Post-Quantum Blockchains
A blockchain becomes quantum-resistant by swapping the vulnerable primitive that authorizes spending. Every mainstream chain authorizes transactions with an elliptic-curve signature, and Shor’s algorithm recovers the private key from an exposed public key, so the migration target is the signature scheme, while the SHA-256 hashing that secures proof-of-work faces only Grover’s algorithm and carries forward with a wider margin.
Two paths exist. A chain can be built quantum-resistant from day one, which is what the Quantum Resistant Ledger did with XMSS, or an existing chain can retrofit through a soft fork or programmable wallets, which is what the current Bitcoin and Ethereum proposals aim at. The post-quantum signature standards those retrofits will draw on are already final, so none of this work needs a quantum computer to arrive before it can start.
Sources: Divesh Aggarwal, Gavin K. Brennen, Troy Lee, Miklos Santha, Marco Tomamichel, “Quantum attacks on Bitcoin, and how to protect against them,” arXiv:1710.10377, for the elliptic-curve exposure and the proof-of-work margin: “the proof-of-work used by Bitcoin is relatively resistant to substantial speedup by quantum computers in the next 10 years, mainly because specialized ASIC miners are extremely fast compared to the estimated clock speed of near-term quantum computers. On the other hand, the elliptic curve signature scheme used by Bitcoin is much more at risk.” The QRL, theqrl.org, for the XMSS-from-launch design; Hunter Beast et al., “BIP-360,” github.com/bitcoin/bips, and Ethereum, “Post-quantum cryptography,” ethereum.org, for the two retrofit tracks; NIST, “Post-Quantum Cryptography FIPS Approved,” August 13, 2024, csrc.nist.gov, for FIPS 203, 204 and 205 being final.
The short version:
- The quantum exposure in a blockchain sits in the signature scheme that authorizes spends, because Shor’s algorithm breaks the elliptic-curve math behind ECDSA and Ed25519, and the fix is a post-quantum signature.
- The Quantum Resistant Ledger is the purpose-built case: it authorizes every transaction with XMSS, a hash-based signature whose security rests only on a hash function, so it was quantum-resistant from launch.
- Bitcoin’s leading retrofit is BIP-360, Pay-to-Merkle-Root, a soft-fork proposal for an output type that keeps the spending public key hidden until the moment it is spent. It closes the long-exposure risk on its own and leaves post-quantum signatures to a later, separate proposal.
- BIP-361 is the companion draft for the coins that never move: once a post-quantum output type exists, it stops sends to quantum-vulnerable addresses about 3 years after it activates and, 2 years after that, lets legacy coins move only through a quantum-safe rescue protocol. For old pay-to-public-key coins, where no rescue protocol is known, its authors back a separate proposal called Hourglass that limits those spends to one per block.
- Ethereum’s approach routes through account abstraction, letting wallets swap their signature algorithm to a post-quantum one without a protocol-level hard fork.
- State proofs are a related technique: a chain periodically commits its ledger state with a post-quantum signature, so the compressed proof of history stays verifiable even against a quantum adversary.
- The hashing that secures mining survives, so a quantum-resistant blockchain is a signature-migration and coordination project rather than a rebuild from scratch.
What actually needs to change to make a blockchain quantum-resistant?
The signature scheme, and almost nothing else in the cryptographic core. A blockchain does two cryptographic jobs that matter for the quantum question, and quantum computers treat them very differently. Transaction authorization proves you are allowed to move coins, and it is done with a public-key signature: ECDSA over secp256k1 on Bitcoin, ECDSA and increasingly other curves on Ethereum, Ed25519 on several newer chains. All of those rest on the elliptic-curve discrete logarithm problem, which Shor’s algorithm solves efficiently, so a cryptographically relevant quantum computer can recover a private key from an exposed public key and forge a spend.
The other job is ordering and securing the ledger, which on proof-of-work chains is a SHA-256 search. The only quantum attack on a hash function is Grover’s algorithm, which gives a square-root speedup rather than the exponential collapse Shor’s brings to signatures, and purpose-built ASIC miners outrun a near-term quantum machine. So the scope of a quantum-resistant blockchain is a signature migration: replace the elliptic-curve signature that authorizes spending with a post-quantum signature that has no known efficient quantum attack. The full treatment of why signatures fall and mining holds lives in Bitcoin and Blockchain Quantum Risk.
