as is; no solution can satisfy everyone.

Common misunderstandings

One misunderstanding is that "once quantum computers appear, all cryptocurrencies will drop to zero." In fact, what is threatened is the signature process; networks can respond by upgrading signature schemes, with different progress across various chains and unequal risks.

Another misunderstanding is that "quantum computers will render mining meaningless." Mining relies on hash calculations, and quantum algorithms only provide limited acceleration and will not overturn proof of work.

A third misunderstanding is "this is science fiction, and it has nothing to do with me." Currently, quantum computers cannot crack Bitcoin, but regulatory agencies, custody providers, and ETF issuers have already included it in formal risk lists, and the migration time window has been incorporated into various countries' policies.

Key Findings

The crypto industry’s preparedness for quantum attacks has significantly improved compared to a year ago, but the actual post-quantum protections available on main networks are still very few, and overall, it is not well-prepared.

The blockchain relies on private key signatures to prove asset ownership, and the security of these signatures is built on the mathematical problem of elliptic curve discrete logarithm. Classical computers cannot solve this problem within a feasible time, but a sufficiently large quantum computer with error correction capability can theoretically derive the private key from the public key using Shor’s algorithm, potentially enabling the transfer of someone else’s assets. Post-quantum cryptography refers to signature and encryption schemes that are still considered secure even when facing quantum computers.

“Elliptic curve discrete logarithm” may sound abstract, but it can be understood using a relatable analogy. Imagine there is a public starting point on a specially shaped grid; according to fixed rules, you start from that point and “jump” multiple times until you land at a certain position. Your private key is the number of jumps, an extremely large random number; your public key is the landing position, which will be made public. Knowing the number of jumps makes it easy to calculate the landing point; it's only a few hundred steps of computation. Conversely, if one only sees the landing point and wants to know how many jumps were made, the only method is to try all possible numbers one by one; no better method exists currently. The curve used by Bitcoin and Ethereum may have as many as about 2 to the 256th power possible jumps, an astronomical number. Even harnessing all computers in the world cannot complete this process within the lifespan of humanity or even the universe. This is the reason why the private key cannot be derived by others from the public key.

The threat posed by quantum computers arises because they do not have to try each possibility one by one. Shor’s algorithm takes advantage of quantum superposition, examining many possible numbers simultaneously and extracting the underlying patterns from the jumping process, reducing what would require a colossal number of steps to a manageable computation. In other words, classical computers are like trying to scoop a needle out of the sea drop by drop, while quantum computers are finding the patterns where the needle is located.

Specifically, during an actual attack, the process can be divided into three steps: first, the attacker retrieves a public key that has been exposed from the blockchain; second, using a sufficiently large quantum computer, calculates the corresponding private key; third, using this private key to forge a legitimate signature that transfers the coins from that address to their own. The network cannot distinguish whether this signature is genuine or not because it is mathematically identical to what the owner signed. This is also why it is repeatedly emphasized later whether the public key has been exposed: if the public key is not exposed, the attack cannot even begin.

When will the threat arise?

Over the past year, the academic community has significantly reduced the estimates of quantum resources required to break cryptocurrencies. The white paper released by Google Quantum AI in March 2026 (co-authored by Stanford's Dan Boneh and Ethereum Foundation’s Justin Drake) provided two sets of attack circuits targeting the secp256k1 curve, requiring no more than 1,200 and 1,450 logical quantum bits, respectively. Logical quantum bits refer to error-corrected quantum bits that can be reliably computed, translating to physical quantum bits required in actual hardware of fewer than 500,000 on superconducting routes with an error rate of about 0.1%; completion of the entire run would take approximately 18 to 23 minutes. Because about half of the computation can be completed in advance, if a public key is exposed when the transaction is broadcast, an attacker would only need approximately 9 minutes to derive the private key. CoinDesk reported that this means the attacker has about a 41% chance of redirecting the funds before the original transaction is confirmed. Forbes believes this result reduces prior estimates of millions of physical quantum bits by about 20 times.

