The quantum threat to Bitcoin gets the headlines, but it is not a Bitcoin problem. Almost every cryptocurrency signs transactions with elliptic curve mathematics that a large quantum computer would unravel, whether that is the ECDSA behind Bitcoin or the Ed25519 behind most newer chains. The question of a quantum resistant cryptocurrency is really a question about the whole market, and the honest answer in 2026 is that almost none of the coins people actually hold are protected yet. Building a quantum resistant cryptocurrency is now on the agenda of most serious projects, but agendas are not mainnet code.
This guide maps the field. It explains why the threat is shared, lays out in one table exactly what each major cryptocurrency is doing about it, and separates the projects that have shipped a genuinely quantum resistant cryptocurrency from the ones that have only published roadmaps or slogans. For the Bitcoin-specific version of this story, our companion guide on bitcoin and quantum computing goes deeper on that one chain.
The threat is shared across chains. Both ECDSA and Ed25519, which between them secure almost the entire market, fall to Shor’s algorithm once a capable quantum computer exists.
Only one major chain is quantum resistant today. The Quantum Resistant Ledger has signed every transaction with hash-based cryptography since 2018. Everything else still protects user funds with vulnerable signatures.
The big names are on roadmaps, not mainnet. Bitcoin, Ethereum, XRP, Cardano, Hedera and Polkadot all have plans, and none has a live protocol-wide post-quantum signature for accounts.
Some defences are narrower than they sound. Solana’s vault and Algorand’s FALCON accounts are opt-in, and Algorand’s headline resistance protects historical state rather than your balance.
A few are doing nothing or moving backward. Litecoin has no funded effort, Monero is at the research stage, and IOTA actually removed its original quantum resistance in 2021.
The clock is the same for all of them. Expert timelines cluster in the early 2030s, and migrating a whole chain safely takes years, so the projects that start late will finish late.
Why the threat is shared across every chain
Almost all cryptocurrency ownership rests on the same kind of mathematics. A wallet holds a private key, publishes a public key or a hash of one, and proves ownership with a digital signature that is easy to verify but, classically, impossible to forge. Bitcoin uses ECDSA on the secp256k1 curve, while Ethereum, Solana, Cardano and most newer chains use Ed25519, and both are elliptic curve schemes that Shor’s algorithm can break.
That shared foundation means a cryptographically relevant quantum computer would not threaten one coin in isolation. It would threaten the signature scheme underneath most of the market at once, on the day the community calls Q-Day. The exposure is also already accumulating, because the same danger driving banks and governments toward post-quantum cryptography applies to any public key sitting on a blockchain for an attacker to study.
The threat has a slow fuse and a shared face. It is the reason the wider worry about harvest now, decrypt later extends to on-chain data, and the reason every serious project now has to answer the same question about its own signatures.
What every major cryptocurrency is doing
The table below grades each major chain on what it actually runs today, not on what it has announced. A project counts as shipped only when the defence protects ordinary user funds on mainnet, which is a far higher bar than a testnet or a research program. Read the status column carefully, because several of the most confident marketing claims describe opt-in features or narrow protections rather than a truly quantum resistant cryptocurrency.
| Cryptocurrency | Signature today | Quantum-resistance effort | Status |
|---|---|---|---|
| Bitcoin (BTC) | secp256k1 ECDSA, Schnorr | BIP-360 adds a quantum-safe address type and BIP-361 would sunset old signatures, the first assigned in late 2024 and the second in early 2026, with nothing on mainnet. | Proposed |
| Ethereum (ETH) | ECDSA accounts, BLS validators | A February 2026 roadmap targets account abstraction for signature agility plus STARK-based aggregation, with account-level agility drafted as EIP-8141, aimed at roughly 2029. | Proposed |
| XRP (XRPL) | ECDSA and Ed25519 | A four-phase Ripple roadmap published in April 2026 targets a full post-quantum transition by 2028, with candidate signatures on Devnet in the second half of 2026. | Proposed |
| Cardano (ADA) | Ed25519 | Input Output’s 2026 research program aims to harden the Ouroboros consensus with lattice-based cryptography, still at the research stage with no mainnet code. | Research |
| Solana (SOL) | Ed25519 | The opt-in Winternitz Vault lets users park funds under a hash-based signature, but default accounts stay on Ed25519 and it is not a protocol-wide change. | Opt-in |
| Algorand (ALGO) | Ed25519 | FALCON-signed state proofs have been live since 2022 but protect historical state rather than balances, and opt-in FALCON accounts arrived in late 2025 with broad resilience targeted for 2027. | Partial |
| Hedera (HBAR) | Ed25519 and ECDSA | An April 2026 roadmap plans hybrid Ed25519 and FALCON event signing and a new post-quantum key type targeted for 2027, with nothing yet shipped for accounts. | Proposed |
