Post-quantum on a token vs in a wallet: what the words can and cannot mean

The desk is building a token, and the plan for it uses the words "post-quantum." This page exists so that those words mean something specific on this site, and so that a reader can tell the difference between what they mean here and what they mean on a landing page that is selling a coin. The short version: a token cannot be quantum-safe on a chain that is not, and the chains are not; what a token can do is narrower, and it is worth doing anyway.

What the threat is

Every major blockchain authorises a payment with a digital signature over an elliptic curve: ECDSA and Schnorr on Bitcoin, ECDSA on Ethereum, Ed25519 on Solana. The security of all three rests on the same hard problem, and Shor's algorithm, run on a large enough fault-tolerant quantum computer, solves that problem. The question has only ever been "how large" and "when." In May 2025 Craig Gidney of Google's quantum team published an estimate that RSA-2048 could be factored "with less than a million noisy qubits" running for "less than a week," assuming a gate error rate of 0.1% — down from the 20 million qubits his 2019 estimate with Ekerå had required. No machine of that size exists; the public devices are counted in hundreds or low thousands of noisy physical qubits, not a million. But the engineering estimate fell by a factor of twenty in six years, and the elliptic-curve problem the chains rely on is generally reckoned to need fewer resources than RSA-2048, not more.

Two distinctions matter for what follows. First, a quantum computer attacks public keys, not hashes. A hash like SHA-256 or Keccak gets a square-root speed-up from Grover's algorithm and is otherwise fine; that is why every serious proposal below is built from hashes. Second, the attack needs the public key in the open. A Bitcoin address that has never spent exposes only a hash of its key; a Solana address is the Ed25519 public key, exposed from the first transaction in; an Ethereum account exposes its key with its first outgoing transaction. Where the key is already visible, the funds are already in the window.

What NIST did, and the dates

On August 13, 2024 NIST published its first three post-quantum standards: ML-KEM (FIPS 203) for key exchange, ML-DSA (FIPS 204, the lattice signature once called Dilithium) and SLH-DSA (FIPS 205, the hash-based signature once called SPHINCS+). In November 2024 it published the draft transition plan, NIST IR 8547, which puts dates on the old algorithms: ECDSA at 112-bit strength is "deprecated after 2030" and "disallowed after 2035"; ECDSA and EdDSA at 128-bit strength and above are "disallowed after 2035." The same document explains why signatures are the less urgent half of the migration: unlike encryption, where there is a "harvest now, decrypt later" threat, "authentication systems stay secure as long as their algorithms and keys are secure when authentication happens." A blockchain is the exception that proves the rule — its public keys and its signatures are harvested by design, forever, in the ledger.

What the chains are doing

Bitcoin. BIP-360 is the first proposal to put quantum resistance formally on Bitcoin's road map. Its current form adds a new output type modelled on Taproot but with the key path removed, so that "no public key based spending route exists at all"; spending reveals a script with a Merkle proof. It "does not replace ECDSA or Schnorr" with a post-quantum signature, and it changes nothing about existing coins: "old unspent transaction outputs remain vulnerable until users manually move funds" to the new outputs. Activation would be a soft fork "if consensus builds," and as of March 2026 it was a published proposal, not a deployed one.

Ethereum. On September 8, 2026 the Ethereum Foundation's protocol group set December 2029 as its target for a quantum-resistant layer one, writing that Ethereum "should plan for Q-day happening as early as 2030." The near-term fork, Hegotá, carries the plumbing — native account abstraction through "Frame Transactions," which would let a wallet use a custom signature scheme — and the post-quantum milestones sit in later forks. A target is not a shipped upgrade, and the announcement does not say what happens to accounts that never migrate.

Solana. In January 2025 a Solana developer, Dean Little, published the Winternitz Vault: a program that holds funds behind a hash-based one-time signature — 32 secret scalars each hashed 256 times to make a public key, of which only a hash is stored on chain. Because a one-time signature should be used once, each spend closes the vault and opens a new one with fresh keys. It "currently exists as an optional feature, not a network-wide security upgrade": the chain's own signature is still Ed25519, every ordinary Solana wallet is still an Ed25519 key in the open, and the vault protects exactly the coins someone chooses to put in it.

A vault and an attestation protect different things

That last sentence is the whole distinction. There are two things a project can make post-quantum today without waiting for a chain, and they protect different assets.

A hash-based vault protects holdings at rest — a treasury balance, a reserve, a long position — by keeping them behind a hash of a key rather than a key. The chain still validates Ed25519 for the transaction that moves the coins out; what the vault removes is the standing exposure of the key in the meantime. Its cost is operational: one-time keys, a new vault per spend, a signature of a few kilobytes, and a mistake (reusing a key) that is fatal rather than inconvenient.

A signed attestation protects the record — what an entity did and said. A mint, an allocation, a pool lock, a treasury decision, written as a small document, hashed, and signed with ML-DSA (the NIST lattice standard) next to the chain's own signature, verifiable offline with a public key the entity has published. If the chain's signatures fall, the ledger's authorship becomes forgeable — anyone with the broken key can spend as the entity — but the attested record of what the entity actually did, signed with an algorithm the attack does not reach, still stands. It is the difference between a lock and a notary.

Neither of these is "a quantum-safe token." A token's transfers, its pools and its staking program run on the chain's signatures and inherit the chain's exposure in full, and that will be true of every token on Solana, Ethereum or Bitcoin until those chains migrate. A project that says otherwise is either confused about which of the two things it built, or is counting on the reader being.

The honest claim

The desk's plan for its token (the staking program and the attestation layer are published, open-source, and described on the crypto shelf) uses the second thing today and names the first as future work. The claim it is entitled to make is "post-quantum attested acts" — a public, offline-verifiable, ML-DSA-signed record of everything the token entity does — and, if and when a hash-based vault holds the treasury, "treasury held behind a hash-based signature." It is not entitled to say "quantum-safe," "quantum-proof," or "quantum-resistant token," and no page on this site will. A reader who sees those words on another project's page now has the question to ask: which of the two things did you build, and what happens to my balance when the chain's own signature breaks? The staking and pools pages — staking, liquidity pools — carry the ordinary risks that come before the exotic one; the exotic one is the only risk that, on the day it arrives, arrives for everyone at once.

• What a perpetual future is and how funding works
• Spot vs perps vs on-chain: where a trade actually happens
• Holding your own keys: what a signature proves, and what nobody should ask you for
• The vault: hash-based keys and what they protect
• Liquidity pools and impermanent loss, with the arithmetic
• Staking — what you earn, what you risk, what is taxed

← Crypto · All of Learn