Quantum-Safe Blockchains: Migrating Signature Schemes

As of mid-2026, no quantum computer can break Bitcoin, Ethereum, or any mainstream blockchain’s signature scheme. That fact gets repeated often enough that it has started to function as an excuse for inaction, when it should function as a countdown. Public-key signature schemes secured by the elliptic curve discrete logarithm problem, namely ECDSA and Schnorr, are provably breakable by Shor’s algorithm on a large enough fault-tolerant quantum computer. Academic roadmaps now estimate a cryptographically relevant quantum computer could exist as early as 2027 to 2030, and migrating a live, economically load-bearing, decentralized network away from its foundational signature scheme is a multi-year undertaking even under ideal coordination. The math is not close, but the clock genuinely is.

Why Blockchains Are Uniquely Hard to Migrate

Most cryptographic migrations, such as a bank rotating its TLS certificates to a post-quantum key exchange, happen inside an organization with a single decision-maker and a maintenance window. Blockchains have neither. A public blockchain’s signature scheme is embedded in consensus rules that every node, wallet, and downstream application must agree on simultaneously. Changing it requires either a backward-compatible soft fork, which can only add new capability without breaking old rules, or a hard fork, which changes the rules outright and risks splitting the network if any meaningful fraction of participants does not upgrade.

Layered on top of that governance problem is an exposure problem unique to public ledgers: a blockchain address only reveals its public key once it has been used to sign an outgoing transaction. Addresses that have never spent funds, holding only a hashed version of the public key, remain safe from a quantum attack even after such a computer exists, because the hash function itself is not vulnerable to Shor’s algorithm in the same way. But any address that has ever sent a transaction has revealed its raw public key on the permanent, public ledger, and that key is potentially exposed to a future quantum attacker who can derive the private key and forge signatures at will. This single design detail explains most of the urgency, and most of the disagreement, in current migration debates.

Bitcoin’s Migration Path: BIP-360 and BIP-361

Bitcoin’s approach has crystallized around two complementary proposals. BIP-360 introduces a new address type called Pay-to-Merkle-Root, which strips out the quantum-vulnerable key-path spend that Taproot addresses currently support, replacing it with a script-path structure compatible with post-quantum signature schemes. Published and merged into Bitcoin’s reference repository in February 2026, BIP-360 is explicitly framed as a first step rather than a complete fix: it protects newly created addresses and coins belonging to users who choose to migrate, but it does not by itself do anything for the roughly one-third of all bitcoin already sitting in addresses that have revealed a public key on-chain.

That second, harder problem is the subject of BIP-361, a companion proposal addressing legacy exposed coins. According to public estimates from a BIP-361 co-author, a full network migration to quantum resilience, meaning the point at which essentially all economically active coins have moved to quantum-resistant addresses, could take around seven years from the day the community reaches rough consensus on the approach. The central policy dilemma is stark and has been widely discussed in the Bitcoin community: should the network eventually freeze coins sitting in exposed, dormant addresses to prevent a quantum attacker from stealing them, or should it leave those coins spendable and accept that a sufficiently powerful attacker could eventually take them. Neither option is comfortable, since freezing coins raises questions about property rights and about which addresses genuinely belong to lost or inactive wallets versus lost keys, while leaving them exposed creates a slow-motion theft risk that grows as quantum hardware matures.

Why Bitcoin moves cautiously

Bitcoin’s governance model prioritizes backward compatibility and rough consensus over speed, by design. There is no central foundation that can mandate an upgrade timeline, and any hard fork requires overwhelming buy-in from miners, node operators, and the exchanges and custodians that hold the majority of circulating supply. This is precisely why estimates for full migration run into years rather than months, even though the underlying cryptographic engineering for post-quantum signatures is largely solved. Broader research on post-quantum migration consistently finds that this coordination problem, not the mathematics, is the longest pole in any large-scale cryptographic transition.

