Quantum-Resistant Blockchains Compared

TL;DR

Five properties decide whether a chain's quantum claim means anything: which signature scheme, which NIST security category, whether post-quantum signing covers every transaction from genesis or is opt-in, what it costs in bytes and throughput, and whether it has shipped or been announced.

Measured that way, Quantus is the only proof-of-work Layer 1 with FIPS-standardised post-quantum signatures on every mainnet transaction from block 0, live since 9 September 2026 — and it has no smart contracts, no bridge in production, and two of its seven audits still open. QRL has run hash-based XMSS signatures on mainnet since June 2018, the longest record of any of these, but its ML-DSA-87 successor Zond has been on Testnet V2 since Q1 2026 with no mainnet date set. Algorand shipped native Falcon-1024 accounts to mainnet in August 2026 via the v5.0.0 upgrade, and user funds still default to Ed25519. Ethereum's largest exposures are 37 million ETH of stake behind BLS signatures and 15 million ETH behind KZG commitments, fixable by no user action, with an L1 target of 2029. Bitcoin has two draft BIPs and no activation path.

The Five Properties That Decide Quantum Risk in a Chain

Ranking chains by how loudly they use the word quantum produces a useless list. These five questions produce a decision.

1. Which signature scheme? Lattice (ML-DSA, Falcon), hash-based (XMSS and relatives), or still elliptic curve. This sets both the security assumption and the byte cost.
2. Which NIST security category? ML-DSA-65 targets Category 3, ML-DSA-87 targets Category 5. Falcon and the onramp candidates are not finalised standards at all.
3. Every transaction from genesis, or opt-in? This is the property that decides user risk, and it is the one comparisons skip. A chain where post-quantum signing exists but defaults to off protects the users who read the release notes.
4. What does it cost? Signature plus public key on the wire, and the throughput ceiling that falls out of it.
5. Shipped or announced? A testnet, a draft BIP and a roadmap milestone are three different things, and none of them is mainnet.

One framing note before the table. A blockchain is an authenticity system, not a confidentiality system, so harvest-now-decrypt-later mostly does not apply: a quantum computer cannot retroactively forge a signature that was already accepted. Signature risk starts at Q-day. Bitcoin is the exception that proves the rule — its public keys have been published on a permanent ledger since 2009, so the harvesting already happened and only the machine is missing. I go through the measurement behind that in the quantum threat to Bitcoin and Ethereum.

The Comparison, on Those Five Properties

Read the Coverage column first. It is the only column where the answer changes what happens to a user who does nothing.

Which Signature Scheme, and Which Category You Are Actually Getting

NIST's finalised post-quantum set is narrow. FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) have been final since 13 August 2024. HQC was selected in March 2025 as a non-lattice backup KEM and no draft FIPS has been published. FN-DSA — the standard name for Falcon — still has no public draft, per the CSRC post-quantum project page↗ updated 5 August 2026. On 14 May 2026, NIST advanced nine candidates to round three of the additional-signatures onramp in IR 8610: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign and UOV.

The practical consequence for a chain designer in 2026: your finalised choices are ML-DSA, SLH-DSA, or a non-NIST hash-based scheme such as XMSS or LMS. Everything else is a bet on a standard that is not finished.

That reframes two of the projects in the table. Algorand's Falcon-1024 is not a finalised FIPS. QRL's XMSS is not a FIPS either, though NIST does recommend XMSS and LMS in SP 800-208, and it is hash-based, which is the most conservative security assumption on the list — its security rests on hash function properties rather than on lattice hardness.

One more parameter to check inside a chain rather than on its homepage. The whitepaper quotes throughput for both parameter sets — "~43 QTPS" at ML-DSA-87 and "~58 QTPS" at ML-DSA-65 — and the repository's Cargo.toml compiles both, and the HD wallet crate is compiled with ml-dsa-65 only — so wallet-derived keys are Category 3, not Category 5. I work through that discrepancy line by line in what Quantus actually shipped. The lesson generalises: the category you get is set by the wallet derivation path, not by the marketing page.