Quantum bits can be simply understood as the computational power a quantum computer needs to break blockchain, and accordingly, Q-day refers to the day a sufficiently powerful quantum computer appears.

Craig Gidney pointed out in a May 2025 preprint that the noise-affected quantum bits required to break RSA-2048 have dropped to under 1 million, whereas his previous estimate with Ekerå in 2019 was 20 million. A separate preprint submitted on the day of the white paper release by Caltech, Oratomic, and UC Berkeley claimed that using neutral atoms could make 10,000 to 26,000 quantum bits sufficient, but this conclusion was derived from simulations and has not been hardware-verified. Furthermore, Google has not publicly disclosed the attack circuits themselves, only using zero-knowledge proofs to demonstrate their validity, representing the first instance of “responsible disclosure” in this field.

However, there’s no need to panic because there remains a significant gap between the current hardware and these estimates. Google's Willow chip only has 105 quantum bits, and in public demonstrations, the largest elliptic curve key broken was only 15 bits long, whereas Bitcoin uses a 256-bit key. The Q-Day prize issued by Project Eleven also exists in controversy, as Bitcoin developers believe this output does not differ significantly from random guessing.

Experts' judgments about when machines with practical cracking capability will appear broadly center around the early to mid-2030s, and there may be risks before 2030. The Coinbase advisory committee has stated that there is no certainty that such machines will not emerge by the 2035 migration deadline set by NIST. Charles Hoskinson believes the probability of seeing commercial-grade quantum computers before 2033 is over half, while Nic Carter estimates the probability of Bitcoin being vulnerable by 2035 to be between 70% and 80%. Google has set its own post-quantum migration timeline to 2029.

The Nature of Risk and Scale of Exposure

For public ledgers, the main risk is signature forgery, meaning that an attacker can derive the private key and steal assets given that the public key has been exposed, rather than the “collect first, decrypt later” strategy often discussed in the industry. Public keys already present on-chain put asset risk into a "static exposure" state on the day a powerful quantum computer appears; assets that are simply hashed as an address and have never been spent are exposed only in the brief window between the transaction broadcast and confirmation. The threat of “collect first, decrypt later” mainly lies with privacy coins, as transactions recorded today could potentially be retroactively de-anonymized in the future. The hash function itself is not a weak link: SHA-256 and Keccak only lose square-root level security strength in the face of quantum algorithms; proof-of-work mining and hash-based commitments remain generally secure, which is also why most post-quantum schemes tend towards hash-based proposals.

The scale of exposed assets is quite substantial. The Coinbase advisory committee estimates that about 6.9 million BTC (about 32% of the total supply) have had their public keys exposed on-chain, including about 1.7 million located in about 20,000 early P2PK addresses and around 5 million from address reuse, including some large exchanges' cold wallets. The proportion cited by BIP-361's authors is slightly higher, claiming that as of March 1, 2026, it has exceeded 34%. In contrast, Ripple states that only 0.03% of XRP is held in dormant accounts where the public key has been exposed. The differences in numbers arise mainly from varying statistical methods regarding P2PK, address reuse, and Taproot outputs.

Progress and Differentiation Among Various Chains

In terms of actual progress, various chains have clearly differentiated. QRL has been running with native post-quantum signatures since 2018, Algorand plans to launch native Falcon accounts in August 2026, NEAR has scheduled its ML-DSA accounts to go live in July 2026, Starknet’s Falcon accounts are operational on the mainnet but have not been audited, and Tezos has included related code in the mainnet with the upgrade but is off by default. Ethereum (around 2029), XRPL (2028), Sui (Q1 2027), Stellar and Hedera (around 2027) already have timelines, while Solana has selected Falcon but lacks a timetable, and Cosmos SDK has released support but requires individual chains to enable it. Bitcoin's two related proposals remain in draft stage and lack activation paths; Cardano is still in the research phase; Monero, Avalanche, and BNB Chain have no formal plans.