Source: Divesh Aggarwal, Gavin K. Brennen, Troy Lee, Miklos Santha, Marco Tomamichel, “Quantum attacks on Bitcoin, and how to protect against them,” 2018, arXiv:1710.10377.
How does the Quantum Resistant Ledger build quantum resistance in?
The Quantum Resistant Ledger (QRL) took the from-scratch path: it authorizes every transaction with XMSS, the eXtended Merkle Signature Scheme, so its spend authorization never touched vulnerable elliptic-curve math in the first place. QRL describes itself as the first industrial blockchain to use the IETF-specified XMSS, a hash-based, forward-secure signature scheme. The design choice is the whole point: XMSS derives its security only from the strength of an underlying hash function, which is the property that carries through the quantum transition, so QRL inherits the same durability that keeps SHA-256 standing.
XMSS is built from two pieces. The bottom layer is a set of Winternitz one-time signatures (WOTS+), each of which can safely sign a single message, and the top layer is a Merkle tree that binds many of those one-time keys under a single public root, so one address can sign many messages. The trade-off is that XMSS is stateful: each one-time key must be used exactly once, and the signer has to track which leaves are spent, because reusing a one-time key is where hash-based signatures leak. QRL manages that state at the wallet and protocol level, which is exactly the engineering cost of choosing the most conservative post-quantum signature family. The mechanics of stateful hash-based signing, and why the state requirement is the price of the strongest security assumption, are covered in Stateful Hash-Based Signatures (XMSS - LMS).
Sources: The QRL, “The Quantum Resistant Ledger,” theqrl.org. A. Huelsing, D. Butin, S. Gazdag, J. Rijneveld, A. Mohaisen, “XMSS: eXtended Merkle Signature Scheme,” RFC 8391, May 2018, datatracker.ietf.org/doc/html/rfc8391.
How would Bitcoin retrofit a quantum-safe signature?
Through a soft-fork that adds a new output type which keeps the public key hidden until the coins are spent. The leading concrete proposal is BIP-360, Pay-to-Merkle-Root (P2MR), authored by Hunter Beast, Ethan Heilman, and Isabel Foxen Duke, which defines an output that works nearly like Pay-to-Taproot with the quantum-vulnerable key-path spend removed. A P2MR output commits to the Merkle root of a script tree and omits the internal key entirely, so spending goes through the script path.
It is proposed as a consensus soft-fork on SegWit version 2 (mainnet addresses starting bc1z), which means older nodes keep working while upgraded nodes enforce the new rules. ⚠️ The proposal does not itself introduce a post-quantum signature scheme. Its authors name ML-DSA and SLH-DSA as candidates they are researching for a possible separate proposal, and write that quantum-resistant signature algorithms “offer different levels of protection and should be scrutinized before use.”
The design targets the long-exposure risk, and the BIP is precise about the boundary. Once the new output type exists, holders can move coins out of exposed pay-to-public-key and reused addresses into outputs whose public key is never revealed until it is spent. The BIP states that P2MR outputs “are only resistant to ‘long exposure attacks’ on elliptic curve cryptography,” and that P2MR “does not, by itself, protect against short exposure quantum attacks,” meaning a public key sitting in the mempool while a transaction waits to confirm. Closing that second gap would require post-quantum signatures the proposal does not introduce.
What happens to the coins that never move is handled elsewhere. BIP-360 puts the burning of vulnerable coins and other responses to a quantum-driven supply shock explicitly out of its own scope, naming Jameson Lopp’s QBIP and the authors’ separate Hourglass proposal as the venues for that argument. QBIP has since been assigned a number, BIP-361, covered in the next section. BIP-360 is a draft under discussion, so it is the direction to track rather than a shipped feature, and its hardest part is coordination across wallets, miners, exchanges, and users.
Source: Hunter Beast, Ethan Heilman, Isabel Foxen Duke, “BIP-360: Pay-to-Merkle-Root (P2MR),” version 0.12.1, Status: Draft, Bitcoin Improvement Proposals, github.com/bitcoin/bips/blob/master/bip-0360.mediawiki. ⚠️ The BIP was renamed twice: from Pay to Quantum Resistant Hash (P2QRH) to P2TSH at v0.10.0 (September 2025), then to P2MR at v0.11.0 (February 2026). Older writing citing “P2QRH” is describing an earlier revision of this same document.
What happens to Bitcoin that never moves to a quantum-safe address?
