Post-quantum blockchains (survey)

Post-quantum blockchains use signature schemes designed to resist quantum attack in place of the elliptic curve signatures that secure most networks today. A small number run post-quantum signatures in production, several major ecosystems are researching retrofits, and every design pays the same cost: post-quantum signatures and keys are roughly 10 to 100 times larger than the elliptic curve values they replace.

#Why blockchains are a hard migration case

The threat is uniform: nearly every chain signs transactions over a discrete-logarithm-based curve, so quantum threat to ECDSA applies to Bitcoin, Ethereum, and most of their successors alike. The migration is not uniform. In post-quantum TLS, operators upgrade servers and clients centrally; on a blockchain, new consensus rules must be agreed, and then every individual key holder must move funds, so coins whose owners are absent stay exposed indefinitely (the governance consequences are examined in is Bitcoin quantum safe?). Ledger history is also permanent, so any key ever revealed remains attackable forever. This is why some projects chose post-quantum signatures from genesis while others plan cryptographic agility into account models so schemes can be swapped later.

#Chains with post-quantum signatures in production

The Quantum Resistant Ledger (QRL) has run XMSS signatures since its mainnet launch in June 2018, one of the longest-running production deployments of post-quantum signatures on a public chain. XMSS is a stateful hash-based scheme built from Merkle trees of one-time keys: its security assumptions are conservative and well studied, but each one-time key may sign exactly once, so wallets must track signature indexes, and signatures run to several kilobytes. As of early 2026 the project is developing an EVM-compatible successor network that replaces XMSS with ML-DSA.

BTX is a proof-of-work chain derived from the Bitcoin codebase that replaces ECDSA with the two primary NIST signature standards, ML-DSA and SLH-DSA, at the protocol level (project site). The network is live as of early 2026 with a small mining base and an early ecosystem; like other from-genesis designs, it accepts larger transaction sizes up front so that no later signature migration is needed.

#Post-quantum components inside classical chains

Algorand illustrates a partial approach. Everyday account transactions use Ed25519, which is quantum-vulnerable like ECDSA, but since 2022 the chain's State Proofs have been signed with Falcon, the compact lattice scheme standardized as FN-DSA / Falcon. State Proofs let light clients and bridges verify Algorand's history without trusting validators, so the chain's exported history is post-quantum protected even though individual account keys are not.

IOTA moved in the opposite direction, and the history is instructive. Its original protocol used Winternitz one-time signatures, a hash-based scheme that resists quantum attack but makes address reuse dangerous because each key is single-use. With the Chrysalis upgrade in 2021, IOTA adopted Ed25519, giving up quantum resistance in exchange for reusable addresses, standard tooling, and better performance. Post-quantum migration is not a one-way ratchet; usability pressures can and do push projects back to classical schemes.

#Retrofit research on Bitcoin and Ethereum

Bitcoin's main concrete proposal is BIP 360, a draft pay-to-quantum-resistant-hash output type that would let coins commit to post-quantum verification data and be deployed as a soft fork; is Bitcoin quantum safe? covers it alongside the migration and governance questions.

Ethereum research runs along three lines as of early 2026: account abstraction, which lets individual accounts choose their own signature verification and therefore adopt post-quantum schemes without a global fork; validity proofs built only from hash functions (STARKs), which are conjectured quantum-resistant and could carry both scaling and signature aggregation; and contingency planning, including a hard-fork sketch by Vitalik Buterin for recovering most user funds after a surprise quantum break. None of these is deployed for ordinary transactions on mainnet.

#Comparison

#The cost every design pays

Size is the unavoidable tradeoff. An ECDSA signature is 64 to 72 bytes with a 33-byte key; the standardized replacements are far larger, per FIPS 204 and FIPS 205.

Every transaction carries at least one signature, so scheme size multiplies directly into block size, bandwidth, and archival storage, and verification cost shapes node requirements. Falcon's compactness makes it attractive for chains, but its signing algorithm needs careful floating-point implementation, which is why some projects avoid generating Falcon signatures in consumer wallets. Stateful hash-based schemes like XMSS shift risk into wallet engineering. The honest summary of the field as of early 2026: production experience exists and the standards are settled, but no design escapes the size penalty, and the largest ecosystems remain at the research or proposal stage.