Account abstraction is the most significant structural differentiation. Accounts can independently switch signature schemes without requiring the entire chain to undergo a synced fork (Starknet, Algorand, NEAR, Sui, Aptos, and Ethereum after the implementation of EIP-8141), allowing users to migrate one by one. Bitcoin's account model lacks this flexibility, and migration can only rely on new address types and voluntary transfers over years.

The Difficulty Lies in Governance: How to Ensure Everyone Acts in Unison?

Cryptographic schemes already have standards to follow; the real undecided issues are governance and engineering problems.

First, how to coordinate soft or hard forks to ensure the entire network upgrades uniformly. Second, how to handle assets that have not yet migrated, including about 1.7 million BTC from the Satoshi Nakamoto era—whether to freeze, revoke, or maintain their current state; currently, only a few chains have made clear statements. Third, new signatures are 10 to 40 times larger than the current 64-byte signatures, which will directly slow down transaction throughput and increase costs. Ripple noted that Dilithium signatures are about 40 times larger than existing signatures; the Coinbase advisory committee warned that the block size could expand up to 38 times after switching; Hoskinson reminded that an early switch could potentially slow down network speed by about 10 times.

Standards and Regulation

Traditional finance and government sectors have already laid down clear migration timelines, and the various chains in the crypto industry are being driven to act within this context. The most critical is the post-quantum standards from the U.S. NIST, which specify the signature schemes blockchain can choose and define the deadline for phasing out old algorithms.

The Industry Gold Standard: NIST Standards

NIST, the National Institute of Standards and Technology, is part of the U.S. Department of Commerce, responsible for developing technical standards. Its cryptographic standards (such as AES, SHA hashes) are widely adopted globally. In August 2024, it released the first batch of post-quantum cryptography standards, so most blockchain post-quantum schemes are based on this.

NIST officially released three post-quantum standards on August 13, 2024, with a fourth still in development. FIPS 203 (ML-KEM) is a key encapsulation mechanism for encrypting communication and not a signature scheme. FIPS 204 (ML-DSA, formerly Dilithium) is a lattice-based signature, with signature sizes of about 2.4 to 4.6 KB, the most common default choice. FIPS 205 (SLH-DSA, formerly SPHINCS+) is based on hash signatures, with security assumptions being the most conservative, but signature sizes reach about 7.8 to 50 KB. The not-yet-finalized FIPS 206 (FN-DSA, formerly Falcon) is also lattice-based, with Falcon-512 signatures being only about 0.7 KB, the most compact of the three, and Hedera estimated in April 2026 that it would be completed around early 2027. As a reference, Bitcoin's Schnorr signatures and Solana's Ed25519 signatures are only 64 bytes.

NIST's transition guidelines stipulate that public key algorithms vulnerable to quantum attacks will be phased out by 2030 and banned by 2035. The commonly referred “2035 deadline” originates from this.

Institutional Disclosures

On the institutional level, quantum risk has begun to be written into formal documents. BlackRock expanded quantum risk factors in the prospectus for its iShares Bitcoin Trust (IBIT) on May 9, 2025, and similar wording appears in its Ethereum products, warning that quantum computing may render Bitcoin’s cryptography ineffective. VanEck also issued similar warnings for BNB Smart Chain in its BNB ETF prospectus in 2026. These disclosures are standard risk warnings and not predictions for the future, but they indicate that quantum preparedness has become part of the due diligence for custodians and ETF issuers.

Preparations by Various Institutions

Coinbase: “Defining” the Industry with an Independent Advisory Board

Coinbase is one of the most critical institutions pushing quantum topics into mainstream discussion in 2026. Its approach involves inviting external experts to form an independent committee that publicly releases analyses and calls for various chains to make their positions known as soon as possible.

The Coinbase Independent Quantum Computing and Blockchain Advisory Committee was established in January 2026, with its first paper published on April 21, 2026, spanning about 50 pages. Members include Scott Aaronson, Dan Boneh, Justin Drake, Sreeram Kannan, Yehuda Lindell, and Dahlia Malkhi, with Boneh and Drake also being co-authors of the aforementioned Google white paper, thus providing mutual corroboration of both documents' judgments.