| Polkadot (DOT) | sr25519 and Ed25519 | A Web3 Foundation roadmap names lattice signatures for consensus and FALCON for account keys, framed as a forward plan without a mainnet deployment. | Proposed |
| Litecoin (LTC) | secp256k1 ECDSA | No funded migration exists, and an official claim that its MWEB addresses are quantum resistant that MWEB lead developer David Burkett has since walked back, so it is best treated as marketing. | Nothing |
| Monero (XMR) | CLSAG ring signatures | The Monero Research Lab runs active post-quantum research, still at the research stage, and a privacy hedge reached a test network in 2026, but no part of its live cryptography uses a post-quantum primitive. | Research |
| IOTA | Ed25519 | Its original hash-based signatures were quantum resistant, but a 2021 upgrade replaced them with Ed25519 for usability, and no dated migration plan has followed. | Regressed |
| Quantum Resistant Ledger (QRL) | XMSS hash-based | Every transaction has been signed with the hash-based XMSS scheme since the 2018 mainnet, making it the only major chain that was quantum resistant from day one. | Native |
The pattern is stark once the noise is stripped away, and a truly quantum resistant cryptocurrency remains the exception rather than the rule. One chain is genuinely native, a cluster of serious projects are on multi-year roadmaps, two offer opt-in tools that most users will never touch, and several are doing little or nothing. The rest of this guide walks through each of those groups.
The one chain built quantum resistant
The Quantum Resistant Ledger is the only major cryptocurrency that was quantum resistant from the start. Since its 2018 mainnet it has signed every transaction with XMSS, a hash-based signature scheme standardised by the internet standards bodies, which rests on the security of hash functions rather than elliptic curves and so is not broken by Shor’s algorithm. That makes it the exception that proves how far behind everyone else is, a point our profile of the Quantum Resistant Ledger explores in more detail.
The trade-off is real rather than cosmetic. XMSS is a stateful scheme, which means a wallet has to track which one-time keys it has already used, and reusing one is catastrophic, so the design demands more careful wallet engineering than a conventional chain. It is a reminder that the only fully quantum resistant cryptocurrency in production bought that safety with genuine complexity, which is part of why larger chains have been slow to follow.
The big roadmaps, Ethereum to XRP
The largest chains are aware of the problem and have committed to fixing it, but their defences live in planning documents rather than on mainnet. Ethereum’s founder Vitalik Buterin set out a post-quantum direction in early 2026 that leans on account abstraction, so that users could opt into hash-based or lattice signatures, alongside STARK-based aggregation for validators, with account-level signature agility drafted as EIP-8141 and a realistic horizon around 2029. Nothing in that plan yet secures a live Ethereum account.
Ripple has been more concrete about dates. Its April 2026 roadmap for the XRP Ledger sets out four phases toward a full post-quantum transition no later than 2028, with candidate signatures due on a development network in the second half of 2026, and the ledger’s built-in key rotation means accounts could migrate without moving funds, an approach our coverage of the XRP Ledger’s 2028 target examines. Cardano, Hedera and Polkadot sit in the same category, each with a credible published plan built on the standardised lattice and hash-based schemes, and each still short of a shipped account signature.
The opt-in half measures
Two chains offer real post-quantum protection that almost nobody uses, because it is optional and separate from the default wallet. Solana has a Winternitz Vault, a hash-based construction that a user can move funds into for safety, but ordinary Solana accounts remain on Ed25519 and the vault is a single developer’s program rather than a protocol change. Headlines calling Solana quantum resistant overstate what is really an opt-in tool.
Algorand is the most over-claimed of all. It has run FALCON-signed state proofs on mainnet since 2022, which is genuine post-quantum cryptography, but those proofs secure historical state and cross-chain attestations rather than the balance in your account. Opt-in FALCON accounts arrived in late 2025 and broad resilience is targeted for 2027, yet every ordinary account, block proposal and committee vote still relies on Ed25519 today. Calling Algorand a quantum resistant cryptocurrency is accurate only for a narrow layer, not for user funds.
Doing nothing, or going backward
At the other end of the field are the projects with no meaningful defence. Litecoin has no funded post-quantum effort, and an official statement that its privacy sidechain addresses are quantum resistant, a claim its own MWEB lead developer David Burkett later walked back by noting that no cryptocurrency is quantum safe, so it is best read as marketing rather than a shipped protection. A coin inheriting Bitcoin’s signature scheme inherits Bitcoin’s exposure without Bitcoin’s active proposals.
