Post-Quantum Blockchains
A blockchain becomes quantum-resistant by swapping the vulnerable primitive that authorizes spending. Every mainstream chain authorizes transactions with an elliptic-curve signature, and Shor’s algorithm recovers the private key from an exposed public key, so the migration target is the signature scheme, while the SHA-256 hashing that secures proof-of-work faces only Grover’s algorithm and carries forward with a wider margin.
Two paths exist. A chain can be built quantum-resistant from day one, which is what the Quantum Resistant Ledger did with XMSS, or an existing chain can retrofit through a soft fork or programmable wallets, which is what the current Bitcoin and Ethereum proposals aim at. The post-quantum signature standards those retrofits will draw on are already final, so none of this work needs a quantum computer to arrive before it can start.
Sources: Divesh Aggarwal, Gavin K. Brennen, Troy Lee, Miklos Santha, Marco Tomamichel, “Quantum attacks on Bitcoin, and how to protect against them,” arXiv:1710.10377, for the elliptic-curve exposure and the proof-of-work margin: “the proof-of-work used by Bitcoin is relatively resistant to substantial speedup by quantum computers in the next 10 years, mainly because specialized ASIC miners are extremely fast compared to the estimated clock speed of near-term quantum computers. On the other hand, the elliptic curve signature scheme used by Bitcoin is much more at risk.” The QRL, theqrl.org, for the XMSS-from-launch design; Hunter Beast et al., “BIP-360,” github.com/bitcoin/bips, and Ethereum, “Post-quantum cryptography,” ethereum.org, for the two retrofit tracks; NIST, “Post-Quantum Cryptography FIPS Approved,” August 13, 2024, csrc.nist.gov, for FIPS 203, 204 and 205 being final.
The short version:
- The quantum exposure in a blockchain sits in the signature scheme that authorizes spends, because Shor’s algorithm breaks the elliptic-curve math behind ECDSA and Ed25519, and the fix is a post-quantum signature.
- The Quantum Resistant Ledger is the purpose-built case: it authorizes every transaction with XMSS, a hash-based signature whose security rests only on a hash function, so it was quantum-resistant from launch.
- Bitcoin’s leading retrofit is BIP-360, Pay-to-Merkle-Root, a soft-fork proposal for an output type that keeps the spending public key hidden until the moment it is spent. It closes the long-exposure risk on its own and leaves post-quantum signatures to a later, separate proposal.
- Ethereum’s approach routes through account abstraction, letting wallets swap their signature algorithm to a post-quantum one without a protocol-level hard fork.
- State proofs are a related technique: a chain periodically commits its ledger state with a post-quantum signature, so the compressed proof of history stays verifiable even against a quantum adversary.
- The hashing that secures mining survives, so a quantum-resistant blockchain is a signature-migration and coordination project rather than a rebuild from scratch.
What actually needs to change to make a blockchain quantum-resistant?
The signature scheme, and almost nothing else in the cryptographic core. A blockchain does two cryptographic jobs that matter for the quantum question, and quantum computers treat them very differently. Transaction authorization proves you are allowed to move coins, and it is done with a public-key signature: ECDSA over secp256k1 on Bitcoin, ECDSA and increasingly other curves on Ethereum, Ed25519 on several newer chains. All of those rest on the elliptic-curve discrete logarithm problem, which Shor’s algorithm solves efficiently, so a cryptographically relevant quantum computer can recover a private key from an exposed public key and forge a spend.
The other job is ordering and securing the ledger, which on proof-of-work chains is a SHA-256 search. The only quantum attack on a hash function is Grover’s algorithm, which gives a square-root speedup rather than the exponential collapse Shor’s brings to signatures, and purpose-built ASIC miners outrun a near-term quantum machine. So the scope of a quantum-resistant blockchain is a signature migration: replace the elliptic-curve signature that authorizes spending with a post-quantum signature that has no known efficient quantum attack. The full treatment of why signatures fall and mining holds lives in Bitcoin and Blockchain Quantum Risk.