The basic assessment of the paper is that fault-tolerant quantum computers will eventually be developed, with the committee highly confident of this; however, they simultaneously emphasize that such machines currently do not exist. Regarding whether such a machine will emerge before 2035, the committee believes that it cannot be guaranteed that it won’t, thus advocating for preparations to begin now rather than waiting for urgent signals to arrive. In terms of the scale of exposure, the paper estimates that about 6.9 million BTC's public keys have already been exposed; the subsequent report released in June further broke this number down, with about 1.7 million located in around 20,000 old P2PK addresses and about 5 million coming from address reuse, mainly belonging to active users, including large exchanges' cold wallets. The paper also warned that switching to post-quantum signatures could cause the block size to increase by up to 38 times. Unlike the Google white paper, the committee is relatively less worried about pre-confirmation front-running attacks, while the 9-minute attack window provided by Google makes this type of attack a real concern.

The core recommendation for various chains is to make a decision and announce it as soon as possible: for assets that have never migrated to post-quantum signatures, whether to freeze them, revoke them, or maintain their current situation. The committee itself does not take sides when it comes to networks like Bitcoin but believes that the failure to declare a position poses a risk.

The significance of this document lies in that Coinbase, as a publicly listed company and one of the largest custodians, fulfills both its product responsibilities and provides the industry with a referenceable third-party analysis, making quantum preparedness a necessary question for exchanges, custodians, and ETF issuers. It is worth noting that this committee was funded by Coinbase; its opinions carry considerable weight, but readers should not consider it completely neutral.

Project Eleven: The Leader in Quantum Security

Project Eleven is the most active security vendor in this field, conducting both research and prototyping and playing a role in bringing the topic to the public's attention. Its revenue and influence largely rely on the judgment that the quantum threat will become a reality.

In January 2026, the company completed a $20 million Series A funding round. It established a Q-Day prize with a reward of 1 BTC, awarded to the first person to crack an elliptic curve key using a quantum computer. On April 24, 2026, the prize was awarded to Giancarlo Lelli, who cracked a 15-bit elliptic curve key using IBM's cloud quantum hardware. There are two key points to see here: first, the actual Bitcoin key is 256 bits long, and the 15-bit demonstration is far from posing a real threat; second, Bitcoin developers believe that this output does not differ significantly from random guessing, and the relevant announcement was annotated by the community.

Project Eleven also collaborates with Ripple and Solana to conduct threat assessments and prototype developments; for example, Ripple's Denis Angell has worked with them to complete a prototype of ML-DSA on XRPL's AlphaNet. Meanwhile, the company has provided an estimate of about 7.1 million BTC public keys being exposed.

In summary, Project Eleven provides discussion milestones that can be publicly debated and prototype codes for various foundations to test; at the same time, in terms of commercial interests, the company tends to emphasize urgency.

Preparing and Core Teams of Various Public Chains

The preparedness of various chains varies greatly. Ethereum’s project is the most organized among large chains, while Bitcoin has the most debate and the least implementation, and Solana has selected its algorithm but has no timetable. The following examines the three chains with the largest market capitalization and then discusses other networks with relevant quantum preparation.

Bitcoin: Has Proposals, but No Activation Path

Bitcoin does not have a foundation; any modifications require developer proposals (BIPs) and consensus among miners and node communities. Currently, the main proposals related to quantum are two, plus one emergency plan.

BIP-360 (Pay-to-Merkle-Root, abbreviated P2MR) was written by Hunter Beast (MARA), Ethan Heilman, and Isabel Foxen Duke and merged into the official proposal library as a draft on February 11, 2026. It adds a new output type similar to Taproot but removes the path for directly spending with keys, so that coins will not expose public keys during their idle period; addresses will begin with bc1z. This proposal intends not to introduce any post-quantum signature scheme, leaving this part for subsequent soft forks, and Heilman has initiated discussions about algorithm agility on the mailing list. BIP-360 also does not defend against pre-confirmation front-running attacks.

