Neptune Cash Community
Get started

Which cryptocurrencies survive a quantum computer?

Very few cryptocurrencies would survive a large enough quantum computer, and not the ones most people hold. Bitcoin, Ethereum and nearly every other major chain rely on elliptic-curve signatures that such a machine can break. Just two of the twelve graded below protect every user with hash-based cryptography.

30.2%

of issued bitcoin sits in outputs whose public key is already published

A measure of key visibility, not of coins an attacker could take tomorrow. The exposure map explains the difference.

Glassnode, 20 May 2026 (opens in new tab)

~1,200

logical qubits estimated to break 256-bit elliptic-curve cryptography

A March 2026 resource estimate for the discrete logarithm on a 256-bit curve, roughly a tenfold improvement on earlier work. No machine of that quality exists.

Google Quantum AI, 31 Mar 2026 (opens in new tab)

2029

earliest publicly stated target for a fault-tolerant quantum computer

IBM’s roadmap target for Starling. A vendor date, and the one most migration schedules are implicitly racing. It is not a date on which anything breaks.

IBM Quantum roadmap (opens in new tab)

1979

the year it was shown a one-way function alone can authenticate a message

Lamport built signatures from nothing but a one-way function, fifteen years before Shor’s algorithm gave anyone a reason to want them. What protects funds on the two chains at the top of this board still reduces to that one assumption, by different routes, even where other parts of their designs do not.

Lamport, SRI International CSL-98, October 1979 (opens in new tab)

The verdict

One standard, four tiers, twelve chains. Quantum-resistant and post-quantum mean the same thing here, and a chain earns the label from what protects ordinary user funds on mainnet today. Roadmaps, testnets and target dates never move a chain into a protected tier, however credible they are, though they do separate a chain that is working on the problem from one where no public plan was found. Within a tier, chains are listed longest-deployed first, or alphabetically where nothing is deployed.

Post-quantum by design

Spending ordinary funds requires a primitive believed to resist known quantum attacks, for every user, by default, on mainnet today. No opt-in step and no migration needed.

Partially post-quantum

A post-quantum way to hold and spend ordinary funds is live on mainnet and has actually been used there, but it is opt-in and is not what protects the default account. Includes smart-contract and account-abstraction routes that need no protocol change.

Vulnerable — migration under discussion

Nothing deployed protects ordinary funds from a quantum attacker, but a public migration effort exists: a proposal, a research programme, a testnet, a mainnet experiment, or an announced target.

Vulnerable — no public plan found

Nothing deployed protects ordinary funds, and searching the project’s documentation, proposal repositories, development repositories and roadmap surfaced no qualifying public migration plan on the verification date. This describes our search, not the project’s intentions.

Why a quantum computer breaks some cryptography and not other

Two quantum algorithms matter, and they do very different amounts of damage. Almost every disagreement about this subject comes from treating them as one threat.

Shor’s algorithm is the one that breaks things

Published in 1994, it efficiently solves the two problems public-key cryptography is built on: factoring large integers, and computing discrete logarithms in a group, including on an elliptic curve. Given a public key, a large enough quantum computer recovers the private key. Every elliptic-curve signature scheme on this page falls to it, whether it is called ECDSA, Schnorr, Ed25519, BLS or RedDSA. There is no partial credit and no parameter you can increase to escape.

Grover’s algorithm is the one that does not

It searches an unstructured space of size 2n in roughly 2n/2 steps: a quadratic speedup, not an exponential one. Against a well-sized hash function that halves the effective security level and leaves it comfortable, which is why standards bodies treat appropriately sized hashes as usable after quantum computers exist. It is also why proof-of-work mining is not the emergency here: Grover makes mining somewhat cheaper, not free, and cheaper mining is an economics problem rather than a way to take anyone’s coins.

So hash-based constructions survive

Anything drawing its security from hash functions alone inherits Grover’s modest speedup instead of Shor’s total break, and that is the whole reason the top tier of the verdict board looks the way it does. It need not be a signature scheme: proving you know the preimage of a published digest authenticates a payment just as well. The historical problem with these constructions was never security, it was practicality, and what changed is that chains were finally built around the awkward shapes they impose, such as keys that may only be used once, or signatures measured in kilobytes.

The decisive question is what the chain publishes

Shor’s algorithm needs a public key to work on. Whether a chain hands one over, and when, is therefore the difference between a theoretical risk and a live one, and it varies more between chains than almost anything else. That question gets its own section below, because it is also the one most coverage gets wrong.

None of this says when a capable machine will exist, and this page does not forecast that. It compares what has been built against what has been publicly targeted, which is the part that can actually be checked.

The race

One axis, two rows. Above it, what the outside world has done and said it will do about the arrival of a capable machine, the moment the industry calls Q-Day. Below it, what chains have shipped and what they have promised. The shape of the picture is that most of the second row sits to the right of most of the first.

Off the left edge: QRL mainnet launches (Jun 2018). The axis starts in 2024 because everything else on it does.

