Why Every Blockchain Needs Post-Quantum Cryptography

Every blockchain ever built rests on one assumption. It is so basic that nobody writes it down, and it has never once been wrong.

The assumption is this: you can publish your public key to the entire world, forever, and nobody will ever work backwards from it to your private key.

That assumption is what makes a blockchain possible. It is why you can hold money without a bank, sign a transaction without a notary, and prove ownership without asking anyone's permission. Bitcoin, Ethereum and almost every chain in production inherit it from the same place: elliptic curve cryptography, the mathematics that has protected the internet since the 1980s.

Quantum computing breaks that assumption. Not weakens it. Breaks it.

This article explains why that matters more for blockchains than for anything else on the internet, why "we'll fix it later" does not work for a decentralised network, and what a blockchain built for the post-quantum world actually looks like.

The one thing a quantum computer is good at

A quantum computer is not a faster computer. For almost every task you use a computer for, it is useless. It is decisive for one narrow family of problems, and elliptic curve cryptography sits right in the middle of it.

In 1994, Peter Shor published an algorithm showing that a large enough quantum computer can find the hidden structure inside the numbers behind RSA and elliptic curves. On a classical computer, turning a public key back into a private key would take longer than the age of the universe. On a sufficiently large quantum computer, it becomes a calculation.

For thirty years the only thing missing was the machine. In March 2026, Google Quantum AI published resource estimates showing that breaking the elliptic curve behind Bitcoin and Ethereum would need fewer than 500,000 physical qubits and about nine minutes of runtime. Six months later, on 8 September, IonQ published the first complete end-to-end blueprint for the same attack on its own trapped-ion architecture: 20,000 physical qubits, just under 26 days, with a roadmap that targets a machine of that size in 2028. That is not today's hardware. It is a number, and it is smaller than the last number, which was smaller than the one before it.

Why blockchains are exposed in a way nothing else is

Every other system on the internet has an advantage blockchains do not have: it can hide its public keys.

When you connect to a website, keys are exchanged for that session and thrown away. When a bank updates its cryptography, it does so behind closed doors, on its own servers, on its own schedule. The old keys were never public, so there is nothing for an attacker to collect.

A blockchain is the opposite by design. The ledger is public, permanent and replicated on every node in the world. Every address that has ever signed a transaction has revealed its public key, and that key cannot be un-revealed. It sits on-chain, waiting, for as long as the chain exists.

The scale of this is already known. In April 2026, Coinbase's independent advisory board on quantum computing, which includes Scott Aaronson, Dan Boneh and Justin Drake, published its position paper. Roughly 6.9 million BTC sit in addresses with exposed public keys. About a million of those are held in only eleven addresses, most of them untouched since the earliest years of the network.

Those coins are not at risk someday. The exposure exists today. The only thing missing is the machine, and the machine is the one variable that has only ever moved in one direction.

Why "later" does not work for a blockchain

A company can migrate its cryptography quietly. A blockchain cannot, for three reasons.

Nobody is in charge. Changing the signature scheme on a decentralised network means a hard fork: a change to the rules that every node, every wallet, every exchange and every application has to adopt. That takes coordination, governance and time, and it has to happen on a live network holding real money.

The migration is measured in years. In September 2026 the Ethereum Foundation made quantum resistance its top priority and set a deadline of December 2029 for a quantum-resistant base layer. The plan involves the Hegotá upgrade in 2027, which in the Foundation's own words "is not the PQ fork, it is the fork that decides whether the PQ forks happen on time", followed by five further hard forks at roughly seven-month intervals. That is the most serious migration plan any major chain has published, and it shows what the job actually involves.

Old keys stay exposed. Even after a chain migrates, every coin sitting in an address whose owner never moves it remains protected only by the old cryptography. Bitcoin's hardest question is not technical. It is whether the network should freeze or leave alone coins it cannot reach, and no answer to that question is comfortable.

Put those together and the conclusion is simple. For a blockchain, post-quantum cryptography is not an upgrade you schedule when the threat arrives. By the time the threat arrives, a migration that has not already started is too late.

The world has already set the date

For most of a decade this was a conversation between cryptographers. In 2026 it became a calendar.

The United States has set federal deadlines of 2030 for key establishment and 2031 for digital signatures. The United Kingdom's National Cyber Security Centre holds its milestones at 2028, 2031 and 2035. The European Union's coordinated roadmap puts high-risk systems at 2030 and full transition at 2035.

The largest technology companies stopped talking and started shipping. Google Cloud has set full post-quantum readiness for 2029, with hybrid post-quantum key exchange already live on

google.com

. Cloudflare reports that over 65% of human traffic to its network is already post-quantum encrypted and targets full post-quantum security by 2029. Microsoft has pulled its own programme forward to the same year.

And the chains have begun to move. Ethereum's December 2029 deadline aligns it with Google, Cloudflare and Microsoft. On Bitcoin, the first quantum-resistant transaction was confirmed on mainnet in August 2026, and Blockstream followed with SHRINCS, the first post-quantum signature proposal designed specifically for Bitcoin.

When governments, the internet's largest infrastructure providers and the largest smart contract chain in the world all land on the same three years independently, that is not a forecast. It is the industry telling you how it reads the clock.

What post-quantum cryptography actually is

Post-quantum cryptography, or PQC, is cryptography built on mathematical problems that a quantum computer has no known shortcut for.

In August 2024, after an eight-year open competition in which 82 candidate schemes were submitted and most were broken along the way, NIST finalised the first three standards. FIPS 203, ML-KEM, handles key exchange. FIPS 204, ML-DSA, handles digital signatures. FIPS 205, SLH-DSA, is a hash-based signature scheme kept as a backup. ML-KEM and ML-DSA rest on lattice problems: finding one hidden point in a grid of hundreds of dimensions, a problem that grows harder at exactly the rate quantum computers cannot keep up with.