Source: Divesh Aggarwal, Gavin K. Brennen, Troy Lee, Miklos Santha, Marco Tomamichel, “Quantum attacks on Bitcoin, and how to protect against them,” 2018, arXiv:1710.10377.
How does the Quantum Resistant Ledger build quantum resistance in?
The Quantum Resistant Ledger (QRL) took the from-scratch path: it authorizes every transaction with XMSS, the eXtended Merkle Signature Scheme, so its spend authorization never touched vulnerable elliptic-curve math in the first place. QRL describes itself as the first industrial blockchain to use the IETF-specified XMSS, a hash-based, forward-secure signature scheme. The design choice is the whole point: XMSS derives its security only from the strength of an underlying hash function, which is the property that carries through the quantum transition, so QRL inherits the same durability that keeps SHA-256 standing.
XMSS is built from two pieces. The bottom layer is a set of Winternitz one-time signatures (WOTS+), each of which can safely sign a single message, and the top layer is a Merkle tree that binds many of those one-time keys under a single public root, so one address can sign many messages. The trade-off is that XMSS is stateful: each one-time key must be used exactly once, and the signer has to track which leaves are spent, because reusing a one-time key is where hash-based signatures leak. QRL manages that state at the wallet and protocol level, which is exactly the engineering cost of choosing the most conservative post-quantum signature family. The mechanics of stateful hash-based signing, and why the state requirement is the price of the strongest security assumption, are covered in Stateful Hash-Based Signatures (XMSS - LMS).
Sources: The QRL, “The Quantum Resistant Ledger,” theqrl.org. A. Huelsing, D. Butin, S. Gazdag, J. Rijneveld, A. Mohaisen, “XMSS: eXtended Merkle Signature Scheme,” RFC 8391, May 2018, datatracker.ietf.org/doc/html/rfc8391.
How would Bitcoin retrofit a quantum-safe signature?
Through a soft-fork that adds a new output type which keeps the public key hidden until the coins are spent. The leading concrete proposal is BIP-360, Pay-to-Merkle-Root (P2MR), authored by Hunter Beast, Ethan Heilman, and Isabel Foxen Duke, which defines an output that works nearly like Pay-to-Taproot with the quantum-vulnerable key-path spend removed. A P2MR output commits to the Merkle root of a script tree and omits the internal key entirely, so spending goes through the script path.
It is proposed as a consensus soft-fork on SegWit version 2 (mainnet addresses starting bc1z), which means older nodes keep working while upgraded nodes enforce the new rules. ⚠️ The proposal does not itself introduce a post-quantum signature scheme. Its authors name ML-DSA and SLH-DSA as candidates they are researching for a possible separate proposal, and write that quantum-resistant signature algorithms “offer different levels of protection and should be scrutinized before use.”
The design targets the long-exposure risk, and the BIP is precise about the boundary. Once the new output type exists, holders can move coins out of exposed pay-to-public-key and reused addresses into outputs whose public key is never revealed until it is spent. The BIP states that P2MR outputs “are only resistant to ‘long exposure attacks’ on elliptic curve cryptography,” and that P2MR “does not, by itself, protect against short exposure quantum attacks,” meaning a public key sitting in the mempool while a transaction waits to confirm. Closing that second gap would require post-quantum signatures the proposal does not introduce.
What happens to the coins that never move is handled elsewhere. BIP-360 puts the burning of vulnerable coins and other responses to a quantum-driven supply shock explicitly out of its own scope, naming Jameson Lopp’s QBIP and the authors’ separate Hourglass proposal as the venues for that argument. BIP-360 is a draft under discussion, so it is the direction to track rather than a shipped feature, and its hardest part is coordination across wallets, miners, exchanges, and users.
Source: Hunter Beast, Ethan Heilman, Isabel Foxen Duke, “BIP-360: Pay-to-Merkle-Root (P2MR),” version 0.12.1, Status: Draft, Bitcoin Improvement Proposals, github.com/bitcoin/bips/blob/master/bip-0360.mediawiki. ⚠️ The BIP was renamed twice: from Pay to Quantum Resistant Hash (P2QRH) to P2TSH at v0.10.0 (September 2025), then to P2MR at v0.11.0 (February 2026). Older writing citing “P2QRH” is describing an earlier revision of this same document.