  • Deployed or published
  • Proposed
  • Experimental
  • Targeted

Quantum and standards milestones

  1. Aug 2024 NIST finalises FIPS 203, 204, 205 published Eight years of open competition end in approved replacements.
  2. Nov 2024 NIST IR 8547 draft proposed First public draft of the US transition timetable, and still only a draft.
  3. Mar 2026 Google Quantum AI estimate proposed Cuts the estimated cost of breaking elliptic curves by roughly tenfold.
  4. 2029 IBM Starling target targeted IBM’s target for a fault-tolerant machine of about 200 logical qubits, several times short of what the March estimate says breaking an elliptic curve needs.
  5. 2030 Legacy public-key crypto deprecated targeted The NIST draft’s proposed date. Full disallowance is proposed for 2035.

Chain deployments and targets

  1. Jun 2018 QRL mainnet launches deployed Hash-based signatures protecting ordinary funds by default, from day one.
  2. Jan 2025 Solana Winternitz Vault deployed An opt-in hash-based vault, deployed as an ordinary program with no fork.
  3. Feb 2025 Neptune mainnet launches deployed Hash-based spending and hash-based proofs, on by default.
  4. Nov 2025 Algorand Falcon accounts deployed A Falcon verification opcode, and the first post-quantum mainnet spend.
  5. Feb 2026 BIP-360 and BIP-361 reach Draft proposed Bitcoin’s two quantum-migration proposals. No Bitcoin Core implementation.
  6. Apr 2026 Dogecoin mainnet experiment experimental A post-quantum proof riding alongside an ECDSA-authorised spend.
  7. Jul 2026 Zcash Ironwood activates deployed Quantum-recoverable notes live. Spend authorisation stays elliptic-curve.
  8. H2 2026 XRPL phase 3 target targeted Candidate schemes on Devnet, explicitly not on mainnet.
  9. 2027 Algorand and Zcash targets targeted Algorand targets broad resilience; Zcash targets full post-quantum security.
  10. 2028 XRPL amendment target targeted Ripple’s stated date for native post-quantum signatures on the ledger.
  11. 2029 Ethereum layer-1 estimate targeted Foundation estimate for layer-1 upgrades. Accounts migrate for years after.

What each chain publishes about your key

Shor’s algorithm needs your public key. Chains differ in whether they publish it, and that difference decides whether ordinary advice about moving coins helps you or does nothing at all.

Address is the key

The address people share is itself the public key, or contains it. Every funded account is exposed from the moment it exists, whether or not it has ever spent.

Hashed until you spend

The address is a hash of the public key. The key becomes public the first time the account spends, and stays public afterwards.

Mixed

Different output or address types on the same chain behave differently, so exposure depends on which one holds the funds.

No vulnerable key

Nothing an attacker could run Shor’s algorithm against is published, because the authority to spend is not an elliptic-curve key in the first place.

Bitcoin is the only chain here with a measured figure

Zcash is mixed too, but no comparable measurement of its transparent share was found. The meter splits 6.04M BTC of exposed supply by why it is exposed, because the two halves have different remedies.

Structural 9.6% 1.92M BTC
Output types that publish the key by design: the earliest pay-to-public-key coins, bare multisig, and every Taproot output. No user behaviour can hide these.
Behavioural 20.6% 4.12M BTC
Output types that would have hidden the key behind a hash, exposed anyway by reusing an address after spending from it. Around 1.63M BTC of this sits with exchanges.
Not exposed 69.8% 13.99M BTC
Outputs whose key is still behind a hash. Safe only until they are spent, and only if the address is never reused afterwards.

What this figure is not: a count of coins a quantum attacker could take. It answers one question, “has the public key already been published?”, and its authors are explicit that it is not a forecast, a probability, or a claim of immediate risk. Other published estimates disagree because they answer different questions; see Bitcoin’s assessment for where they diverge. Measured 20 May 2026 by Glassnode (opens in new tab).

The evidence, chain by chain

Each entry holds the reasoning behind its grade, what would change it, and the sources it was built from. Facts already shown above are linked rather than repeated. Every entry is separately linkable.

Post-quantum by design

Quantum Resistant Ledger

QRL
What secures ordinary user funds today
XMSS, a stateful hash-based signature scheme standardised in IETF RFC 8391 and approved in NIST SP 800-208. It is the only way to sign a QRL transaction; there is no elliptic-curve option to fall back to.
Public-key exposure
XMSS publishes one-time public keys as it signs, but they are hash-based, so publishing them exposes nothing Shor’s algorithm can use. The exposure question that dominates every elliptic-curve chain here simply does not apply.
Consensus and state proofs
Proof-of-work. Grover’s algorithm gives at most a quadratic speedup against the mining search, which changes the economics of mining rather than the safety of held funds.
Privacy under quantum attack
No privacy layer. Balances and transfers are public, and they stay equally public before and after a quantum computer exists.
Migration deployed
None needed for user funds. The successor chain, QRL 2.0 / Zond, moves to ML-DSA-87 and proof-of-stake, but that is a new network rather than a rescue of this one.
Why this grade

QRL is the oldest of the chains graded here to have shipped a post-quantum default. It has been signing every mainnet transaction with a hash-based scheme since 2018, which is longer than most of the migration plans on this page have existed. Its primitives are also the most conservative in the top tier: XMSS is built on SHA-256, a hash with roughly a quarter-century of public cryptanalysis behind it, and it carries both an IETF specification and a NIST approval. Judged strictly on the question this page asks, nothing here is aspirational.