The vetting has continued in public. In July 2026, HAWK, a candidate in NIST's follow-on signature competition, was broken by AI-assisted cryptanalysis in around sixty hours and withdrawn. That is the process working, at machine speed, and it is why the standards that survived it are the ones the world is migrating to.

What it costs

Post-quantum signatures are bigger. An ML-DSA signature runs to more than 2,400 bytes, against roughly 64 bytes for the elliptic curve signatures used today. Public keys are larger too. On a blockchain, where every byte is stored by every node forever, that is not a footnote. Coinbase's advisory board warned in June 2026 that swapping ML-DSA into Bitcoin as it stands could reduce transaction capacity severalfold.

This is the honest reason migration is hard. It is not that the mathematics is unknown. It is that fitting bigger signatures into a system designed around small ones means rethinking block space, fees, aggregation and throughput, on a live network, without breaking anything. The chains that were built around the larger signatures from the start do not have that problem, because it was designed in rather than retrofitted.

What a post-quantum blockchain looks like

NaoX, formerly Naoris Protocol, is a post-quantum Layer 1 blockchain. It was built on NIST-standardised post-quantum cryptography from its first block, with full EVM compatibility.

On NaoX, transactions can be signed with ML-DSA-87, FIPS 204 at NIST Security Level 5, the strongest parameter set the standard defines. Those signatures are verified natively by the protocol itself, in roughly 38.5 microseconds each, around 26,000 verifications per second per core, the post-quantum counterpart to Ethereum's ecrecover. The 100,000 transactions that crossed mainnet in August 2026 were every one of them signed this way.

Keys are derived rather than stored. Through OTKDP, the One-Time Key Derivation Protocol, a post-quantum keypair is derived from the wallet a user already has, with enrolment running over ML-KEM-768 and the same twelve recovery words regenerating the same keys on any device. Nothing new to export, nothing new to lose.

Migration is a dial rather than a flag day. A transaction can carry two signatures over the same payload, classical and post-quantum, and both must pass. Adoption runs forward only, classical to hybrid to post-quantum, per application and on its own schedule.

For builders, nothing changes. NaoX runs standard Ethereum client software: the same Solidity, Hardhat, Foundry, ethers and MetaMask work unchanged, with Go development supported. A contract deployed today inherits post-quantum signing, verification and key management without a line changed, and when the 2029 deadlines arrive, there is no migration to run.

And the honest edge, stated plainly: finality aggregation on NaoX runs on classical BLS today, exactly as it does across the proof-of-stake industry, because no mature post-quantum aggregation scheme exists yet for anyone. That is the open frontier of the whole field, and a claim with boundaries is the only kind worth making.

The conclusion

Every blockchain needs post-quantum cryptography for the same reason every blockchain exists: because the security is in the maths, and the maths is about to change.

The public key is the door. Blockchains put every door on public display, permanently, by design. A quantum computer turns the door into the key. The world has set its dates, the largest chains have started the longest upgrade in their history, and the standards to build on have existed since 2024.

2026 continues to be the great quantum awakening. The investment, the innovation and the migration are accelerating, and none of it is slowing down. The only question left for anyone building on a blockchain is whether they meet the post-quantum world early or late.

FAQs

Why do blockchains need post-quantum cryptography? Because a blockchain publishes every public key permanently. A quantum computer running Shor's algorithm can derive the private key from the public key, which means every exposed address becomes spendable by whoever controls the machine. Post-quantum cryptography replaces the vulnerable signatures with schemes a quantum computer cannot break.
Is Bitcoin quantum resistant? Not today. Bitcoin uses ECDSA and Schnorr signatures on elliptic curves, both broken by Shor's algorithm. Roughly 6.9 million BTC sit in addresses with exposed public keys. The first quantum-resistant transaction on Bitcoin mainnet was completed in August 2026 and the first signature proposal, SHRINCS, was published the same week, but full migration is expected to take years.
Is Ethereum quantum resistant? Not yet. In September 2026 the Ethereum Foundation set December 2029 as the deadline for a quantum-resistant base layer, covering user signatures, validator signatures and on-chain data, delivered across the Hegotá upgrade and five further hard forks.
What is post-quantum cryptography? Cryptography based on mathematical problems, such as structured lattices and hash functions, that have no known quantum shortcut. NIST finalised the first standards, FIPS 203, 204 and 205, in August 2024.
Is my seed phrase safe from quantum computers? Yes. Seed phrases are pure entropy with no mathematical structure to exploit. The exposure is the public key derived from them, which is what post-quantum signatures replace.
Which blockchains are post-quantum? Very few. Most chains in production plan to migrate. A small number were built post-quantum from the start. NaoX is a post-quantum Layer 1 whose transactions can be signed with ML-DSA-87 at NIST Security Level 5 and verified natively by the protocol.
When is Q-Day? No date is known. Expert estimates cluster between 2028 and the mid-2030s, and they have only ever moved closer. Google, IBM and the United States government are all working to 2028 to 2030 targets for fault-tolerant machines, and IonQ's September 2026 blueprint puts a 20,000-qubit machine capable of breaking elliptic curve signatures in its 2028 roadmap.

About NaoX Protocol

NaoX is a post-quantum Layer 1 blockchain and decentralised infrastructure protocol designed to secure digital assets, applications and systems across the decentralised stack.

Built with NIST-standardised post-quantum cryptography and full EVM compatibility, NaoX enables transactions to be signed with FIPS 204 at Security Level 5 while existing tools, contracts and developer workflows continue to work unchanged.

By extending post-quantum security across both Web3 and connected Web2 environments, NaoX is building the infrastructure required for a more resilient digital future.