Genesis-Wide or Opt-In: The Property That Decides User Risk

This is where the comparison stops being academic.

Quantus and QRL sign every transaction with a post-quantum scheme and have no elliptic-curve fallback path. A user who does nothing is covered. That is a strong, narrow, true claim, and it is the strongest honest claim either project has.

Algorand is the instructive middle case. Falcon-signed State Proofs have been live since 2022, but they protect chain history — they let a light client or a bridge verify past state without trusting a committee. They do not protect an account. Native Falcon-1024 accounts reached mainnet in August 2026 with the v5.0.0 upgrade, and Algorand's post-quantum roadmap↗ targets post-quantum multisig and Falcon-512 support by the end of 2026, with a post-quantum VRF still at the research-paper stage expected in early 2027. Today, user funds default to Ed25519. So "Algorand is post-quantum" is true of the protocol's history proofs and available for accounts, and false for the median user's balance until they migrate.

Ethereum offers nothing to users today and says so plainly. ethereum.org's future-proofing page↗ tells users "For now, there is nothing you need to do."

Bitcoin offers nothing either, and its newest address type made the position worse. P2TR (bc1p) writes the tweaked public key straight into the locking script with no hash in front of it, which restores the at-rest exposure that P2PKH removed in 2009. Google's whitepaper calls this the Taproot regression. Measured across blocks 877,259 to 930,340, P2TR moved roughly 16.8 million BTC in 2025 and accounted for 21.68% of all Bitcoin transactions that year. Roughly 6.9 million BTC were quantum-vulnerable across all script types in March 2026, of which about 1.7 million BTC sit in P2PK outputs including Satoshi-era mining rewards. The folklore advice "use a modern address and never reuse it" is wrong for the newest address type. If you want the practical version of that, I cover it in how to store Bitcoin safely.

What Post-Quantum Signatures Cost in Bytes and Throughput

Every chain on this list is paying, or deferring, the same bill.

ML-DSA has no public-key recovery. Ethereum's ECDSA has public-key recovery: the verifier reconstructs the public key from the signature, which is why an Ethereum transaction carries a 65-byte signature and no key. Bitcoin does not use recovery at all — a P2WPKH input carries a signature of about 72 bytes plus a 33-byte public key, and a Taproot key-path spend carries a 64-byte Schnorr signature only because the key already sits in the output being spent. Lattice signatures do not, so the key travels in every transaction.

Roughly a 100x blowup against a 72-byte input that transmits no key, and 69x against a legacy input that already carries its public key, two-thirds of it signature and one-third unavoidable key material. The whitepaper quantifies size rather than verification time: "ML-DSA signatures can be over 70 times larger than ECDSA equivalents, and public keys more than 80 times larger."

You can watch that bill land on throughput. Quantus's runtime allows 3,932,160 bytes of normal-extrinsic space per 12-second block. That is 3,932,160 / 7,219 / 12 = 45.4 transactions per second at ML-DSA-87 and 62.3 at ML-DSA-65, matching the whitepaper's stated 43 and 58 once encoding overhead is added. A chain that swaps in lattice signatures and changes nothing else loses most of its throughput.

That single property explains the design choices of everyone else on the list. Algorand's stated reason for choosing Falcon is that it "offers the most compact size of keys and signature from the lattice-based schemes". Ethereum refused to put lattice signatures on the consensus layer at all, choosing hash-based leanXMSS aggregated through a minimal zkVM, leanVM, with proof-based compression to keep the onchain footprint manageable. Quantus needs a recursive-proof shielded pool to get past its transparent ceiling. Nobody gets to just swap the curve.

Quantus: Ahead on One Axis, Narrow on the Rest

The honest version of the Quantus claim is narrower than the marketing and still meaningful: it is the only proof-of-work Layer 1 with FIPS-standardised post-quantum signatures on every mainnet transaction from block 0. QRL is also proof-of-work and also signs every transaction from genesis, but with XMSS, which NIST recommends in SP 800-208 rather than in a FIPS.