Caveats and limitations
  • XMSS is stateful. Each one-time key may be used exactly once, and a wallet that loses track of its index and reuses a key can leak enough to forge signatures. This is a real operational hazard that stateless schemes do not have, and it is a property of the design rather than a bug.
  • The network is small. A chain this size has correspondingly modest proof-of-work behind it, which is a security consideration independent of anything quantum.
  • QRL 2.0 / Zond has been in testnet for years and the project states it has not set a mainnet date, pending audits. Nothing about the successor chain should be read as protecting funds on the current one.
What would change the grade

A break in SHA-256 preimage resistance, or a demonstrated practical attack on XMSS as specified. Neither is on the horizon. A migration of mainnet to Zond would change what is being graded rather than the grade.

Sources

Neptune Cash

NPT
What secures ordinary user funds today
A lock script that, by default, asserts knowledge of a preimage to a hardcoded Tip5 digest, proved inside a Triton VM STARK. Both the lock and the proof system are hash-based, so no elliptic-curve secret stands between an attacker and the coins.
Public-key exposure
Addresses are not published on the chain; what appears is a commitment plus an encrypted announcement. There is no elliptic-curve public key protecting spending authority to expose in the first place.
Consensus and state proofs
Proof-of-work over Tip5, and block validity is certified by a STARK proof rather than by replaying transactions. STARKs rest on hash-based assumptions rather than elliptic-curve ones, so the consensus layer inherits the same quantum posture as the spending layer.
Privacy under quantum attack
Confidentiality is the one place the answer is not uniform. Generation addresses encrypt the payment notice with a lattice-based scheme and are quantum-safe. EC hybrid addresses use an elliptic-curve key exchange: an attacker holding a quantum computer *and* the address could read what that address received, though still not spend it. Viewing addresses can be read by anyone who has the address. The project documents all three.
Migration deployed
None needed for user funds. Two consensus hard forks have shipped, neither for cryptographic reasons.
Why this grade

Neptune is the cleanest structural answer on this page and the least proven one, and both halves of that sentence matter. Structurally it is unusually complete: spending authority, the proof system, the commitment scheme and the mining puzzle are all hash-based, so there is no partial migration to plan and no exposure window to reason about. That completeness is why it sits in the top tier. But the two chains in this tier are not equally proven. Its hash function is far younger than QRL’s.

Caveats and limitations
  • Tip5 is a novel algebraic hash function, published in 2023 and designed to be cheap to verify inside a STARK rather than to resemble SHA-256. Its public cryptanalytic history is short: one third-party paper, in late 2024, against a reduced-round variant. Roughly three years and a single paper is thin scrutiny next to the quarter-century behind SHA-256, and what protects funds on Neptune reduces to this one function.
  • The lattice-based encryption behind generation addresses did not go through a public standardisation process like the NIST-standardised lattice schemes other projects are adopting, and has had correspondingly less public cryptanalysis. It was selected for native compatibility with the field Triton VM works over, not for depth of public review.
  • Proof-of-work behind the chain is small in absolute terms, so the cost of attacking consensus is low compared with larger chains. That is a conventional security consideration and has nothing to do with quantum computing.
  • The strongest privacy option, the generation address, is the long one. Users who choose the shorter EC hybrid format trade quantum-safe confidentiality for length, while keeping quantum-safe protection against theft.
What would change the grade

Cryptanalysis reaching full-round Tip5, or a preimage attack on it, would move Neptune out of this tier immediately, because there is no second primitive underneath. Sustained third-party cryptanalysis that continues to leave full-round Tip5 unbroken, and enough of it to compare with what SHA-256 has absorbed, is what would close the gap to QRL.

Sources

Partially post-quantum

Solana

SOL
What secures ordinary user funds today
Ed25519 by default. Separately, the Winternitz Vault, an on-chain program live since January 2025, lets a user hold SOL under a Winternitz one-time signature over truncated Keccak-256. Spending it means revealing a one-time signature and moving the remainder to a fresh vault.
Public-key exposure
A Solana address is the Ed25519 public key. Every funded default account is exposed from creation.
Consensus and state proofs
Not protected. Validator identities, votes and leader scheduling are Ed25519-based.
Privacy under quantum attack
No privacy layer. Balances and transfers are public.
Migration proposed
The Solana Foundation published a phased plan in April 2026: continued evaluation of Falcon and alternatives, post-quantum schemes for new wallets if needed, then migration of existing ones. No dated commitment to a protocol-level switch was found.
Why this grade

Solana clears the opt-in bar on the same evidence Algorand does, by a different route: no new opcode, just a program deployed under the existing runtime. That is the strongest form of this claim, because it means the capability cannot be taken away by a governance failure. What it does not mean is that Solana is protected. The vault has been available for over eighteen months and reporting in April 2026 put adoption at fewer than three hundred accounts, which is a rounding error against the chain’s account count. It also carries a real ceiling: Solana’s 1,232-byte transaction limit forces hash truncation, and the vault’s own documentation puts the resulting post-quantum security at 176 bits rather than the 256 the scheme could otherwise offer.

