Web3's Quantum Security Report Card: Which Chains Are Ready for Q-Day (and Which Have No Plan)

Project Eleven's May 2026 report warned that over $3 trillion in digital assets — virtually all of it — is secured by elliptic-curve signatures that a large enough quantum computer can break, and that it might already be too late for Bitcoin's quantum migration. That sounds like hype until you read the calendar: Google's March 2026 paper cut the estimated hardware needed to break Ethereum's account security by 20x, to roughly 1,200 logical qubits, while migrating global cryptographic infrastructure takes a decade or more even with finished standards. Web3Caff Research's 14,000-word panoramic report on blockchain quantum security calls this the industry's "quantum doomsday" clock. This post grades the chains against it.

The short version up front: every major chain still signs transactions with quantum-vulnerable ECDSA or EdDSA today, and only a minority have dated native migration plans. Algorand and NEAR are shipping post-quantum signatures on mainnet now; Ethereum has the most serious dated plan (signature agility in 2026, full L1 resistance by 2029); Bitcoin, BNB Chain, Dogecoin, and Tron have no dated native plan at all. The table below is the report card — the rest of the post is the evidence behind each grade.

The report card, up front​

Grades are the author's synthesis from published plans, shipped code, and dated commitments as of September 2026. "Plan owner" matters: a third-party overlay is not a protocol migration, and the table labels each accordingly.

Two things to notice before the detail. First, the chains holding most of the value cluster at the bottom: Bitcoin alone holds about 59% of the total crypto market (mid-September 2026), and it has no plan. Second, "no quantum computer can break Bitcoin today" — cracking its keys needs 1,200 to 1,450 logical qubits against IBM's roughly 200-qubit 2029 target — which is exactly why the migration costs below, not the threat timeline, are the scary part. The deadline is soft; the migration is slow.

What "quantum breaks crypto" actually means​

The mechanism is specific, not apocalyptic. Shor's algorithm, run on a sufficiently large error-corrected quantum computer, derives a private key from its public key for ECDSA, EdDSA, and RSA alike. For blockchains that means: any address whose public key has ever been exposed — spent-from addresses, reused addresses, and on account-model chains like Ethereum, effectively every active account — becomes spendable by whoever runs Shor's first. Unexposed keys (fresh addresses, hashed addresses never spent from) stay safe until they move.

Three facts set the clock:

• The estimates keep shrinking. Google Quantum AI's March 2026 paper cut the break-Ethereum figure 20x to about 1,200 logical qubits. IBM's Starling project targets a fault-tolerant machine by 2029. Chainalysis puts cryptographically relevant machines at 5–15 years out; IEEE Spectrum's sources say 2030–2033; skeptics say 10–30. The honest answer is a range, and the range keeps moving left.
• "Harvest now, decrypt later" already started. An adversary needs no quantum computer today to archive every exposed public key on every public ledger — the ledger helpfully never deletes them. The attack executes years from now against data collected for free today. For blockchains, unlike TLS sessions, there is no forward secrecy to rotate into.
• Migration takes longer than the optimistic timelines. The Quantum Insider's April 2026 assessment puts global PQC migration at 10–20 years of coordinated effort. Decentralized protocols, which must coordinate adversarial strangers rather than employees, sit at the slow end of that distribution — which is why a 15-year threat horizon against a 10-year migration is an emergency wearing a lab coat.

Why blockchains can't just swap the algorithm​

If post-quantum signatures were drop-in replacements, this post would be three paragraphs. They aren't, and the three costs below are all measured, not theoretical:

• Size: signatures grow 10–50x. An ECDSA signature is about 64 bytes. Falcon-512 runs ~690 bytes (~11x), Falcon-1024 ~1,330 bytes (~20x), and conservative hash-based schemes run into kilobytes. Every byte lands in blocks, propagates across gossip networks, and prices into fees. Block-space economics designed around 64-byte signatures have to be re-derived.
• Throughput: Solana's testnet lost ~90%. Live April 2026 testnet data from Project Eleven and the Solana Foundation confirmed roughly 90% throughput loss under quantum-safe signatures. Verification cost, not just size, is the bottleneck — and it hits high-throughput chains hardest, exactly the ones whose pitch is cheap abundant block space.
• Compatibility: existing wallets can't be force-upgraded. Billions in assets sit in wallets whose owners may never touch them again — lost keys, cold storage, deceased holders. Any migration that invalidates old signature schemes strands those funds; any migration that keeps accepting them keeps the quantum hole open. Hybrid-signature transitions (old + new signatures both valid during a window) are the standard answer, and nobody has executed one at scale on a live chain with real value.

This is why "the standards exist" doesn't end the conversation. NIST finished its job; the chains haven't started theirs.

The readiness spectrum, chain by chain​

Shipping post-quantum signatures today. Algorand is the outlier among major chains: Falcon lattice signatures have protected its state proofs since 2022, the first fully post-quantum-signed mainnet transaction landed in November 2025 with over 140,000 following, and its June roadmap ships native Falcon-1024 accounts in Q3 2026 on the way to full-stack resilience by end-2027 — a Google research paper called it likely the most quantum-ready major L1. NEAR enabled quantum-safe signing on mainnet on July 20, 2026. The Quantum Resistant Ledger has used hash-based XMSS as its sole signing scheme since 2018 — genuinely post-quantum by design, securing a rounding error of industry value.