How is Ethereum planning to go quantum-resistant?
Ethereum’s plan leans on account abstraction, which lets an account choose its own signature algorithm so a quantum-safe scheme can be adopted without a protocol-level hard fork. In February 2026, Vitalik Buterin published a roadmap identifying four parts of Ethereum’s cryptography that need post-quantum upgrades: consensus-layer signatures, data-availability sampling, externally owned account signatures, and certain zero-knowledge proofs. The account-signature piece is where account abstraction does the heavy lifting, because moving users from bare externally owned accounts to programmable smart-contract wallets means a wallet can swap its verification logic to a post-quantum signature when the standards and tooling are ready.
On the consensus layer, Ethereum Foundation researchers have proposed two complementary tools: leanXMSS, a hash-based signature scheme replacing BLS for validators, and leanVM, a minimal zkVM for SNARK-based signature aggregation, because BLS’s aggregation property “does not have an obvious quantum-safe equivalent”, chosen because a hash-based scheme rests on the same quantum-durable foundation as XMSS and SLH-DSA. The general shape mirrors Bitcoin’s: keep the surviving hash-and-consensus machinery, replace the signature layer, and stage the migration so it does not require an emergency fork. Both timelines and design details are moving, so treat the specifics as a live research program rather than a finished migration.
Source: Ethereum, “Post-quantum cryptography,” ethereum.org/roadmap/future-proofing/quantum-resistance.
What are state proofs, and how do they help?
A state proof is a periodic, compact certificate that attests to a blockchain’s ledger state, signed with a post-quantum signature so the proof of history stays verifiable even against a quantum adversary. Algorand is the deployed worked example: it introduced state proofs in 2022 as a post-quantum compact certificate produced every 256 rounds, signed with FALCON, the NIST signature being standardized as FN-DSA. Because each participating validator signs with a post-quantum key, a verifier can trust that a valid state proof was produced by the real network, which protects the entire signed history of the chain rather than only future transactions.
The technique matters for two reasons. It gives a chain a quantum-durable anchor for its own past, so an attacker with a future quantum computer cannot rewrite what a state proof already committed, and because these proofs are compact and verifiable by outside systems, they let other chains confirm a network’s state with quantum resistance, which is the foundation for quantum-safe cross-chain bridging. State proofs address a different exposure from the spend-authorization signatures above: they harden the record of what already happened rather than the authorization of what happens next.
Source: Algorand, “State Proofs Overview,” Algorand Developer Portal, developer.algorand.org/docs/get-details/stateproofs.
Which post-quantum signatures do quantum-safe blockchains use?
They draw from the finalized NIST signature standards plus the older stateful hash-based schemes, and the choice trades size against conservatism. The candidates a chain actually reaches for:
| Signature scheme | Family | Where it appears | Why chosen |
|---|---|---|---|
| XMSS | Hash-based (stateful) | Quantum Resistant Ledger | Security rests only on a hash function; most conservative assumption |
| SLH-DSA (SPHINCS+) | Hash-based (stateless) | Named in BIP-360 as a research candidate | Hash-only security with no state to manage; large signatures |
| ML-DSA (Dilithium) | Lattice | Named in BIP-360 as a research candidate; Ethereum candidate | General-purpose default; moderate size and speed |
| FN-DSA (FALCON) | Lattice (NTRU) | Algorand state proofs | Compact signatures where transaction size is the binding constraint |
The pattern across all of them is that the security foundation is a problem with no known efficient quantum attack, either a hash function or a lattice problem, which is what makes each one a durable replacement for ECDSA. The practical tension is size. Aggarwal et al. put the criterion plainly: “In the blockchain context the most important parameters of a signature scheme are the signature and public key lengths, as these must be stored in some capacity to fully verify transactions, and the time to verify the signature,” and on that measure “the only reasonable options are hash and lattice based schemes.” That is why a chain that can tolerate managing state may prefer compact hash-based signing, while a chain that wants a stateless drop-in reaches for a lattice signature and accepts the size.