Where the claim narrows. It has no smart contracts in any language, deliberately — the whitepaper says "Quantus is not a general purpose smart contract platform. It is more like Bitcoin, Monero, or Zcash and less like Ethereum or Solana". Its proof-of-work hash is Poseidon2, and its own documentation says Poseidon2 was chosen for ZK circuit efficiency rather than quantum resistance, adding that hash functions like SHA-256 are "weakened but not destroyed by quantum algorithms, notably Grover's". The whitepaper lists seven audits. Five are complete with PDF reports published: Eiger on proof-of-work and Poseidon2 (October 2025), Neodyme on ML-DSA signatures and the HD wallet (December 2025), Eiger on the Wormhole ZK circuits (March 2026), Eiger on the Substrate runtime and node (May 2026), and a Lean formal verification of the Wormhole circuits (June 2026). Two are still open: a Hashcloak audit of threshold ML-DSA signatures and an Immunefi public competition. The only route off-chain is a NEAR threshold-MPC bridge whose testnet integration has not launched.

So: genuinely first on one axis, unproven on several others.

QRL: The Longest Mainnet Record, and a Successor That Has Not Shipped

QRL has run XMSS hash-based signatures on mainnet since June 2018. That is more than eight years of a post-quantum signature scheme securing a live chain, which is a record nobody else on this list is close to, and it almost never appears in comparison articles.

The successor is the problem. QRL 2.0, called Zond, moves to ML-DSA-87, proof of stake, and an EVM-derived QRL VM with a Solidity fork named Hyperion. It has been on Testnet V2 since Q1 2026, and the project's roadmap lists network performance optimisation and a comprehensive security audit ahead of mainnet without naming a date, and mainnet is contingent on audits. If you are evaluating QRL for smart contract work rather than for value transfer, you are evaluating a testnet. Anyone porting Solidity to a forked VM should read how the EVM actually behaves before assuming compatibility.

Algorand: Shipped, Real, and Still Off by Default

Algorand has the most credible incremental story here, and the marketing overstates it in one specific way.

What is real: Falcon-signed State Proofs on mainnet since 2022, protecting chain history for light clients and bridges. Native Falcon-1024 accounts on mainnet since August 2026 via the v5.0.0 upgrade. That is a production Layer 1 with a working post-quantum account type, which is more than Ethereum or Bitcoin can say.

What is narrower than it sounds: user funds default to Ed25519, so coverage is opt-in. Post-quantum multisig and Falcon-512 are targeted for end-2026 and a post-quantum VRF is still at the research-paper stage, expected early 2027, which means the consensus randomness beacon is not post-quantum yet. And Falcon is FN-DSA, whose FIPS 206 has no published draft — Algorand is ahead of the standard, not behind it, but that is still a bet on a document that does not exist yet.

Ethereum: The Biggest Exposure Is Not Your Wallet

Coverage of Ethereum's quantum exposure stops at the account model. That is the smallest of five exposures. Google's whitepaper lays out the taxonomy:

Thirty-seven million ETH of stake sits behind BLS and fifteen million behind KZG. No wallet upgrade, no seed rotation and no user action touches either. All five are at-rest attacks. Ethereum's 12-second slots and TEE-based private mempools underpin Google's assessment that early fast-clock machines are "unlikely to be able to launch on-spend attacks against Ethereum". Google also estimates such a machine could crack the 1,000 highest-value ETH accounts in under nine days.

KZG is the one worth sitting with. It is a binding commitment whose security reduces to discrete log, so after Q-day an attacker could equivocate on blob data availability — which is the data layer every rollup now settles against. I go into what blobs cost and who depends on them in Fusaka, blobs and rollup economics.

The plan, published at pq.ethereum.org↗, splits across execution, consensus and data with milestones labelled I, J, L and M: a post-quantum key registry, post-quantum signature precompiles, post-quantum attestations plus leanVM, and post-quantum aggregation plus blobs. Consensus replaces BLS with leanXMSS aggregated through leanVM, with the compression factor not yet published. Data replaces KZG with STARK-based or lattice-based commitments, still research. Around ten client teams are building post-quantum consensus clients against leanSpec. The Foundation's own line: "L1 protocol upgrades could be completed by 2029, with full execution-layer migration taking additional years beyond that."