BIP-361 (Post-Quantum Migration and Sunset of Old Signatures) was written by Jameson Lopp and five others and was published on April 14, 2026. It advocates for phasing out old signatures in stages; about three years after activation, it would prohibit sending new funds to vulnerable address types; around five years later, the old ECDSA and Schnorr spends would become invalid, freezing the corresponding assets; thereafter, a recovery path based on zero-knowledge proofs may be provided. Critics say the proposal is authoritarian, and Lopp himself indicates that he does not genuinely wish to see it implemented and states that it is not currently in a position to be adopted.

In simple terms, BIP-360 merely adds a type of address that hides the public key; it cannot protect old addresses where the public key has already been exposed: those coins still rely on the original ECDSA/Schnorr signatures, which can still be forged once quantum computers appear. The only action is for holders to move coins into new P2MR addresses before Q-Day to stop exposing their public keys. For coins whose owners have lost contact and cannot be transferred (such as P2PK from the Satoshi era), BIP-360 cannot assist, which is also why BIP-361 proposes freezing them.

Additionally, StarkWare’s Avihu Levy designed Quantum-Safe Bitcoin (QSB), whose first transaction was recorded on-chain through MARA Slipstream on August 26, 2026. It uses signature grinding to add a hash-based lock to transactions requiring no soft fork, but each transaction costs hundreds of dollars to submit directly to miners, and it does not address already exposed keys. Therefore, it can only be viewed as an emergency solution.

Even if BIP-360 is activated tomorrow, every holder will still need to manually move their assets to the new address, occupying block space for years with no effect on assets from the Satoshi era. This means that if Bitcoin does not reach a consensus on a major plan within the next five years, there will be a risk of all prior Satoshi era addresses being attacked. At that time, a consensus split at the level of a hard fork may be required to resolve it.

Ethereum: The Most Complete Organization Among Large Chains, Targeting 2029

The Ethereum Foundation has listed post-quantum security as a top priority, with a dedicated team, dedicated website, and weekly interoperability testing. In January 2026, the foundation established a post-quantum team led by Thomas Coratger and set up two $1 million cryptography prizes; pq.ethereum.org went live on March 25, 2026; over a dozen client teams run post-quantum interoperability development test nets weekly.

According to a summary from ethereum.org, four parts that need upgrading are: BLS consensus signatures, KZG data availability commitments, ECDSA account signatures, and the zero-knowledge proof system relied upon by layer-two networks. In the consensus layer, the Lean Ethereum plan replaces the BLS signatures with a hash-based leanXMSS signature, aggregating numerous signatures into a very small proof through an extremely simplified zkVM called leanVM, which alleviates the issue of oversized signatures. In the account layer, EIP-8141 (Frame Transactions), drafted by Vitalik Buterin and others starting January 29, 2026, grants accounts the native ability to abstract accounts, allowing each account to determine how to verify signatures, including switching to post-quantum schemes. This proposal is now scheduled for the Hegotá upgrade. Circle's Mira Belenkiy also proposed a post-quantum path for ecrecover, where frame transactions carry post-quantum signatures for contracts to read.

In terms of timeline, the target for core post-quantum infrastructure is around 2029, with some reports indicating December 2029. Various sources have differing statements on the Hegotá upgrade itself: early materials stated it would occur in the second half of 2026, while statements on ethereum.org in July 2026 have changed to 2027.

Overall, this is the most advanced project among large networks. However, until EIP-8141 goes live and wallets supporting post-quantum signers are available, ETH holders currently lack a natively supported post-quantum option; old accounts with exposed public keys face the same dilemma as Bitcoin. However, overall, if there is no black swan-like quantum attack risk, the upgraded Ethereum network is unlikely to be affected by quantum attacks.

Solana: Algorithm Chosen, No Timetable

Solana’s protections currently remain primarily at the application layer. Blueshift's Winternitz Vault serves as a hash-based one-time signature vault, available for voluntary use by users since around January 2025; it falls under application rather than protocol upgrades.