Caveats and limitations
  • Winternitz signatures are one-time. The vault design handles this by splitting into fresh vaults on every spend, which works, but it makes the account model unfamiliar and the failure mode of reuse severe.
  • The 176-bit figure is a consequence of the transaction size limit. A pending proposal to raise that limit to 4,096 bytes would remove the constraint; until it lands, the ceiling is real.
  • The adoption figure comes from secondary reporting rather than an on-chain measurement we performed. Treat it as an order of magnitude, not a count.
  • Because a Solana address is the public key, an account that has never transacted is exposed exactly as much as one that transacts daily. The advice that helps Bitcoin holders does not transfer here.
What would change the grade

Native post-quantum signature support at the protocol level, or wallet defaults that route ordinary balances through a post-quantum construction, would move Solana up. A published on-chain measurement of vault adoption would sharpen this entry either way.

Sources

Algorand

ALGO
What secures ordinary user funds today
Ed25519 by default, which Shor’s algorithm breaks. Since AVM v12 added the falcon_verify opcode, a user can instead hold funds in a logic-signature account whose spending condition is a Falcon signature, a NIST-selected hash-and-sign lattice scheme. That route needed no consensus change and works on mainnet today.
Public-key exposure
An Algorand address is the Ed25519 public key, base32-encoded with a checksum. Every funded default account is therefore exposed from creation, spent or not.
Consensus and state proofs
Not protected. Block proposal and voting use Ed25519, and the verifiable random function that selects committees is elliptic-curve based. The project says a post-quantum VRF is a research problem it expects to present on in 2027.
Privacy under quantum attack
No privacy layer. Balances and transfers are public.
Migration targeted
A published roadmap targets broad quantum resilience by the end of 2027, with milestones beginning in Q3 2026. State Proofs, which compress and attest to ledger history, have been Falcon-signed since 2022; that protects the chain’s record of the past, not the coins in your account.
Why this grade

Algorand is the chain most often described as already quantum-safe, and that description is wrong in a specific and instructive way. Falcon has been in the protocol since 2022, but it was signing State Proofs: certificates that let an outside party verify Algorand’s history without trusting anyone. That is a real post-quantum component and it protects the wrong thing for this page’s question. What changed in November 2025 is narrower and more relevant: a Falcon verification opcode landed in the AVM, and the protocol team executed a post-quantum transaction on mainnet using it. Ordinary users can now put funds behind a Falcon key. Almost none do, it is not the default, and the consensus layer underneath is still elliptic-curve. Partially post-quantum is the accurate description in both directions.

Caveats and limitations
  • The Falcon route is a logic-signature construction, not a native account type. It carries the usual costs of that pattern: larger transactions, different tooling, and a smaller pool of software that understands it.
  • We found no measurement of how much ALGO is held behind Falcon accounts. The absence of a figure is itself a signal about adoption, but we are not going to invent one.
  • A quantum-safe account on a chain whose consensus is not quantum-safe is protected against having its coins stolen, not against the ledger recording those coins being subverted. These are different risks and both are real.
What would change the grade

Falcon accounts becoming the default for new wallets would move Algorand toward the top tier. Delivering the post-quantum VRF and consensus signatures would address the dimension the current capability leaves open.

Sources

Vulnerable — migration under discussion

Bitcoin

BTC
What secures ordinary user funds today
ECDSA over secp256k1 for legacy and SegWit outputs, and Schnorr over the same curve for Taproot. Shor’s algorithm breaks both. Nothing post-quantum is deployed in Bitcoin’s consensus rules.
Public-key exposure
This is the chain where the distinction matters most, and where it is genuinely mixed. P2PKH and P2WPKH outputs hash the key and reveal it only when spent. P2PK, bare multisig and Taproot commit to or reveal the key in the output itself. Reusing an address after spending from it re-exposes the remainder.
Measured exposure
The only chain here with one. It is broken down, with its methodology and its limits, in the exposure map above; the short version is that it counts keys already published, not coins anyone could take.
Consensus and state proofs
Proof-of-work over SHA-256. Grover’s algorithm offers at most a quadratic speedup, which is a mining-economics question rather than a threat to held funds.
Privacy under quantum attack
No protocol-level privacy. Nothing about a quantum computer makes the existing transparency worse; the chain is already public.
Migration proposed
Two draft BIPs and no implementation in Bitcoin Core. BIP-360 proposes an output type that removes Taproot’s key-path spend. BIP-361 proposes a two-phase sunset of legacy signatures. Both are Draft. Bitcoin’s consensus rules have not changed since Taproot activated in 2021.
Why this grade

Bitcoin has the most attention on this problem and the least deployed. That is not a contradiction: its change process is deliberately slow, and the same conservatism that makes it hard to break makes it hard to upgrade. Two things complicate the usual story. First, the exposure figure everyone quotes is a measure of key visibility, not of coins an attacker could take tomorrow, and the gap between those two readings is large. Second, a research result published in April 2026 argues that a quantum-safe spend is already constructible inside Bitcoin’s existing Script rules, using hash puzzles and Lamport signatures rather than elliptic curves, at a cost the author puts at roughly $75–$150 of off-chain compute per spend. We tested Bitcoin against the same opt-in exception that put Algorand and Solana in the tier above, and it does not clear it: the author’s own repository records on-chain broadcast as not yet attempted, and the work is a preprint with assembly still unfinished rather than working wallet software.