Sources: NIST, “Post-Quantum Cryptography FIPS Approved,” August 13, 2024, csrc.nist.gov, for ML-DSA being the module-lattice scheme and SLH-DSA the stateless hash-based one; Divesh Aggarwal et al., “Quantum attacks on Bitcoin, and how to protect against them,” Table II and the surrounding discussion, arXiv:1710.10377, for the length-and-verification-time criterion that narrows the field to hash-based and lattice schemes. The per-scheme sizes are in NIST FIPS 204 and FIPS 205 themselves.
Common misconceptions
- “A blockchain has to be rebuilt from scratch to go quantum-safe.” Most of the machinery survives. The migration replaces the signature scheme that authorizes spending, and the proof-of-work hashing and ledger structure carry forward, which is why soft-fork retrofits are on the table for Bitcoin and Ethereum.
- “Quantum computers break blockchains by out-mining the network.” Mining rests on SHA-256 and faces only Grover’s quadratic speedup, which ASIC miners outrun. The break is on the ECDSA signatures that authorize spends.
- “The Quantum Resistant Ledger just uses a bigger key.” It uses a different family. QRL authorizes transactions with XMSS, a hash-based signature whose security rests only on a hash function, which is a structurally different foundation from elliptic-curve signing.
- “Nothing can be done until a quantum computer exists.” The finalized NIST signatures already exist, so the proposals for Bitcoin and Ethereum can be built and coordinated now, ahead of the CRQC. The scarce resource is coordination time across the ecosystem, since the cryptography is already standardized.
- “Post-quantum signatures are a free drop-in.” They are larger and often slower than ECDSA, and on a chain that stores and charges for every byte, that size drives real decisions about which scheme fits, which is why chains split between compact hash-based and stateless lattice options.
Questions people ask
How does a blockchain become quantum-resistant? By replacing the elliptic-curve signature that authorizes transactions with a post-quantum signature that has no known efficient quantum attack, either by building the chain that way from the start like the Quantum Resistant Ledger or by retrofitting an existing chain through a signature soft-fork. The SHA-256 hashing that secures mining survives, so the work concentrates on the signature layer.
What signature does the Quantum Resistant Ledger use? XMSS, the eXtended Merkle Signature Scheme specified in IETF RFC 8391, a hash-based signature whose security rests only on the strength of a hash function. It is stateful, so each one-time key must be used exactly once, which QRL manages at the wallet and protocol level.
Can Bitcoin be made quantum-safe? Yes, through a soft-fork that adds a quantum-resistant output type. The leading proposal, BIP-360, would let holders move coins behind a NIST post-quantum signature such as SLH-DSA or ML-DSA. It is a draft under discussion, so the main open work is ecosystem coordination.
What is Ethereum doing about quantum computing? Ethereum’s plan uses account abstraction so wallets can swap their signature algorithm to a post-quantum scheme without a protocol-level hard fork, alongside a hash-based multi-signature proposal to replace consensus-layer BLS aggregation. The roadmap covers account signatures, consensus signatures, data availability, and some zero-knowledge proofs.
What are blockchain state proofs? A state proof is a periodic compact certificate that attests to the ledger’s state, signed with a post-quantum signature so the proof of history stays verifiable against a quantum adversary. Algorand produces them signed with FALCON, which protects the chain’s entire signed history and enables quantum-safe cross-chain verification.
Which post-quantum signature is best for a blockchain? It depends on the constraint. Chains that can manage signing state may prefer compact hash-based signatures, chains that want a stateless drop-in use a lattice signature like ML-DSA, and chains where transaction size dominates reach for the compact FN-DSA. All rest on problems with no known efficient quantum attack.
Everything here is the map, given freely. When your team needs blockchain or ledger cryptography sorted into what a quantum computer can actually reach and which post-quantum signature fits your constraints, that’s the work I do.
Last verified 2026-07-26 · Updated 2026-08-27 · Maintained by Addie LaMarr, LaMarr Labs.