That question has its own draft proposal, BIP-361, “Post Quantum Migration and Legacy Signature Sunset,” by Jameson Lopp, Christian Papathanasiou, Ian Smith, Joe Ross, Steve Vaile, and Pierre-Luc Dallaire-Demers, assigned its number on 11 February 2026. Proposals like BIP-360, plus the signature proposal still to come, build somewhere safe to move coins to, and BIP-361 sets a deadline for moving them. It names no particular output type: its abstract says it “follows the implementation of any post-quantum (PQ) output type,” and its header lists a dependency on a post-quantum signature BIP that has yet to be written, so it cannot activate on its own.
The design turns migration into what the authors call “a private incentive: fail to upgrade and you will encounter additional friction to access your funds.” It runs in two phases:
| Phase | What changes | When |
|---|---|---|
| A | Sends are permitted only from legacy scripts to post-quantum scripts, so nobody can send funds to a quantum-vulnerable address | 160,000 blocks (about 3 years) after BIP-361 activates |
| B | Nodes tighten verification of ECDSA and Schnorr, encumbering those spends with a quantum-safe rescue protocol | 2 years after Phase A activates |
A rescue protocol is how a legitimate owner still gets out after Phase B. It relies on something the owner knows and a quantum attacker who has only derived the private key does not. The BIP’s worked example is the BIP-32 wallet seed: a wallet that used a hardened derivation step can prove knowledge of the parent key, which a quantum attacker “would be very unlikely to know.” The authors point to research on STARK-based zero-knowledge proofs and on commit/reveal schemes as candidate constructions, and they state plainly that “It remains to be seen how much of the legacy Bitcoin supply can be theoretically covered by such rescue protocols.”
That uncertainty is what the proposal’s confiscation claim hangs on. The BIP says that “If one or more rescue protocols can be designed to cover the majority of the Bitcoin supply, then restricting ECDSA/Schnorr verification will be at most mildly confiscatory.” The claim is conditional, and the condition is unmet as of this writing. Coins whose owners have lost the seed, or that sit in outputs no rescue protocol covers, would stay locked.
The oldest coins are the case the authors concede has no rescue. Pay-to-public-key outputs expose the public key directly, and the BIP states that “it’s not currently believed possible to construct a rescue protocol for P2PK UTXOs, as no knowledge asymmetry is known.” For those coins the authors support Hourglass, a separate draft by Hunter Beast and Michael Casey that restricts spending from P2PK outputs “to one per block,” slowing any flood of quantum-recovered coins onto the market without burning them. BIP-361 is compatible with an Hourglass-style BIP provided that one has activated by the time Phase B does.
The philosophical argument is compressed into one borrowed line. The BIP quotes Satoshi Nakamoto, “Lost coins only make everyone else’s coins worth slightly more. Think of it as a donation to everyone,” and answers it with its own corollary: “Quantum recovered coins only make everyone else’s coins worth less. Think of it as a theft from everyone.” The BIP sorts every response into three types: “Allow anyone to steal vulnerable coins,” “Allow throttled theft of coins,” or “Allow no one to steal vulnerable coins.” Its own Phase B aims at the third. Hourglass is a throttle, the second type, and the authors accept it only for the P2PK coins their rescue approach cannot reach.
⚠️ The proposal changed between revisions, and older coverage quotes the earlier text. The version hosted at qbip.org as of 15 September 2026 describes Phase B as rendering ECDSA and Schnorr spends “invalid, preventing all spending of funds in quantum-vulnerable UTXOs,” with recovery deferred to a later “Phase C.” The version merged into the Bitcoin BIPs repository replaces that with the rescue-protocol encumbrance described above. Writing that says BIP-361 would freeze every legacy coin outright is describing the earlier draft.
Sources: Jameson Lopp, Christian Papathanasiou, Ian Smith, Joe Ross, Steve Vaile, Pierre-Luc Dallaire-Demers, “BIP-361: Post Quantum Migration and Legacy Signature Sunset,” Layer: Consensus (soft fork), Status: Draft, Type: Informational, assigned 2026-02-11, Requires: TBD Post Quantum Signature BIP, github.com/bitcoin/bips/blob/master/bip-0361.mediawiki, for the phases, timing, rescue protocols, the conditional confiscation statement, the P2PK and Hourglass position, and the Satoshi quotation. The earlier revision, “BIP-361 Draft,” qbip.org, accessed 15 September 2026, for the Phase B “invalid” wording and the Phase C placeholder. Hunter Beast and Michael Casey, “Hourglass spending rules,” BIP: TBD, Status: Draft, created 2025-04-29, github.com/cryptoquick/bips, for the one-P2PK-spend-per-block restriction.