Caveats and limitations
  • A substantial share of exposed coins sits in wallets that have not moved in over a decade and whose owners may be unreachable. Those coins cannot be migrated by any plan, only frozen or left to be taken, which is why BIP-361 has to argue about sunsetting valid signatures at all.
  • Published exposure estimates disagree. BIP-361 cites over 34% as of 1 March 2026 without stating a methodology; a widely reported analysis attributed to CoinShares puts near-term risk at around ten thousand BTC. These are not contradictions so much as answers to different questions, which is exactly why an unqualified percentage is the wrong thing to repeat.
  • A BIP merged into the repository means it met documentation standards for discussion. It is not endorsement, scheduling, or an implementation.
  • Taproot outputs reveal the key by construction. The common advice to "use a fresh address" protects P2PKH-style outputs and does not protect Taproot ones.
What would change the grade

A post-quantum output type activated on mainnet, with wallet support, would move Bitcoin to partially post-quantum. Working, audited software making the no-fork technique usable, and a demonstrated mainnet spend, would do the same by a different route.

Sources

Cardano

ADA
What secures ordinary user funds today
Ed25519 signatures. Shor’s algorithm breaks them. Nothing post-quantum is deployed.
Public-key exposure
A Cardano address is built from hashes of the payment and staking keys, so keys are revealed on first spend rather than at creation. We found no published measurement of the resulting exposed share.
Consensus and state proofs
Not protected, and structurally harder than most. Ouroboros elects slot leaders with an elliptic-curve verifiable random function, and uses key-evolving signatures whose forward security also rests on elliptic curves. Replacing a VRF is a research problem, not an engineering task, which is why it appears as a research deliverable rather than a roadmap item.
Privacy under quantum attack
No protocol-level privacy. Balances, delegation and the transaction graph are all public.
Migration proposed
A funded research programme rather than a migration schedule. The 2026 cycle published by Input Output targets a post-quantum VRF design, an end-to-end security proof for a revised Ouroboros, a prototype, and a migration strategy published as an improvement proposal. Zero-knowledge-assisted address migration is under consideration.
Why this grade

Cardano is doing the most academically serious work here and has the least to show a user. Both facts follow from the same choice. The project is building post-quantum replacements for its core primitives from the bottom up, with security proofs, rather than bolting an opt-in scheme onto the existing chain, and it is honest that the output for 2026 is papers, prototypes and proposals. That approach may well produce the most defensible migration on this page. It also means an ADA holder today has exactly the same protection as an ADA holder in 2020, which is none. We have graded the second fact, because that is what this page grades.

Caveats and limitations
  • A research deliverable at technology readiness level five is a long way from a mainnet amendment. No dated target for user-fund protection was found.
  • Cardano’s consensus dependency on an elliptic-curve VRF is a genuine additional obstacle that chains with simpler leader selection do not face. That is a reason the timeline is long, not an excuse for the current state.
  • The programme is published by Input Output, a company contracted to develop Cardano, rather than by an independent body.
What would change the grade

Any deployed mainnet capability to hold ADA under a post-quantum key, whether native or via Plutus scripts. On the consensus side, a published and reviewed post-quantum VRF would be the first real milestone.

Sources

Dogecoin

DOGE
What secures ordinary user funds today
ECDSA over secp256k1, inherited from Bitcoin via Litecoin. Shor’s algorithm breaks it. Nothing post-quantum is deployed in consensus.
Public-key exposure
Dogecoin uses Bitcoin’s hashed output types, so keys are revealed on spend and address reuse re-exposes the remainder. No published measurement of the exposed share of DOGE was found.
Consensus and state proofs
Proof-of-work over Scrypt, merge-mined with Litecoin. Quadratic speedup only; not a threat to held funds.
Privacy under quantum attack
No privacy layer.
Migration experimental
An experiment, not a deployment, and the distinction is unusually easy to blur here. In April 2026 the Dogecoin Foundation confirmed that a core developer had put a post-quantum proof onto a mainnet transaction, without any layer-1 change. Development continues in the project’s library implementation alongside a draft improvement proposal. No formal proposal has been accepted and no consensus change is scheduled.
Why this grade

This one deserves care, because "Dogecoin did a post-quantum transaction on mainnet" is technically true and easy to misread. What happened is that a quantum-safe proof was attached alongside a normal transaction. The transaction was still authorised by an ECDSA signature; the proof rode along as extra data. That is a genuinely useful step, because it exercises the tooling and the encoding on a live network, and it is not protection: an attacker who can break ECDSA can spend the output regardless of what proof accompanies it. Set against the chains that cleared the opt-in bar, the difference is concrete. On Algorand and Solana the post-quantum object is what authorises the spend. On Dogecoin it is a passenger.

