In crypto, the reason comes down to digital signature, as a blockchain uses it to prove who can spend with. The schemes the major chains use are all elliptic-curve signatures, from ECDSA and Schnorr on Bitcoin to Ed25519, sr25519, and the BLS signatures in Ethereum's consensus.
They all have one flaw in common: each is vulnerable to the same quantum attack. Post-quantum cryptography is their replacement, but swapping it in is harder for a blockchain than for almost anything else online.
What post-quantum cryptography is
Most public-key cryptography today rests on two kinds of math problems: factoring large numbers, and discrete logarithms, whether in finite fields or on elliptic curves. Both are hard for ordinary computers to solve and, in principle, easy for a large fault-tolerant quantum computer running Shor's algorithm. That's the threat faced by RSA, Diffie-Hellman, ECDSA, Schnorr, Ed25519, and the BLS signatures that some chains use.
Post-quantum cryptography swaps those problems out for ones with no known quantum shortcut. The leading families are lattice-based (finding short vectors in high-dimensional grids), hash-based (leaning only on the security of a hash function), and code-based (decoding a deliberately scrambled message). None of them needs a quantum computer to run. They're classical algorithms designed to resist a quantum attacker.
But first, let’s clear something up: this isn’t the same as quantum cryptography or quantum key distribution, which use quantum hardware and special links to exchange keys. Post-quantum cryptography is software, which is the very reason why it's the practical path for existing systems.
What it replaces, and what it leaves alone
The quantum threat is narrower than some headlines would have you believe. Shor's algorithm breaks public-key cryptography, the part that handles key exchange and digital signatures. It doesn’t break the symmetric encryption that protects data in bulk. Grover's algorithm speeds up brute-force key search, but only quadratically, which halves a cipher's effective strength. AES-256 keeps about 128 bits against it, which is still plenty, so symmetric encryption survives with larger keys.
This split decides what has to change. Post-quantum cryptography targets the public key layer, and there it does two separate jobs. One is key establishment, protecting a channel so two parties can agree on a secret, which is what a KEM (key encapsulation mechanism) handles. The other is signatures that prove a message came from the holder of a private key. For the majority of the internet, the urgent task is key establishment because of the ‘harvest now decrypt later’ recording. For a blockchain, as we'll get to, the job that counts the most is the signature.
What NIST standardized
After about eight years of public competition, NIST published its first post-quantum standards in August 2024. It came up with three standards and two roles. ML-KEM (FIPS 203, from the Kyber submission) handles key establishment, whereas ML-DSA (FIPS 204, from Dilithium) and SLH-DSA (FIPS 205, hash-based) both handle signatures, using different math. Falcon has been selected for a fourth standard, FN-DSA, intended for a future FIPS 206 still in development as of mid-2026. NIST also selected the code-based HQC in 2025 for future standardization as a backup key-establishment method, built on a different problem from ML-KEM.
Three standards finalized, two still to land.
There’s one myth to be busted here. These weren't picked in a hurry. The ‘winners' emerged through years of open cryptanalysis, and two candidates that didn't, Rainbow and SIKE, were dropped after researchers broke them. Their security still rests on hardness assumptions, the same as the cryptography they replace, so nothing here is proven unbreakable. Still, calling them guesswork gets it backwards as, after all, they're the schemes standing after a decade of attack.
Why crypto mostly cares about the signature
Here's where blockchains differ from the rest of the internet. When you load a website, the sensitive step is key establishment, setting up a private channel, which is the part that ‘harvest now decrypt later’ targets. The public ledger itself has no such confidential channel; it's meant to be read by everyone, so secrecy was never the goal. What a blockchain protects is the right to spend, and that right is a signature.
So, the post-quantum piece a chain needs is a signature scheme to replace its elliptic-curve one. That means a post-quantum signature like the standardized ML-DSA or SLH-DSA, or FN-DSA once its standard is finalized, not the KEM. A quantum computer that can forge signatures can move coins, which is the direct theft risk. Breaking key exchange mostly exposes the wallet and node traffic around the chain, not the public ledger.
The size problem
If a drop-in signature swap was easy, chains would have done it by now. A major obstacle is size. A Bitcoin ECDSA signature runs about 70 bytes, and a Schnorr one 64. Post-quantum signatures are far larger: Falcon-512 is around 666 bytes, ML-DSA runs from approximately 2,400 to 4,600 bytes, and the hash-based SLH-DSA ranges from about 7,900 bytes to nearly 50,000. That spans ten times the size of a classical signature to several hundred times. Public keys for ML-DSA and Falcon grow too, though SLH-DSA keeps its keys small.