The user-facing vehicle is EIP-8141↗, Frame Transaction, Draft since 29 January 2026, with no fork assignment in the EIP itself. It defines three verification schemes: ARBITRARY (0x0), SECP256K1 (0x1, 65-byte signatures) and P256 (0x2, 128-byte signatures). The spec describes itself as "a native off-ramp from the elliptic curve based cryptographic system used to authenticate transactions today, to post-quantum (PQ) secure systems". It defines no post-quantum scheme. It is the extension point, not the migration. It has not been scheduled for inclusion in any fork, and the 2029 date is the Foundation's own assessment.

Bitcoin: Two Drafts, No Activation Path

BIP-360↗, renamed Pay-to-Merkle-Root (P2MR), is P2TR with the quantum-vulnerable key-path spend removed — SegWit version 2, mainnet prefix bc1z, created 18 December 2024, authors Hunter Beast, Ethan Heilman and Isabel Foxen Duke. It deliberately contains no post-quantum signature algorithm; that argument was split into a future BIP so P2MR could be debated on its own. Reported merged 11 February 2026, with a first signet transaction on 10 September 2025.

BIP-361, Post Quantum Migration and Legacy Signature Sunset, created 11 February 2026 by Jameson Lopp and five co-authors, is Draft and Informational. Phase A, roughly 160,000 blocks (about three years) after activation, prohibits sending to quantum-vulnerable outputs. Phase B, two years later, tightens ECDSA and Schnorr spend rules, effectively freezing whatever has not moved. The BIP's own logic is that prohibiting sends to quantum-vulnerable scripts, then tightening ECDSA and Schnorr verification, is preferable to leaving exposed coins spendable by a future attacker.

The critical qualifier: both are Draft, both were merged into the bitcoin/bips documentation repository rather than into consensus code, and neither has BIP-9 or BIP-8 deployment parameters. Describing either as "coming to Bitcoin" is wrong. What exists is a specification argument in public, which is how Bitcoin works, and which takes years.

One piece of good news that applies to Bitcoin and to Quantus equally: proof-of-work is not meaningfully threatened. Grover's quadratic speedup is, in Google's words, "all but consumed by the overheads of quantum error correction", and Grover does not parallelise well against an industry built on parallel hardware. The threat is to signatures, not to mining.

How Urgent Is This, in Numbers That Were Measured

Two columns, and never mix them.

Projected, from two 2026 resource estimates that agree far more than the headlines suggest. Google Quantum AI, with the Ethereum Foundation and Stanford, put breaking secp256k1 at fewer than 1,200 logical qubits and fewer than 90 million Toffoli gates, or fewer than 1,450 logical and fewer than 70 million, on under half a million physical qubits at a 10^-3 error rate — 18 to 23 minutes wall clock, with precomputation halving the post-key-reveal window to about 9 minutes. IonQ's trapped-ion blueprint, arXiv 2609.05625↗ dated 4 September 2026, gives 1,457 logical qubits, 19,397 physical, 39 million logical Toffolis and 25.7 days per attempt at a 40.7% to 63.3% success rate — so multiple attempts in expectation, not 26 days to a key. The logical-qubit counts agree within about 20%. The physical counts differ 25x purely from assumed error rate and code family.

Demonstrated, which is a different universe. The largest elliptic-curve key ever broken on real quantum hardware is 15 bits, awarded by Project Eleven's Q-Day Prize on 24 April 2026 to Giancarlo Lelli over a 32,767-element search space, up from a reported 6 bits in September 2025. Secp256k1 is 256 bits. The best commercially announced logical-qubit ratio is Quantinuum's Helios, 98 physical trapped-ion qubits encoding 48 logical on the company's own figures; the Helios paper itself (arXiv 2511.05465↗) reports only the 98 physical qubits. The blueprints want roughly 1,450 logical qubits running tens of millions of Toffolis, every one of which must succeed.