Caveats and limitations
  • The confirmation came through a Foundation director’s social media post and follow-up reporting rather than a technical write-up or a merged specification. We could not locate a primary specification of what was demonstrated.
  • Dogecoin’s consensus rules are downstream of Bitcoin’s codebase and its mining is bound to Litecoin’s. Its options are shaped by decisions taken elsewhere.
  • Nothing found indicates funded, continuous development toward a deployed migration, as distinct from experimental work by individual contributors.
What would change the grade

An accepted improvement proposal with an implementation, or a mainnet output type where the post-quantum proof is what authorises the spend rather than accompanying it.

Sources

Ethereum

ETH
What secures ordinary user funds today
ECDSA over secp256k1 for externally owned accounts. Shor’s algorithm breaks it. No post-quantum signature scheme is deployed in Ethereum’s layer-1 protocol.
Public-key exposure
An Ethereum address is a truncated hash of the public key, so an account that has never sent a transaction hides its key. In practice almost every account holding value has sent one. We found no published measurement of the resulting share of ETH behind exposed keys, and did not estimate one.
Consensus and state proofs
Not protected. Validators sign with BLS over a pairing-friendly curve, which Shor’s algorithm also breaks, and the blob data availability scheme uses KZG commitments with the same dependency.
Privacy under quantum attack
No protocol-level privacy at layer 1.
Migration proposed
The most detailed programme of any chain here, and none of it is live. The Ethereum Foundation created a dedicated post-quantum team in January 2026 and publishes progress openly: hash-based validator signatures, a proof system to aggregate them, and post-quantum data availability. The stated estimate is that layer-1 protocol upgrades could be complete by 2029, with execution-layer account migration running years past that.
Why this grade

Ethereum is the closest chain on this page to the tier above, and the reason it does not cross is worth stating precisely, because it is the one grading call here most likely to be contested. Account abstraction is live on mainnet, and it lets a smart account define its own signature validation, so a post-quantum account is architecturally possible today with no protocol change. That is a genuine capability and it is one Bitcoin structurally does not have. But we applied the same test we applied to Algorand and Solana: is the capability not just available but exercised on mainnet? Reference implementations exist in Foundation-adjacent repositories, and a research proposal puts an EVM-optimised hash-based verifier at roughly 127,000–150,000 gas, but as of the verification date we found no publicly documented verifier contract deployed, and no accounts holding funds under post-quantum-only validation. Available and unexercised is a real state, and we have graded it as such rather than resolving it in either direction. Ethereum is also the only chain here where the consensus layer’s exposure is arguably more urgent than the accounts’.

Caveats and limitations
  • This is the entry most sensitive to new evidence. A single well-documented mainnet deployment would move Ethereum to partially post-quantum, and we would expect that to happen before the protocol-level work lands.
  • That estimate is the Foundation’s own, and it is an estimate rather than a schedule or a completion date for user accounts. The Foundation is explicit that execution-layer migration continues well beyond it.
  • Account abstraction shifts the burden to wallet software. A post-quantum smart account is only as good as the wallet that manages it, and no widely used wallet defaults to one.
  • Many layer 2s reuse Ethereum’s account cryptography and add dependencies of their own, in sequencers, bridges and proof systems. Nothing here is a statement about rollups.
What would change the grade

A deployed, usable post-quantum smart account holding real funds on mainnet moves Ethereum up immediately. A precompile for post-quantum verification, or hash-based validator signatures shipping, would each address a different dimension.

Sources

Monero

XMR
What secures ordinary user funds today
CLSAG ring signatures over Ed25519, with one-time output keys derived by elliptic-curve arithmetic. Shor’s algorithm breaks the underlying discrete logarithm, and with it both spending authority and the ring construction that hides which output was spent.
Public-key exposure
Every Monero output carries a one-time public key on the chain, and addresses contain view and spend public keys. There is no variant of the address model that hides a key behind a hash, so exposure is structural and complete.
Consensus and state proofs
Proof-of-work over RandomX. Grover’s algorithm gives at most a quadratic speedup, which is a mining question rather than a threat to funds.
Privacy under quantum attack
This is where Monero differs from every transparent chain on the page, and it is the reason its entry is not simply "vulnerable like the rest". Ring signatures and stealth addresses hide the sender and recipient using elliptic-curve assumptions. An attacker who can compute discrete logarithms can attack that privacy retroactively, against transactions already recorded, because the chain has been archiving the ciphertext of those assumptions since 2014. Funds can be moved out of reach; a spending history cannot be unpublished.
Migration proposed
Research, not deployment, and less of it than the size of the problem suggests. Monero Research Lab has open investigations into lattice-, hash- and isogeny-based approaches, and a post-quantum addressing scheme is under design. No mainnet activation is scheduled and no dated migration plan was found.
Why this grade