Ethereum’s Roadmap: The “Strawmap” Approach

Ethereum’s governance model is structurally different, built around a more centralized research and coordination process led by its core developers, which allows for faster and more sweeping protocol changes than Bitcoin’s more conservative process typically permits. Vitalik Buterin published a post-quantum roadmap, informally called the “Strawmap,” that targets quantum resistance across multiple layers of the protocol simultaneously rather than as a single signature swap: consensus-layer signatures, account abstraction and wallet signature schemes, data availability sampling, and the zero-knowledge proof systems that underpin Ethereum’s scaling roadmap all need independent post-quantum treatment.

Ethereum’s account abstraction work is particularly relevant here, because it decouples “what makes a valid transaction” from a single hard-coded signature algorithm, letting individual accounts choose or upgrade their signature scheme without requiring a network-wide hard fork for every account simultaneously. That flexibility gives Ethereum a meaningfully different migration path than Bitcoin: rather than one flag-day cutover, post-quantum signature support can roll out account by account as wallets and infrastructure adopt it, with the network-level consensus changes handled on a separate, longer timeline.

The Hybrid Signature Strategy

For the 2026-to-2030 window, essentially every serious blockchain migration proposal converges on the same interim strategy: hybrid signatures. Rather than replacing ECDSA or Schnorr outright, a transaction, account, or validator message can be required to carry both a classical signature and a post-quantum signature simultaneously. This gives two layers of defense in depth. If an unforeseen cryptanalytic flaw is discovered in a newly standardized post-quantum scheme, which has happened before with early post-quantum candidates during NIST’s selection process, the classical signature still provides real security. Conversely, if elliptic curve cryptography falls to a quantum attack sooner than expected, the post-quantum signature remains intact and continues to protect the account.

The trade-off is transaction size and verification cost. ML-DSA signatures run roughly 2.4 to 4.6 kilobytes depending on the security level chosen, compared with 64 to 72 bytes for a typical ECDSA or Schnorr signature, an increase of well over an order of magnitude. Public keys grow similarly, from tens of bytes to over a kilobyte. For a blockchain processing millions of transactions, that size increase has direct consequences for block size limits, fee markets, and long-term storage growth of the ledger itself, which is one of the reasons migration proposals are being debated so carefully rather than rushed.

Layer-1 Alternatives Building Post-Quantum From the Start

Alongside the migration efforts on Bitcoin and Ethereum, a smaller set of newer or restructured layer-1 networks have chosen to build post-quantum signature support in from an earlier stage rather than retrofitting it onto an established base. Several projects position themselves explicitly around post-quantum security as a differentiator, using lattice-based or hash-based signature schemes as their default rather than an opt-in hybrid layer. Hedera has also published research and commentary specifically addressing how its hashgraph consensus mechanism and existing cryptographic primitives relate to the post-quantum threat model, treating it as a design input rather than a future retrofit.

The trade-off for these newer or smaller networks is exactly the one you would expect: less battle-tested security history and smaller, less liquid ecosystems compared with Bitcoin or Ethereum, in exchange for a cleaner post-quantum design that avoids the legacy exposed-key problem entirely. Whether that trade-off is worth it depends heavily on the specific use case and risk tolerance of the organization evaluating it, and it is not a reason for major chains to delay their own migration planning.

What Financial Institutions Building on These Chains Need to Plan For

Enterprises and financial institutions that rely on blockchain settlement, custody, or tokenization infrastructure have a distinct set of planning questions separate from the protocol-level migration debate.