Dated native plans, nothing shipped yet. Ethereum's program is the most credible in this tier: a dedicated post-quantum team stood up in January 2026 with $2 million in research prizes, Vitalik Buterin's February roadmap covering all four exposed areas (BLS validator signatures, KZG data-availability commitments, ECDSA wallet signatures, zero-knowledge proofs), EIP-8141's signature agility graded "must-ship" for the Hegotá hard fork in late 2026, a public hub at pq.ethereum.org, and more than 10 client teams running weekly post-quantum devnets — all aimed at a quantum-resistant L1 by December 2029. Cardano's three-phase plan (quantum-secure model through 2026, a separate proof chain in 2027–2028, full integration from 2029) plus an on-chain governance vote on its quantum strategy earns its grade on process maturity. The XRP Ledger's 2028 target is dated but thin on published mechanics, which is why it shares Cardano's grade rather than beating it.

No dated native plan. This tier names names. Bitcoin's Core developer debate is still unresolved; its only live artifacts are third-party — the BTQ fork's Dilithium testnet (v0.3.0, March 2026) and Project Eleven's qSafe overlay letting custodians sign Dilithium ownership proofs without a consensus change. Neither is a protocol migration, and neither can become one without the consensus change Bitcoin can't agree on.

Solana's position is more active but structurally the same: a Solana Foundation–Project Eleven Dilithium testnet, Falcon signature tests in two validator clients, and co-founder Anatoly Yakovenko warning the network must migrate within five years — real experiments, but no dated native roadmap. BNB Chain, Dogecoin, and Tron have no clear roadmap at all; a 2026 quantum-vulnerability index ranked BNB Chain high-exposure with no clear plan and put Dogecoin alongside Monero among chains lacking roadmaps. Five of the twelve rows — securing the large majority of on-chain value — are here.

The standards are ready; the chains aren't​

One point of precision matters here: the primitives are not the bottleneck, and anyone telling you "we're waiting on NIST" is behind. NIST published three finalized post-quantum standards on August 13, 2024 — FIPS 203 (ML-KEM, the Kyber key-encapsulation mechanism), FIPS 204 (ML-DSA, the Dilithium signature scheme), and FIPS 205 (SLH-DSA, the conservative hash-based SPHINCS+ signatures). Falcon, the lattice signature Algorand and Solana's experiments actually use, is drafted as FN-DSA (FIPS 206) but not yet finalized — close enough to build on, as mainnets are already proving. NIST selected HQC as a code-based backup KEM in March 2025 for diversity of mathematical assumptions.

So the stack reads: standardized algorithms (done 2024), public migration guides and test vectors, and chain-level deployment (two majors shipping, three with dated plans, the rest debating or silent). The gap is entirely in the last layer — protocol upgrades, wallet migrations, and the social coordination to ship them.

Y2K is the precedent — and the warning​

The closest historical analog to a quantum migration isn't a hack or a fork — it's Y2K: infrastructure-wide, cryptographically flavored (dates embedded in every system the way signatures are embedded in every chain), with a hard deadline and a decade of advance warning. Y2K's actual lesson is underappreciated: the reason planes didn't fall out of the sky is that industry spent an estimated $300+ billion over roughly a decade on inventory, remediation, and testing. The "overhyped non-event" narrative is survivorship bias written by people who didn't see the remediation budgets.

Crypto should copy three Y2K moves: inventory first (which addresses hold value under exposed keys — the chains can compute this exactly, since the ledger is public), hybrid transition windows (accept old and new signatures while wallets migrate, the way systems ran dual date formats), and testing at production scale before the deadline (Ethereum's weekly PQ devnets are the right shape). But crypto is worse off than Y2K IT departments in the ways that matter: there is no CIO to mandate the upgrade, no maintenance window to force it in, bearer assets mean every unmigrated key is directly spendable by the attacker rather than merely buggy, and harvest-now-decrypt-later means the deadline already passed for every exposed key — the only question is when someone can execute against the archive. Y2K had a date everyone could see. Q-Day's date is unknown, which makes it easier to postpone and impossible to schedule around.

Catalyst or catastrophe: what to watch​

The question this report raises is whether the quantum threat becomes crypto's catalyst for its biggest coordinated upgrade or a slow-moving catastrophe that fragments the ecosystem. The honest answer, from the report card, is: both, on different chains. Watch the milestones that separate the two paths:

• Late 2026: Ethereum's Hegotá fork — does EIP-8141 signature agility actually ship, giving every wallet an opt-in PQ path?
• Q3 2026: Algorand's native Falcon-1024 accounts — does the furthest-ahead major chain hit its own date?
• 2027–2028: Cardano's proof chain, the XRP Ledger's 2028 target — do dated plans survive contact with implementation?
• 2029: Ethereum's L1 target, IBM's Starling fault-tolerance target — the year the migration deadline and the threat horizon visibly converge.

If Hegotá ships agility and Algorand hits Q3, the industry has its template: hybrid signatures, opt-in migration, devnet-tested rollout. If Bitcoin is still debating while its exposed-key archive grows, the fragmentation scenario writes itself — quantum-ready and quantum-vulnerable chains trading side by side, with the market eventually pricing the difference the way it prices every other security property. The report card's bottom line stands: the cryptography to survive Q-Day exists, two chains are using it, three more have dated plans — and the chains holding most of the money are counting on a deadline that already passed for every key they've ever exposed.

Sources: Web3Caff Research 14,000-word blockchain quantum security report; Project Eleven quantum migration report via CoinDesk, May 9, 2026; Google Quantum AI paper via BeInCrypto/Coinlive, March 2026; Ethereum Foundation PQ announcements and pq.ethereum.org, Jan–Mar 2026; Buterin quantum roadmap, Feb 26, 2026; Algorand roadmap and NEAR mainnet coverage, June–July 2026; DropsTab "Quantum Resistant Crypto" twelve-chain map, Sept 2026; qLABS Quantum Vulnerability Index via TechGaged; BTC dominance via CoinMarketCap/CoinGecko, mid-Sept 2026; NIST FIPS 203/204/205, Aug 13, 2024; Quantum Insider PQC migration assessment, Apr 2026.