We checked Monero’s deployed state against its source rather than against reporting, because the reporting is unreliable here. Several 2026 articles describe Seraphis or FCMP++ as having activated on mainnet. Monero’s hard fork table in the reference implementation shows the network still at fork version 16, activated in 2022, and released binaries remain on the 0.18 series. Neither upgrade has activated. It would not change the grade if they had, because neither was designed as a post-quantum replacement and neither removes the Ed25519 dependency, but the discrepancy matters for anyone trying to reproduce this assessment. The substantive point is that Monero carries a risk no transparent chain does: where the ledger is transparent, a quantum computer threatens what you still hold, and moving coins is a remedy. For Monero it also threatens what you already did, and nothing you do now is a remedy for that.

Caveats and limitations
  • The retroactive de-anonymisation risk is a property of the cryptographic construction, not a prediction. Its severity depends on whether a capable machine ever exists, and its scope depends on which construction was in use when a given transaction was made. Forward-secrecy work in newer designs would limit future exposure, not past.
  • A quantum attacker able to compute discrete logarithms could also forge the commitments that keep amounts confidential, which would make undetectable inflation possible. That is a supply-integrity risk on top of a privacy and theft risk.
  • Monero has no foundation with a budget and a roadmap; work happens through a community funding system. That produces excellent research and no schedule, and it makes "no dated plan" a description of the governance model rather than a criticism of any individual.
What would change the grade

A post-quantum spend authorisation scheme activated on mainnet. For the privacy dimension specifically, nothing that ships in future can restore the confidentiality of transactions already on the chain, so that part of the assessment can only ever get worse or stay the same.

Sources

XRP Ledger

XRP
What secures ordinary user funds today
Exactly two schemes, both broken by Shor’s algorithm: ECDSA over secp256k1, and EdDSA over Ed25519. The ledger’s own documentation states there are no immediate plans to add a quantum-resistant algorithm, a passage written in 2020 and still standing.
Public-key exposure
An XRPL address is a hash of the public key, so the key is revealed on first spend rather than at creation.
Consensus and state proofs
Not protected. The consensus protocol’s validator signatures use the same elliptic-curve schemes.
Privacy under quantum attack
No privacy layer. Balances and transfers are public.
Migration targeted
A four-phase plan published by Ripple in April 2026, targeting native post-quantum signatures via a network amendment no later than 2028. Phase 2, benchmarking NIST algorithms against real workloads, was described as active in the first half of 2026, with ML-DSA signatures deployed on an internal test network. Phase 3 would put candidate schemes on Devnet in the second half of 2026, explicitly without touching mainnet.
Why this grade

XRPL is the clearest example on this page of the gap between a good plan and a deployed capability, and of one structural advantage that is easy to overlook. The advantage is real: XRPL has native key rotation, so an account can move to a different key without changing its address or its history. When a post-quantum scheme arrives, the migration path already exists and does not require users to abandon accounts. The gap is equally real: today there are two algorithms available and both are elliptic-curve, so key rotation currently means rotating from one breakable key to another. The 2028 target is a target. Ripple publishing it is more than most chains here have done, and it protects nobody’s funds yet.

Caveats and limitations
  • Ripple is a company with a large XRP position, and the roadmap is published by that company rather than by an independent foundation. That does not make it wrong; it is worth knowing when weighing a self-reported timeline.
  • The documentation passage declining to add a quantum-resistant algorithm predates the roadmap by years and has not been revised. When a project’s reference documentation and its blog disagree about direction, we grade the deployed code, which agrees with the documentation.
  • Key rotation helps a holder who is paying attention. It does nothing for an account whose owner has stopped watching, which is a large share of any long-lived ledger.
What would change the grade

An amendment activating a post-quantum signature type on mainnet. Failing that, a usable opt-in construction on mainnet would move XRPL to partially post-quantum on the same terms as Algorand and Solana.

Sources

Zcash

ZEC
What secures ordinary user funds today
Two different things, depending on where the coins sit. Transparent addresses use ECDSA over secp256k1, exactly as Bitcoin does. Shielded funds are authorised by RedDSA signatures and protected by Halo 2 proofs, both resting on elliptic-curve assumptions. Shor’s algorithm breaks both paths.
Public-key exposure
Transparent addresses behave like Bitcoin’s hashed outputs. Shielded outputs publish no spending key at all, which is a stronger position than any transparent chain here, and it is undone by the fact that the authorisation scheme itself is elliptic-curve.
Consensus and state proofs
Proof-of-work. The more interesting dependency is proof soundness: Halo 2 is a discrete-logarithm-based proof system, so an attacker who can compute discrete logarithms could forge proofs and, with them, supply. That is a chain-integrity risk, not only a user-funds risk.
Privacy under quantum attack
Shielded note encryption and the proofs that hide amounts and recipients both depend on elliptic curves, so shielded privacy is retroactively attackable in the same way Monero’s is. The July 2026 upgrade is explicit that it does not address quantum attacks on privacy.
Migration deployed
The only chain in this tier with a quantum-migration component actually running on mainnet. The Ironwood pool, activated with the NU6.3 upgrade at mainnet block 3,428,143 in July 2026, derives note commitment randomness by hashing all note fields, making commitments post-quantum binding. If elliptic-curve assumptions fail, the pool can be disabled and a Recovery Protocol used to get funds out, and that protocol is expected to remain secure against quantum adversaries. Full post-quantum security is targeted within 12 to 18 months of a May 2026 statement.
Why this grade