At the protocol level, the Solana Foundation released a preparation plan on April 27, 2026, disclosing that the Anza and Firedancer client teams each independently chose Falcon, reasoning that Falcon-512 is the smallest signature among NIST schemes, and both teams have early implementations. The plan is divided into three phases: continue research; if the threat becomes credible, provide post-quantum signatures first for new wallets; and then migrate existing wallets. On October 8, 2026, Technical VP Jacob Creech further stated that the so-called bunker mode would not be activated currently, nor would large-scale migration occur.

The risk of this stance is that Solana's addresses themselves are original Ed25519 public keys; every account with funds is exposed when idle. Waiting for credible threats to act essentially bets that enough warning time will be obtained.

At the same time, Solana announced a collaboration with Project Eleven in December 2025, where Project Eleven conducted a complete quantum threat assessment for Solana, covering core infrastructure, user wallets, validator security, and long-term cryptographic assumptions, and outlined mitigation paths and migration options. In addition to the assessment report, Project Eleven also deployed a functioning post-quantum signature system on Solana's test net to demonstrate the technical feasibility of end-to-end quantum-resistant transactions. Solana Foundation's Technical VP Matt Sorg stated the goal is to keep the network secure for the next few decades.

Algorand: While it may be cool, it leads in post-quantum deployment among major public chains

Algorand has been using Falcon signatures to protect its State Proofs (used for cross-chain verification) since 2022. On November 3, 2025, the first Falcon-1024 transaction appeared on the mainnet; in August 2026, the native Falcon-1024 accounts went live on the mainnet through the v5.0.0 upgrade; Pera Wallet, SDK, and AlgoKit all support it. By June 2026, the network had processed over 140,000 post-quantum transactions.

According to a roadmap published in June 2026, Algorand plans to achieve Falcon-512, post-quantum multi-signatures, and staking by the end of 2026 and widespread quantum resilience by the end of 2027. The primary gap currently exists in the consensus core's VRF (verifiable random function), which remains a classical algorithm; Algorand itself deems replacing it as the most challenging step. Its cryptography team includes Chris Peikert and Zhenfei Zhang, who participated in the design of Falcon.

XRP Ledger (Ripple): Four-Phase Roadmap with Dates, Targeting 2028

RippleX's Ayo Akinyele released a four-phase roadmap on April 20, 2026. The first phase is an emergency recovery plan for Q-Day; the second phase (first half of 2026) tests ML-DSA, with Denis Angell having completed a prototype on AlphaNet with Project Eleven; the third phase (second half of 2026) involves testing mixed signatures on the development network; the fourth phase aims to launch a native amendment before 2028. XLS-295 (ML-DSA-44) remains in draft form, with no changes on the mainnet.

The structural advantage of XRPL lies in native key rotation, allowing active users to change keys without needing to change addresses; dormant XRP with exposed public keys account for only 0.03%.

Cardano: Still in Research Phase

Founder Hoskinson proposed a plan in February 2026 divided into three steps: first complete the research agenda (2025 to 2026); then establish a separate post-quantum proof chain to check historical states using Mithril certificates and post-quantum signatures; and finally merge with the main chain once hardware acceleration matures. He cautioned that migrating too early could slow the network by about 10 times. By May 2026, he stated that lattice-based schemes and FIPS 203 to 206 have entered the roadmap, and a governance vote on the quantum plan is underway, mentioning collaborations with Google, Microsoft Research, and researchers related to Linux in the Nightstream project. Currently, there are no publicly confirmed testnet signature work.

Sui and Aptos: Voluntary Post-Quantum Account Mechanisms

Sui announced in August 2026 that daily accounts would adopt ML-DSA-65, while high-value vaults would use SLH-DSA-SHA2-128s in Move contracts. Both can be voluntarily enabled by users and can be derived from existing mnemonic phrases, with the mainnet certification target being Q1 2027.