Monero is at the pure research stage, with active post-quantum work at the Monero Research Lab and a privacy hedge reaching a test network in 2026, but none of its live signing or commitments run on a post-quantum primitive. IOTA is the starkest case, because it once used hash-based signatures that were quantum resistant and then replaced them with Ed25519 in 2021 for a smoother user experience, giving up that protection with no dated plan to restore it. Progress on quantum resistance is not guaranteed to move in one direction.
What it means if you hold crypto
The practical takeaway is that no mainstream coin will protect you automatically yet, so the sensible steps are the same ones that reduce exposure on any chain. Avoid reusing addresses, because reuse publishes your public key and turns a hidden key into an exposed one, and prefer wallets whose teams are actively tracking their chain’s post-quantum plan. Neither habit is a full defence, but both buy time.
It is also worth being honest about what a migration will demand of holders. On most chains you will eventually have to move funds into a new post-quantum address type, and on some the community is already debating whether coins that never migrate should be frozen, exactly the fight now playing out over Bitcoin. Following the roadmaps of the specific coins you hold, rather than trusting a blanket claim of quantum safety, is the most useful thing an ordinary holder can do while the engineering catches up.
Bitcoin and quantum computing
What is Q-Day
Harvest Now, Decrypt Later
The CRQC threshold
Post-quantum cryptography companies
The Quantum Resistant Ledger
Frequently asked questions
Is any cryptocurrency actually quantum resistant today?
Yes, but only one major chain. The Quantum Resistant Ledger has used hash-based XMSS signatures since its 2018 launch and is the only large cryptocurrency that protects user funds against quantum attacks by default. Everything else either relies on vulnerable elliptic curve signatures or offers post-quantum protection only as an opt-in feature.
Which quantum resistant cryptocurrency projects are furthest along?
Beyond the Quantum Resistant Ledger, the chains with funded teams and dated plans are furthest along. Ripple’s XRP Ledger targets a full transition by 2028, Ethereum aims for roughly 2029, and Algorand already runs FALCON for a narrow layer. These are roadmaps and testnets rather than shipped account security, so none yet makes the coin fully quantum resistant.
Are Ethereum and Solana quantum resistant?
Not yet in any meaningful sense for your funds. Ethereum has a 2026 roadmap and a draft proposal aimed at around 2029 but nothing live on its main network. Solana offers an opt-in Winternitz Vault, yet default accounts remain on Ed25519, so headlines calling Solana quantum resistant describe an optional tool rather than the chain itself.
Why is the quantum threat the same for so many coins?
Because they share the same cryptography. Bitcoin uses ECDSA and most newer chains use Ed25519, and both are elliptic curve signature schemes that Shor’s algorithm can break once a capable quantum computer exists. A single sufficiently large machine would threaten the signatures underneath most of the market at the same time.
When would a quantum computer be able to break these signatures?
Credible expert timelines cluster in the early 2030s, with surveys giving a better-than-even chance of a capable machine within fifteen years and regulators planning to disallow today’s signatures after 2035. Because migrating a whole chain safely can take years, the practical deadline to begin is well before any machine actually arrives.
What should I do to protect my crypto now?
No mainstream coin protects you automatically yet, so the useful steps are to avoid reusing addresses, which keeps your public key hidden until you spend, and to favour wallets whose teams are actively working on their chain’s post-quantum plan. Neither is a complete defence, but both reduce your exposure while the migrations are built.
Has any project gone backward on quantum resistance?
Yes. IOTA originally used hash-based signatures that resisted quantum attacks, then replaced them with Ed25519 in 2021 to improve usability, giving up that protection without a dated plan to restore it. It is a reminder that quantum resistance is a design choice a project can drop as well as adopt.
Could unmigrated coins be frozen like the Bitcoin proposals suggest?
It is possible on some chains and already being debated. Bitcoin’s BIP-361 proposes eventually sunsetting old signatures so unmigrated coins can no longer be spent, and other communities may face the same choice between letting exposed coins be stolen and freezing them. The argument is as much about property rights and governance as it is about cryptography.
How To Read These Verdicts
Every grade here reflects what protects ordinary user funds on mainnet today, not what a foundation has announced or funded for a later date. A roadmap, a testnet, or an opt-in vault is real progress, yet none of them is the same as a default account that a quantum computer could never loot.
A note on scope. This article assesses the cryptographic and quantum readiness of public blockchains, and it is not investment advice or a recommendation to buy, sell, or hold any digital asset. Security roadmaps change quickly, so treat every status here as a snapshot in time and verify the current state with each project before you act on it.
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