Zcash is the hardest call on this page and the one most likely to be argued with, so here is the reasoning in full. It has deployed something real: quantum-recoverable notes are live on mainnet, and that is more than any other chain in this tier can say. The question is what they protect. They make note commitments binding under a hash assumption, so a quantum attacker cannot forge notes or inflate supply, and they guarantee that legitimate holders can still get their money out after the community disables the quantum-vulnerable pools. What they explicitly do not do is protect spend authorisation, which still uses RedDSA. A quantum attacker facing a live Ironwood pool can steal from it. Recoverability is a fire exit, not a lock on the door, and this page grades the lock. Zcash therefore stays in this tier as its strongest member rather than moving up. A reasonable reader could weigh recoverability more heavily than we have; the evidence for either reading is the same and is linked below.

Caveats and limitations
  • The specification for quantum recoverability is still marked Proposed even though the upgrade carrying it has activated. That is a documentation lag rather than a contradiction, and it is the kind of thing that makes this entry worth re-checking.
  • Recovery depends on the community deciding to disable the quantum-vulnerable pools in time. It is a governance-dependent protection, and governance is the part of every migration on this page that has no cryptographic guarantee.
  • Recovery reaches Ironwood-pool notes only. ZIP 2005 states that funds still in the Sprout, Sapling or Orchard pools would be inaccessible once those protocols are disabled, so the protection depends on holders having moved in time. Transparent ZEC gets none of it either, and sits where Bitcoin’s does
What would change the grade

A post-quantum spend authorisation scheme on mainnet moves Zcash up. So would evidence that the Recovery Protocol can be exercised without first disabling the live pools, since that would make it a protection rather than a contingency.

Sources

Vulnerable — no public plan found

Litecoin

LTC
What secures ordinary user funds today
ECDSA over secp256k1 for ordinary outputs. MWEB, the optional privacy extension, uses Pedersen commitments and elliptic-curve blinding factors. Shor’s algorithm breaks both.
Public-key exposure
Litecoin uses Bitcoin’s hashed output types, so keys are revealed on spend. MWEB outputs do not publish a conventional address, but their commitments rest on the same curve. No published measurement of the exposed share of LTC was found.
Consensus and state proofs
Proof-of-work over Scrypt. Grover halves the effective search, which moves mining costs and nothing about custody.
Privacy under quantum attack
MWEB hides amounts and breaks the link between inputs and outputs, using elliptic-curve commitments. A quantum attacker could attack that privacy, and could also forge the commitments that keep amounts honest, which would make undetectable inflation possible inside the extension block.
Migration unknown
None found. Searching the project’s documentation, development repositories and public statements as of the verification date surfaced no qualifying migration plan, no funded effort, and no target date. This is a description of our search, not a claim about anyone’s intentions.
Why this grade

Litecoin is in this tier because of a specific and unusually well-documented gap between a claim and its own developers’ assessment. In November 2025 Litecoin’s official account described MWEB addresses as quantum resistant. In June 2026, at the project’s own summit, MWEB’s lead developer told the audience that no cryptocurrency is quantum safe, that anyone saying otherwise about undetectable inflation in MWEB was lying, and, asked about post-quantum MWEB, that his guess was as good as anyone’s. We are taking the developer’s account over the marketing account, and we would do the same for any project here. There is one real technical point buried in it: MWEB inherits switch commitments from Mimblewimble, which would give post-quantum binding of amounts and so block undetectable inflation. Activating them destroys MWEB’s confidentiality entirely. It is a fire alarm wired to the sprinklers, and it is more than most chains in the tier above have.

Caveats and limitations
  • "No public plan found" is a statement about what a search on the verification date turned up. Private or unannounced work would not appear, and finding a plan later would move Litecoin up a tier, not down.
  • Switch commitments are a genuine deployed mitigation for one specific risk, supply integrity, at the cost of the feature they sit inside. Whether that counts as a plan is a fair question; we concluded it is a contingency mechanism rather than a migration path, on the same reasoning we applied to Zcash’s recovery protocol.
  • The developer statements are reported from a conference talk. We were unable to locate a recording or transcript to verify the wording directly, and have attributed accordingly.
What would change the grade

Any published, funded post-quantum effort, a dated target, or an accepted improvement proposal would move Litecoin to the tier above immediately. This is the easiest grade on the page to change.

Sources

What surviving actually takes

Neptune Cash is one of two chains in the top tier, with the caveats set out in its assessment. If the design interests you, the technology page explains how it works.
How Neptune works