How is Ethereum planning to go quantum-resistant?
Ethereum’s plan leans on account abstraction, which lets an account choose its own signature algorithm so a quantum-safe scheme can be adopted without a protocol-level hard fork. In February 2026, Vitalik Buterin published a roadmap identifying four parts of Ethereum’s cryptography that need post-quantum upgrades: consensus-layer signatures, data-availability sampling, externally owned account signatures, and certain zero-knowledge proofs. The account-signature piece is where account abstraction does the heavy lifting, because moving users from bare externally owned accounts to programmable smart-contract wallets means a wallet can swap its verification logic to a post-quantum signature when the standards and tooling are ready.
On the consensus layer, Ethereum Foundation researchers have proposed two complementary tools: leanXMSS, a hash-based signature scheme replacing BLS for validators, and leanVM, a minimal zkVM for SNARK-based signature aggregation, because BLS’s aggregation property “does not have an obvious quantum-safe equivalent”, chosen because a hash-based scheme rests on the same quantum-durable foundation as XMSS and SLH-DSA. The general shape mirrors Bitcoin’s: keep the surviving hash-and-consensus machinery, replace the signature layer, and stage the migration so it does not require an emergency fork. Both timelines and design details are moving, so treat the specifics as a live research program rather than a finished migration.
Source: Ethereum, “Post-quantum cryptography,” ethereum.org/roadmap/future-proofing/quantum-resistance.
What are state proofs, and how do they help?
A state proof is a periodic, compact certificate that attests to a blockchain’s ledger state, signed with a post-quantum signature so the proof of history stays verifiable even against a quantum adversary. Algorand is the deployed worked example: it introduced state proofs in 2022 as a post-quantum compact certificate produced every 256 rounds, signed with FALCON, the NIST signature being standardized as FN-DSA. Because each participating validator signs with a post-quantum key, a verifier can trust that a valid state proof was produced by the real network, which protects the entire signed history of the chain rather than only future transactions.
The technique matters for two reasons. It gives a chain a quantum-durable anchor for its own past, so an attacker with a future quantum computer cannot rewrite what a state proof already committed, and because these proofs are compact and verifiable by outside systems, they let other chains confirm a network’s state with quantum resistance, which is the foundation for quantum-safe cross-chain bridging. State proofs address a different exposure from the spend-authorization signatures above: they harden the record of what already happened rather than the authorization of what happens next.
Source: Algorand, “State Proofs Overview,” Algorand Developer Portal, developer.algorand.org/docs/get-details/stateproofs.
Which post-quantum signatures do quantum-safe blockchains use?
They draw from the finalized NIST signature standards plus the older stateful hash-based schemes, and the choice trades size against conservatism. The candidates a chain actually reaches for:
| Signature scheme | Family | Where it appears | Why chosen |
|---|---|---|---|
| XMSS | Hash-based (stateful) | Quantum Resistant Ledger | Security rests only on a hash function; most conservative assumption |
| SLH-DSA (SPHINCS+) | Hash-based (stateless) | Named in BIP-360 as a research candidate | Hash-only security with no state to manage; large signatures |
| ML-DSA (Dilithium) | Lattice | Named in BIP-360 as a research candidate; Ethereum candidate | General-purpose default; moderate size and speed |
| FN-DSA (FALCON) | Lattice (NTRU) | Algorand state proofs | Compact signatures where transaction size is the binding constraint |
The pattern across all of them is that the security foundation is a problem with no known efficient quantum attack, either a hash function or a lattice problem, which is what makes each one a durable replacement for ECDSA. The practical tension is size. Aggarwal et al. put the criterion plainly: “In the blockchain context the most important parameters of a signature scheme are the signature and public key lengths, as these must be stored in some capacity to fully verify transactions, and the time to verify the signature,” and on that measure “the only reasonable options are hash and lattice based schemes.” That is why a chain that can tolerate managing state may prefer compact hash-based signing, while a chain that wants a stateless drop-in reaches for a lattice signature and accepts the size.
Sources: NIST, “Post-Quantum Cryptography FIPS Approved,” August 13, 2024, csrc.nist.gov, for ML-DSA being the module-lattice scheme and SLH-DSA the stateless hash-based one; Divesh Aggarwal et al., “Quantum attacks on Bitcoin, and how to protect against them,” Table II and the surrounding discussion, arXiv:1710.10377, for the length-and-verification-time criterion that narrows the field to hash-based and lattice schemes. The per-scheme sizes are in NIST FIPS 204 and FIPS 205 themselves.