On a blockchain, bytes are not free. Every signature goes into a block, adds to the data full nodes propagate and store, and takes up space that users pay for. Those larger signatures mean heavier transactions, more bandwidth, and greater pressure on block space and fees. Each NIST-selected scheme trades off differently: Falcon is compact but hard to implement safely, since its sampling can leak through side channels; SLH-DSA leans on the most conservative assumptions but is the bulkiest; ML-DSA sits in between. None of them is a free substitution, which is why ‘just switch to post-quantum signatures’ understates the work.
The migration obstacle: post-quantum signatures dwarf ECDSA.
Migrating a blockchain
Adopting a new signature scheme natively on a live chain is a consensus change, the hardest kind of upgrade. It usually needs a new address or transaction type, wallet and node support, and enough of the network to move before the old scheme is at risk.
On Bitcoin, one prominent draft, BIP-360, prepares the ground for post-quantum signatures without adding them outright (we go into that in our Is Bitcoin Quantum Safe? guide). Chains vary widely. None of the ten Layer 1s ranked in the L1 Quantum Vulnerability Index uses a native post-quantum signature as its default, and the index scores where each one stands.
The reason to start early is that migration and the threat run on separate timelines. Migration takes years, and the archive of exposed public keys only grows as keys appear on-chain. That echoes the timing of ‘harvest now decrypt later,’ though the exact mechanism in crypto is better described as forgery than decryption. Waiting for the threat to arrive means completing the migration after it's too late.
The application-layer option
Base-chain migration is the durable fix, but it isn't the only lever. On programmable chains, post-quantum authorization can be added at the application layer through a smart account or vault, without a base-layer consensus change. A contract holds funds behind a post-quantum signature check, so a broken elliptic-curve key on its own can't move them, as long as every withdrawal path enforces the check and the contract itself is sound.
This is the model qLABS built qVAULT around. We describe it as a non-custodial HyperEVM vault that requires a Falcon-based authorization for withdrawals, so an attacker holding only the broken elliptic-curve key can't withdraw. It currently supports qONE and HYPE on HyperEVM, with Ethereum and stablecoins planned. Because it's smart contract-based, qVAULT can never cover native Bitcoin.
qVAULT protects funds under the contract's own rules, not the base chain, its validators, or any bridge. Its approach represents one among several: Cardano has post-quantum research underway, and Ethereum is working on account designs that could adopt new signature schemes.
At the same time, qLABS is working on quantum-safe products and runs the index linked above. Do note that none of this should be read as financial advice. The methodology and conflict-of-interest statement sit with the qLVI.
Where this is heading
The algorithms are settled enough to build on. The standards exist, the signature schemes are named, and for the finalized algorithms, the main task at hand now is deployment, which for a blockchain is the slow part. Post-quantum cryptography is no longer only a research topic. Standardization continues, with FIPS 206 and HQC still to land, but for blockchains, the bottleneck is now migration engineering, measured against a threat whose timeline nobody controls.
If you hold crypto, that means two things for you. The first is that you should watch whether the chains on which you hold your assets are moving, since a signature scheme that never ships protects nobody. Second, where a carefully audited application-layer option exists, it can add a layer as the base chain catches up, as long as you weigh its contract, upgrade, and bridge risks alongside the protection.
FAQ
What is post-quantum cryptography?
It's a set of public-key algorithms designed to stay secure against a quantum computer, built on math problems with no known quantum shortcut. It runs on today's hardware and installs like any other software. NIST standardized the first algorithms in 2024.
Is post-quantum cryptography the same as quantum encryption?
No. Quantum cryptography and quantum key distribution use quantum hardware and dedicated links to exchange keys. Post-quantum cryptography is ordinary software running on ordinary computers, which is why it's the practical route for existing systems, including blockchains.
Which algorithms did NIST choose?
ML-KEM for key establishment, and ML-DSA and SLH-DSA for signatures, all finalized in August 2024. Falcon was selected for a future FN-DSA standard, FIPS 206, still in development as of mid-2026. NIST also selected the code-based HQC in 2025 for future standardization as a backup key-establishment method.
Does my crypto use post-quantum cryptography yet?
Almost certainly not in its native spending path. Major chains authorize transactions with quantum-vulnerable elliptic-curve schemes: ECDSA, Schnorr, Ed25519, or sr25519, with BLS used in some consensus layers. Migration to post-quantum signatures is in proposals and research, not shipped as the default on any of the ten Layer 1s the qLVI ranks. On programmable chains, some application-layer tools add a separate post-quantum check now, but it isn't the same as a completed base-layer migration.
When does this become urgent?
The migration is the long pole, not the quantum computer. Because a blockchain upgrade takes years and exposed keys accumulate in the meantime, the best time to start is before a capable machine arrives, not after. The forecasts for that machine are in What is Q-Day.
qLABS Editorial. Sources are linked inline. See the L1 Quantum Vulnerability Index for our full methodology and conflict-of-interest disclosure.