That is roughly a 29x shortfall in logical qubits and a 10^7 shortfall in fault-tolerant gate depth. The second number is the one that matters, and it is the one nobody quotes.

For expert opinion, the Global Risk Institute publishes an annual Quantum Threat Timeline based on a survey of quantum researchers. I have not read the 2025 edition, so I quote no figures from it. One structural point holds regardless: that survey sets its threshold against RSA-2048, which the 2026 resource papers put well above secp256k1 in cost on the same hardware, so the elliptic-curve threshold arrives earlier than any RSA-anchored headline.

What Actually Binds a Team, and How I Would Choose

Almost every migration checklist cites "NIST's 2030 deprecation and 2035 disallowance" as settled policy. NIST IR 8547 has been an initial public draft since 12 November 2024, with a comment period that closed in January 2025, no second draft and no final. The binding instrument for US federal systems and their contractors is Executive Order 14412 of 22 June 2026, which sets post-quantum key establishment by 31 December 2030 and digital signatures by 31 December 2031 for High Value Assets and high-impact systems, with a FAR rule requiring covered contractors to comply by 31 December 2030. The UK's NCSC roadmap, published March 2025, sets discovery and plan by 2028, highest-priority upgrades by 2031, and full migration by 2035. Those dates and their scoping are what I work to, not the draft. The sequencing is in the post-quantum migration guide for blockchain teams.

How I would choose, in September 2026:

• Value transfer with no contracts, want coverage by default: Quantus or QRL. Quantus is FIPS-standardised and four days old at publication; QRL is not a FIPS scheme and has eight years of mainnet. Pick which risk you prefer.
• Production application today with a real post-quantum account option: Algorand, with the understanding that you must opt in and that Falcon is ahead of its standard.
• Anything needing deep liquidity and tooling: Ethereum, accepting that your exposure is at-rest, that the protocol answer arrives around 2029, and that BLS and KZG are not your problem to fix.
• Bitcoin holdings: bc1q with no address reuse, and treat bc1p as at-rest exposed. Do not wait on BIP-360.

Key Takeaways

• Coverage is the property that decides user risk. Quantus and QRL sign every transaction post-quantum by default. Algorand's Falcon accounts are opt-in with Ed25519 as the default. Ethereum and Bitcoin offer users nothing today.
• Quantus's honest claim is narrow and still first. The only proof-of-work L1 with FIPS-standardised post-quantum signatures on every mainnet transaction from block 0, live 9 September 2026 — with no smart contracts, no bridge in production, and two audits still open.
• QRL holds the longest record and the least certain future. XMSS on mainnet since June 2018; the ML-DSA-87 Zond chain has been on Testnet V2 since Q1 2026 with no mainnet date set.
• The byte cost is structural. 7,219 bytes for ML-DSA-87 and 5,261 for ML-DSA-65 against roughly 65 to 72 for ECDSA, because lattice schemes have no public-key recovery, which caps 3,932,160 bytes of normal-extrinsic space per 12-second block at 45.4 transactions per second.
• Ethereum's problem is BLS and KZG, not wallets. 37M ETH of stake and 15M ETH of data-availability exposure, unfixable by any user, with L1 upgrades targeted for 2029 and execution-layer migration after that.
• Bitcoin's Taproot made things worse, not better. P2TR writes the public key into the locking script and moved roughly 16.8M BTC in 2025 across 21.68% of transactions; BIP-360 and BIP-361 are both Draft with no activation parameters.
• Cite EO 14412, not NIST IR 8547. The IR has been a draft since 12 November 2024; the executive order of 22 June 2026 sets the binding 2030 and 2031 dates.

About the Author

I'm Uvin Vindula — a Web3 and AI engineer based between Sri Lanka and the UK. I compared these chains on their code, their standards status and their default settings rather than their homepages, because the only quantum property that protects a user is the one that is on when the user does nothing. You can see my work at iamuvin.com or reach out about a project at hello@iamuvin.com↗.

If you are choosing a chain on security properties rather than on throughput charts, or planning a signature migration for a wallet or protocol, let's talk about your project.