1. Inventory exposed public keys. Any address or account that has ever signed an outgoing transaction has revealed its public key on-chain permanently; institutions should know exactly which of their holdings sit in exposed addresses versus unexposed, hash-only addresses.
2. Plan custody key rotation ahead of the network’s own timeline. Institutional custodians do not need to wait for a network-wide hard fork; funds can often be proactively moved to fresh, unexposed addresses as an interim mitigation well before any formal post-quantum address format ships.
3. Track validator and node software upgrade paths separately from application-layer wallet upgrades. A financial institution running its own validator or full node needs a different upgrade runway than one simply holding assets through a custodian’s wallet.
4. Model the impact of larger transaction sizes on fee budgets. Post-quantum signatures are meaningfully larger, and any institution processing high transaction volumes should model how that affects operating costs once hybrid or post-quantum-only signatures become standard.
5. Coordinate with custodians and exchanges on their own migration timelines. Because most retail and institutional holders interact with blockchains through custodians and exchanges rather than running their own nodes, an institution’s actual exposure timeline often depends more on its custodian’s readiness than on the underlying protocol’s official rollout.

Consensus-Layer Signatures Are a Separate Problem From Wallet Signatures

Migration discussions tend to focus heavily on wallet and transaction signatures, but proof-of-stake networks have an equally critical dependency on validator signatures used to attest to blocks and finalize consensus. These validator signatures are produced far more frequently than user transactions, often multiple times per epoch across thousands of validators, which means the size and verification-speed overhead of post-quantum signatures hits this layer even harder than it hits ordinary wallet transactions. Aggregatable signature schemes, which currently let networks combine many validators’ individual signatures into one compact proof, do not have mature, standardized post-quantum equivalents yet, and this is widely considered one of the harder open research problems in the entire blockchain post-quantum migration effort, distinct from and arguably more difficult than the wallet-signature question that dominates public discussion.

Common Mistakes and What Actually Worked

Frequently Overlooked Details

• Hash-based addresses are already quantum-resistant todayAny address that has never sent an outgoing transaction is protected by the underlying hash function rather than the exposed public key, meaning a large share of dormant holdings are already safe without any protocol change at all.
• Signature aggregation lacks mature post-quantum supportProof-of-stake validator networks rely heavily on aggregatable signatures to keep consensus overhead manageable, and this specific capability does not yet have a widely standardized post-quantum equivalent, making validator-layer migration harder than wallet-layer migration.
• Custodians can act ahead of the protocolInstitutional custodians are not required to wait for a network-wide hard fork before reducing exposure; proactively rotating client funds into fresh, unused addresses is available today as an interim mitigation.
• Transaction size growth affects fee markets, not just storageBecause post-quantum signatures are an order of magnitude larger than ECDSA signatures, networks adopting them broadly will see real pressure on block size limits and transaction fees, not just long-term ledger storage growth.
• Exchange and custodian readiness often matters more than protocol readinessBecause most holders interact with blockchains through an exchange or custodian rather than a self-hosted wallet, an individual holder’s actual exposure timeline is frequently set by that intermediary’s migration schedule rather than the underlying network’s official rollout date.

Glossary

ML-DSA (FIPS 204)

A lattice-based digital signature algorithm finalized by NIST in August 2024 as a primary post-quantum replacement for ECDSA and RSA signatures, offering strong security guarantees against quantum attacks at the cost of larger signature and key sizes.

SLH-DSA (FIPS 205)

A stateless hash-based signature scheme standardized by NIST alongside ML-DSA, valued for relying only on the security of hash functions rather than newer, less battle-tested lattice assumptions, though with larger signatures and slower performance.

Pay-to-Merkle-Root (P2MR)

The address format introduced by Bitcoin’s BIP-360 proposal, which strips out the quantum-vulnerable key-path spend available in Taproot addresses in favor of a script-path structure compatible with post-quantum signature schemes.

Hybrid signature

A transitional signing approach requiring both a classical signature, such as ECDSA, and a post-quantum signature on the same transaction or message, providing defense in depth against either scheme failing independently.

Account abstraction

A blockchain design pattern, prominent in Ethereum’s roadmap, that decouples transaction validity rules from a single hard-coded signature algorithm, allowing individual accounts to adopt new signature schemes without requiring a network-wide hard fork.

FAQs

Can current quantum computers break Bitcoin or Ethereum today?

