Web3 & Blockchain PQC Solution

Public blockchains are among the most exposed systems in the post-quantum transition: their ledgers are open, their security rests almost entirely on digital signatures, and they are notoriously hard to change. This page maps the quantum risk across Web3 assets, lays out the migration approaches that actually fit an immutable, governance-driven environment, and gives a phased roadmap from key inventory to full PQC.

Why now

Blockchains depend on two cryptographic primitives. Account and transaction integrity rest on elliptic-curve signatures — ECDSA over secp256k1 on Bitcoin and Ethereum, and Ed25519 on many newer chains. Proof-of-work and ledger integrity rest on hash functions such as SHA-256 and Keccak.

These two primitives age very differently under quantum attack. Shor's algorithm breaks elliptic-curve cryptography outright: an adversary with a cryptographically relevant quantum computer (CRQC) could derive a private key from its public key, forge signatures, and move funds that are not theirs. Grover's algorithm only halves the effective strength of hash functions, so PoW and hash-based integrity survive with a comfortable margin (and can be hardened by larger outputs).

The Harvest Now, Decrypt Later (HNDL) problem is uniquely acute here, and the "harvest" step is already done. The ledger is public, so capturing data costs nothing. On most chains a public key becomes visible the moment an address transacts — it is published outright, or it is recoverable from the signature in the spending transaction. Any address that has ever transacted, and especially any reused or known-public-key address, is therefore already quantum-vulnerable the day a CRQC appears. Unspent funds at an address that has never revealed its key are comparatively safer — until they are spent.

Risk & asset map

Recommended approaches

• Quantum-safe signatures — replace on-chain signing with ML-DSA (lattice) or SLH-DSA (stateless hash-based), or stateful hash-based one-time schemes (LMS/XMSS) where a single-use signing model fits the protocol. See PQC signatures.
• Hybrid / dual signatures — during transition, attach both an ECDSA and an ML-DSA signature so a transaction is valid only if both verify. This preserves classical compatibility while adding quantum resistance. See hybrid cryptography.
• Account abstraction — on chains that support smart-contract accounts or extensible verification logic, partly elevate the signature scheme to an account property, reducing the dependence of key or algorithm rotation on a base-layer hard fork; the base layer may still need new PQC verification precompiles, gas rules, or transaction-format support. This is the single most practical lever for migratability on programmable chains.
• Quantum-safe wallets — PQC-capable key storage, multisig, and recovery flows; treat first-spend as a key-rotation event so funds move to a fresh PQC-protected address.
• PQC-aware bridges — upgrade threshold/multisig signing on cross-chain validators, which hold concentrated value and are prime forgery targets.
• Permissioned & CBDC chains move faster — with a known validator set and central governance, they can mandate PQC without community-wide hard forks, unlike permissionless networks.

Migration challenges

Web3 migration is harder than almost any other domain:

• Immutable ledgers — history cannot be re-signed; only future transactions and balances can be protected, so exposed value must be actively migrated.
• Hard-fork governance — consensus or signature-format changes require a hard fork and broad community agreement, which can take years on permissionless chains.
• Signature size & fees — PQC signatures are far larger than 64–72 byte EC signatures; they inflate transaction size, raise fees, and stress block-size and gas limits.
• Key migration — every wallet, seed-phrase scheme, and custody system must learn to hold and use PQC keys, and users must be guided to move funds.
• Exchange & custody readiness — exchanges, custodians, and bridges concentrate value and must upgrade signing and key management ahead of the broader ecosystem.

Phased roadmap

Reference case

A digital-currency exchange hybrid scheme — synthesized from the 安全牛 2025 report and documented on our China vendors page — illustrates a production-shaped design: key agreement combines ECDH and ML-KEM through a KDF; signatures are dual ECDSA + ML-DSA; and data encryption uses AES-256 with a Classic McEliece-encapsulated key. The pattern shows how custody and trading infrastructure can adopt PQC without breaking classical interoperability.

Standards & references

• ML-DSA (FIPS 204) — lattice signatures for on-chain and wallet signing.
• SLH-DSA (FIPS 205) — stateless hash-based signatures, conservative security.
• PQC signatures overview — scheme comparison and trade-offs.
• Hybrid cryptography — dual classical + PQC during transition.
• HNDL — why public ledgers make harvesting free.
• Migration overview — the phased program this roadmap instantiates.
• China vendors — the digital-currency exchange hybrid reference case.
• Resources — full standards register