Sui’s thinking is "two locks, two risks." These two schemes come from different mathematical families: ML-DSA-65 belongs to the lattice-based FIPS 204 standard, with NIST Level 3, used for everyday accounts; SLH-DSA-SHA2-128s belongs to the hash-based FIPS 205 standard, with Level 1 security, used for high-value vaults. Placing the latter in Move contracts rather than within the protocol core allows Sui to keep pace with the standards ultimately adopted by the industry without upgrading the core protocol, while also meaning that if lattice cryptography were compromised, the hash-based path remains unaffected.

Aptos’s AIP-137 was published by cryptography lead Alin Tomescu on December 18, 2025, adding SLH-DSA-SHA2-128s as an optional account type, valued for its conservative security assumptions relying solely on hashes. This proposal requires governance approval to activate and does not mandate user migration.

NEAR: Post-Quantum Accounts have Launched on the Mainnet

NEAR officially included ML-DSA signatures in the mainnet with Protocol 2.13 released on July 20, 2026, with media reports indicating specific levels as ML-DSA-65. This makes NEAR the third public chain, following QRL and Algorand, to allow ordinary users to hold post-quantum accounts on the mainnet, and it is also one of the few large networks addressed in this report that has delivered post-quantum capabilities to users.

Mechanically, users only need to send an on-chain transaction to switch their account's key to a post-quantum key without needing to create new accounts or move assets to new addresses. Accounts can also hold multiple signature schemes simultaneously, allowing for the coexistence of new and old keys. This design benefits ordinary users as the migration cost is low: it does not require the entire network to fork simultaneously, nor does it make users wait years for new address types and asset transfers as in Bitcoin; each user can switch at their own pace. This concretely illustrates the structural advantage brought by "account abstraction" on NEAR.

In terms of advancement methodology, Near One collaborates with Ledger, suggesting that post-quantum keys may be securely stored by hardware devices; Meteor Wallet has already provided support.

This solution still has several limitations. First, it is voluntary: accounts that have not switched still use the original Ed25519 signatures, which have already been publicly exposed on-chain and will still be vulnerable when large quantum computers emerge. Second is the size cost: ML-DSA signatures range from about 2.4 to 4.6 KB, while Ed25519 signatures are only 64 bytes, making transactions notably larger; this research found no publicly available NEAR data on the specific impacts on network throughput and transaction fees. Lastly, and most critically, the signatures used for consensus among validators still rely on classical algorithms; the goal for post-quantum consensus is set for the second half of 2027 (with some sources stating the latest deadline is December 31, 2027), meaning that protective measures at the network level are incomplete before this.

In summary, in terms of usability at the user level, NEAR is ahead of most large networks; however, overall security ultimately depends on two variables: how many users truly complete the switch and when validators achieve consensus upgrades.

Hedera: Official Roadmap, No Post-Quantum Signatures Yet

The SHA-384 hash and AES-256 encryption in Hedera already meet post-quantum requirements, but what is lacking is signatures. Leemon Baird, Rohit Sinha, and Ed Marquez proposed in an official blog in April 2026: to adopt FN-DSA (Falcon) after FIPS 206 is finalized; first implement post-quantum TLS between nodes, then extend it to clients; use hybrid signatures of Ed25519 plus Falcon for consensus events; and launch post-quantum user key types around 2027. Currently, there is no corresponding HIP number released.

The roadmap is divided into four steps in order of ease: first, upgrade TLS between nodes to post-quantum or hybrid solutions; then upgrade TLS for client connections; third, use hybrid signatures of Ed25519 plus FN-DSA for consensus events; and finally, release new user key types. TLS is placed first because it can mainly be completed by updating software libraries, and Chrome has already enabled hybrid key exchange of X25519 plus ML-KEM-768 by default since April 2024; meanwhile, Hedera states that its network security does not rely on TLS as the hashgraph consensus itself provides integrity assurance independent of the transport layer.

The costs are similarly related to size. According to third-party interpretations of Hedera's roadmap, FN-DSA signatures are about 1,280 bytes, roughly 20 times larger than Ed25519; if using ML-DSA-87, signatures are 4,627 bytes, exceeding 70 times. Baird previously noted in 2022 that Hedera's transactions usually only take 100 to 200 bytes, but switching to Falcon would lead to signatures reaching around 1,300 bytes, which he termed a cost to be borne.