No. As of 2026, no existing quantum computer has the scale or error correction needed to run Shor’s algorithm against real-world elliptic curve keys used by Bitcoin or Ethereum. The concern is forward-looking: academic roadmaps estimate a cryptographically relevant quantum computer could emerge as early as 2027 to 2030, and migrating a live blockchain takes years of coordination.

What is BIP-360 and why does it matter?

BIP-360 is a Bitcoin Improvement Proposal, merged into the reference repository in February 2026, that introduces Pay-to-Merkle-Root, a new address format removing the quantum-vulnerable key-path spend available in Taproot addresses. It marks the first time quantum resistance has been formally placed on Bitcoin’s protocol roadmap.

Why are addresses that have already sent a transaction more vulnerable than ones that have not?

An address that has never sent funds only reveals a hash of its public key, which is not vulnerable to Shor’s algorithm. Once an address sends a transaction, it must reveal the actual public key on the permanent public ledger, exposing that key indefinitely to any future quantum attacker capable of deriving the corresponding private key.

How is Ethereum’s approach to quantum resistance different from Bitcoin’s?

Ethereum’s more centralized research and coordination process, combined with account abstraction that lets individual accounts adopt new signature schemes independently, gives it a more flexible, phased migration path. Bitcoin’s more conservative, consensus-driven governance model favors caution and broad agreement, which tends to produce a slower but more stable migration timeline.

What is a hybrid signature and why is it the preferred near-term approach?

A hybrid signature requires both a classical signature, such as ECDSA, and a post-quantum signature on the same transaction. This provides defense in depth: if the post-quantum scheme has an undiscovered flaw, the classical signature still protects the transaction, and if elliptic curve cryptography falls to a quantum attack first, the post-quantum signature remains secure.

Do post-quantum signatures make blockchain transactions more expensive?

Generally yes, at least initially. ML-DSA signatures run roughly 2.4 to 4.6 kilobytes compared with 64 to 72 bytes for ECDSA, and larger transactions place more pressure on block size limits and fee markets, which is a significant factor in how carefully migration proposals are being designed and phased in.

Why is validator signature migration harder than wallet signature migration?

Proof-of-stake validator networks rely on aggregatable signatures to combine many validators’ attestations into one compact proof, keeping consensus overhead low. Mature, standardized post-quantum equivalents for this aggregation capability do not yet exist, making the consensus layer a harder and slower migration problem than ordinary wallet transactions.

What should an institution holding crypto assets do right now, before any formal migration happens?

Institutions should inventory which addresses have ever revealed a public key on-chain by sending a transaction, and consider proactively rotating funds into fresh, unused addresses as an interim mitigation. This does not require waiting for a network-wide hard fork and can meaningfully reduce exposure ahead of any official post-quantum address format.

• bip360.org, “BIP 360: Pay-to-Merkle-Root (P2MR)”
• bips.dev, “BIP 361: Post Quantum Migration and Legacy Signature Sunset”
• crypto.news, “Bitcoin Is Going Quantum-Proof: Inside BIP-360 and the Migration,” 2026
• CryptoSlate, “Bitcoin’s Quantum Migration Plan Forces the Network to Choose Between Frozen and Stolen Coins,” 2026
• TradingView / Cointelegraph, “Bitcoin May Take 7 Years to Upgrade to Post-Quantum: BIP-360 Co-Author,” 2026
• Hedera, “Post-Quantum Cryptography and Blockchain,” hedera.com/blog
• Blockchain Council, “Quantum-Resistant Blockchain Security Guide,” blockchain-council.org
• arXiv preprint, “A Survey on Security with Quantum Computing,” arxiv.org/abs/2606.00058

Blockchain signature migration sits inside the broader post-quantum transition covered in our guides to NIST post-quantum cryptography standards and post-quantum cryptography migration more generally. Because no single blockchain will finish its migration on the same schedule, maintaining crypto-agility across custody and settlement infrastructure matters just as much as the protocol changes themselves, and the exposed-key dynamic discussed above is really a specific case of the wider harvest-now-decrypt-later threat facing any long-lived public key.