Common misconceptions
- “A blockchain has to be rebuilt from scratch to go quantum-safe.” Most of the machinery survives. The migration replaces the signature scheme that authorizes spending, and the proof-of-work hashing and ledger structure carry forward, which is why soft-fork retrofits are on the table for Bitcoin and Ethereum.
- “Quantum computers break blockchains by out-mining the network.” Mining rests on SHA-256 and faces only Grover’s quadratic speedup, which ASIC miners outrun. The break is on the ECDSA signatures that authorize spends.
- “The Quantum Resistant Ledger just uses a bigger key.” It uses a different family. QRL authorizes transactions with XMSS, a hash-based signature whose security rests only on a hash function, which is a structurally different foundation from elliptic-curve signing.
- “Nothing can be done until a quantum computer exists.” The finalized NIST signatures already exist, so the proposals for Bitcoin and Ethereum can be built and coordinated now, ahead of the CRQC. The scarce resource is coordination time across the ecosystem, since the cryptography is already standardized.
- “Post-quantum signatures are a free drop-in.” They are larger and often slower than ECDSA, and on a chain that stores and charges for every byte, that size drives decisions about which scheme fits, which is why chains split between compact hash-based and stateless lattice options.
Questions people ask
How does a blockchain become quantum-resistant? By replacing the elliptic-curve signature that authorizes transactions with a post-quantum signature that has no known efficient quantum attack, either by building the chain that way from the start like the Quantum Resistant Ledger or by retrofitting an existing chain through a signature soft-fork. The SHA-256 hashing that secures mining survives, so the work concentrates on the signature layer.
What signature does the Quantum Resistant Ledger use? XMSS, the eXtended Merkle Signature Scheme specified in IETF RFC 8391, a hash-based signature whose security rests only on the strength of a hash function. It is stateful, so each one-time key must be used exactly once, which QRL manages at the wallet and protocol level.
Can Bitcoin be made quantum-safe? Yes, through soft forks, and it takes more than one. The leading proposal, BIP-360, adds an output type that keeps the public key hidden until it is spent, which closes the long-exposure risk; post-quantum signatures such as SLH-DSA or ML-DSA would arrive in a separate proposal its authors are researching. Both are drafts, so the main open work is ecosystem coordination.
What is BIP-361? A draft Bitcoin proposal that sunsets ECDSA and Schnorr signatures after a post-quantum output type exists. Phase A stops sends to quantum-vulnerable addresses 160,000 blocks, about 3 years, after activation, and Phase B, 2 years later, lets legacy coins move only through a quantum-safe rescue protocol. Its authors call the result “at most mildly confiscatory” only if rescue protocols can cover most of the supply.
What is the Hourglass proposal? A separate Bitcoin draft by Hunter Beast and Michael Casey that limits spends from old pay-to-public-key outputs to one per block. It slows the release of coins a quantum computer might recover without burning them, and BIP-361’s authors support it for P2PK coins because no rescue protocol is known for those outputs.
What is Ethereum doing about quantum computing? Ethereum’s plan uses account abstraction so wallets can swap their signature algorithm to a post-quantum scheme without a protocol-level hard fork, alongside a hash-based multi-signature proposal to replace consensus-layer BLS aggregation. The roadmap covers account signatures, consensus signatures, data availability, and some zero-knowledge proofs.
What are blockchain state proofs? A state proof is a periodic compact certificate that attests to the ledger’s state, signed with a post-quantum signature so the proof of history stays verifiable against a quantum adversary. Algorand produces them signed with FALCON, which protects the chain’s entire signed history and enables quantum-safe cross-chain verification.
Which post-quantum signature is best for a blockchain? It depends on the constraint. Chains that can manage signing state may prefer compact hash-based signatures, chains that want a stateless drop-in use a lattice signature like ML-DSA, and chains where transaction size dominates reach for the compact FN-DSA. All rest on problems with no known efficient quantum attack.
Everything here is the map, given freely. When your team needs blockchain or ledger cryptography sorted into what a quantum computer can actually reach and which post-quantum signature fits your constraints, that’s the work I do.
Last verified 2026-07-26 · Updated 2026-09-15 · Maintained by Addie LaMarr, LaMarr Labs.