Stellar: Phased Plan, Protocol Vote Pending

The Stellar Development Foundation released its quantum readiness plan on June 9, 2026: first providing ML-DSA-44/65 validation in the form of native host functions for Soroban in 2026, and by the end of 2027 launching a protocol-level post-quantum signature type. Reports indicate that Protocol 30 (Bell) upgrade includes CAP-87 (ML-DSA in Stellar Core), with validator voting scheduled for November 23, 2026.

Stellar's structural advantage is that identity and signing keys are separated: users can add a post-quantum signer to their accounts then remove the old Ed25519 key without needing to transfer balances or update all related systems. However, every Stellar address (including dormant accounts that have never signed) has already exposed public keys, making dormant accounts the hardest to handle; the foundation plans to open community discussions about it.

The phased content involves: the first phase (2026) is to add native host functions for Soroban supporting the validation of ML-DSA-44 and ML-DSA-65, allowing contract accounts to realize post-quantum authentication through Soroban's account abstraction; classic accounts do not require protocol layer changes, allowing enterprise wallets to migrate in 2026, and then join FN-DSA and HSM support based on the finalization of standards. The second phase (2027) is for protocol layer solidification and voluntary migration, allowing ordinary accounts to add post-quantum signers through existing set_options operations, requiring updates for wallets, SDKs, and anchor service providers, with a target for every account to have this capability by the end of 2027. The plan is divided into three phases; I did not find verifiable details on the third phase. Furthermore, the zero-knowledge applications relying on pairing technologies also have gaps, and the foundation plans to convene teams working on zero-knowledge applications in Stellar to collectively address these challenges. The foundation also stated that SHA-256 used by Stellar is viewed as post-quantum secure, and XLM holders currently need not take any action; the plan also cited the U.S. CNSA 2.0 and the EU DORA as the regulatory backdrop.

Starknet: Focused on Post-Quantum, Some Deliverables Already

Starknet's architecture brings an inherent advantage: STARK proofs rely on hash functions, and each account is a smart contract, allowing for independent switching of signature schemes. Post-quantum accounts based on Falcon have launched on the mainnet (implemented by S2morrow using Cairo with Falcon-512); however, this implementation has not yet been audited.

The roadmap published in June 2026 is divided into three phases. The first phase replaces state commitments, address derivations, and configurations still relying on elliptic curve hashes, which have partially been delivered; the second phase extends this protection to existing contracts; the third phase will follow Ethereum due to bridges and data availability still inheriting Ethereum L1's elliptic curve cryptography.

Meanwhile, the Starknet community conducted a non-binding Snapshot vote from October 15 to 22, 2026, with a 93.52% approval rate for the proposal to study a migration to an independent post-quantum L1, with approximately 3,236 participants representing about 489 million STRK. CEO Eli Ben-Sasson aims for complete quantum resistance by 2027, with a white paper expected to be released in November. Critics argue that breaking away from Ethereum means sacrificing Ethereum’s economic security, relying instead on Starknet's currently immature self-staking mechanisms, which are still in the second phase among four phases, with validators yet to begin block production.

Zcash: Ensure "Recoverable" First, Then Upgrade

The main risk for Zcash is not theft, but the retrospective destruction of privacy: future quantum computers may re-associate anonymous transactions currently on the chain.

ZIP 2005 changed the construction of tickets so that if it is necessary to freeze the Orchard funds pool, funds can later be recovered into the post-quantum protocol using post-quantum STARK. In the NU7 vote, this proposal received 90.5% support from ZCAP and 94.6% from coin holders (February 2026), and the candidate version went live on the test net on May 22, 2026. The subsequent steps involve first introducing ML-KEM key exchange with Tachyon, and then building a fully post-quantum fund pool, with the CEO of ZODL setting a target of 12 to 18 months from May 2026.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。