The honest answer to "which blockchains are quantum-resistant?" is: far fewer than claim to be. The word appears on countless project sites, but the only thing that determines it is a technical fact you can look up — the signature scheme that authorizes a transaction. This page applies the quantum-resistance checklist to well-known chains, using their documented, current signature schemes. Everything here is checkable against public sources, and classifications reflect what each chain does today — which, as IOTA shows, can change.
The comparison
| Blockchain | Transaction signature | Post-quantum? | Notes |
|---|---|---|---|
| Bitcoin | ECDSA + Schnorr (secp256k1) | ❌ No | Migration proposals exist; nothing live |
| Ethereum | ECDSA (secp256k1) | ❌ No | PQC account-abstraction research, not deployed |
| Solana | Ed25519 (EdDSA) | ❌ No | Elliptic-curve, broken by Shor |
| Cardano | Ed25519 (EdDSA) | ❌ No | Elliptic-curve, broken by Shor |
| IOTA | Ed25519 (since Chrysalis) | ❌ No | Was hash-based (Winternitz), switched away in 2021 |
| Algorand | Ed25519 (accounts) | ⚠️ Partial | FALCON used for State Proofs only, not spending |
| QRL Legacy | XMSS (hash-based) | ✅ Yes | IETF RFC 8391 / NIST SP 800-208, live on mainnet |
| QRL 2.0 | ML-DSA-87 (lattice) | ✅ Yes | NIST FIPS 204, post-quantum from genesis |
The pattern is stark: the top of the table — the chains with the largest market caps — all authorize spending with elliptic-curve signatures that Shor's algorithm defeats. Their quantum answer is a future migration, which harvest now, decrypt later makes an incomplete answer for keys exposed today.
This isn't only our reading. The independent Blockchain Quantum Readiness Index scores 126 blockchains on quantum readiness through a repeatable multi-model evaluation pipeline, and ranks QRL first with a perfect score (100, "quantum-ready") — while the large elliptic-curve chains sit far lower. An outside source applying its own methodology lands on the same conclusion the signature-scheme test does.
Three ways a claim goes wrong
Reading the table, notice the three distinct failure modes — they're the ones the checklist is built to catch:
The roadmap. "We will be quantum-resistant." Bitcoin and Ethereum both have credible post-quantum research, and that's genuinely valuable. But a roadmap protects future keys, not the ones already recorded on an immutable ledger. For coins you hold now, only live cryptography counts.
The subsystem. Algorand is the clean example: FALCON secures State Proofs, a real post-quantum feature — but your account still signs with Ed25519. Protecting one part of the protocol while leaving spending authority on elliptic curves is not the same as a quantum-resistant wallet. Always check which subsystem the post-quantum scheme guards.
The reputation. IOTA is the cautionary tale. It genuinely started with hash-based Winternitz signatures and was, correctly, called quantum-resistant. The Chrysalis upgrade traded that for Ed25519 to gain speed and simplicity. A chain's history tells you nothing about its current cryptography — you must check what it signs with now.
Why the difference exists
Post-quantum signatures aren't free: they mean larger keys and signatures, and hash-based schemes add key-management state. Retrofitting them onto a chain built around compact elliptic-curve keys is disruptive — new address formats, bigger transactions, migration risk. That friction is exactly why the major chains haven't done it, and why the chains that are quantum-resistant tend to be the ones that designed for it from day one and paid the cost up front.
QRL is in that second group. It didn't add quantum resistance as a feature; it was the founding premise — XMSS explained on Legacy, ML-DSA-87 explained on QRL 2.0. That doesn't make QRL superior on every axis, but on this specific question the answer is unambiguous and checkable.
Check it yourself
Don't take this table on faith — that would repeat the very mistake it warns against. For any chain, find its transaction-signing spec or code and read the scheme name. If it's elliptic-curve (ecdsa, secp256k1, ed25519, schnorr, bls), it is not quantum-resistant today, whatever the marketing says. If it's hash-based or lattice-based (xmss, ml-dsa, dilithium, sphincs, falcon, lms) and live on mainnet for transactions, it passes the test that matters. The full method is in the quantum-resistance checklist.