Q-Risk Pack: Every Major Chain's Path to Quantum Resistance

As of Thu 2026-10-08, 16:43 ET. Market caps come from CoinGecko (/simple/price, include_market_cap) and were pulled at 16:38 ET. Chains are sorted by those caps. On-chain stats were pulled 16:30–16:43 ET. Labels used: Fact means verified against a primary source today. Reported means it comes from press, a vendor, or a secondary source. Speculative means it is my inference. Unknown means I could not source it.

Summary

• Ethereum is the only chain with a dated, L1-wide PQ deadline. The EF Protocol cluster (Sep 7 2026) set a target of a quantum-resistant L1 across execution, consensus and data by Dec 2029, with a reassessment in Jan 2027 (Fact). Four lean-consensus PQ devnets have already run (Fact). No PQ signature is live on mainnet.
• Zcash is the only chain that has shipped a consensus-level quantum measure on mainnet. NU6.3 "Ironwood" activated 2026-07-28 at height 3,428,143 (Fact). It makes new notes quantum-recoverable, which is not the same as quantum-secure. The Recovery Protocol itself is still unspecified (Fact, ZIP 2005).
• Bitcoin has specs but no activation path. BIP-360 (P2MR) and BIP-361 (legacy-signature sunset) are merged Drafts (Fact). There is no PQ-signature BIP and no activation client. Exposed supply is 31.2% per Glassnode (Oct 8 2026) and 34.45% per Project Eleven (block 950,000) (Reported).
• Mid-caps are split. TRON (TIP-899, live on Nile testnet, "year-end" mainnet target, Reported) and Sui (ML-DSA-65 mainnet targeted Q1 2027) have dated plans. Solana has app-level Winternitz vaults and Falcon client prototypes, but its Falcon syscall SIMD was closed (Fact). Monero's FCMP++ adds forward secrecy, not PQ spend authority. Hyperliquid has no public plan.
• The threat baseline moved left in 2026. Google Quantum AI estimates ECDLP-256 can be broken with ≤1,200 logical qubits on <500k physical qubits (Mar 31 2026, Fact). ECDSA.fail (Sep 2026) cuts point-addition circuits to 793 logical qubits (Fact). Justin Drake's "bunker mode" warning (Oct 7–8 2026) adds an AI-cryptanalysis tail risk (Reported).
• L2s mostly inherit Ethereum's timeline. Starknet (59) leads, using STARK proofs, native AA, a mainnet Falcon-512 account and BLAKE2s OS hashes. Optimism has a 10-year ECDSA-EOA sunset plan to Jan 2036. Arbitrum has no official plan.

Scoreboard

Ranked by CoinGecko mcap (16:38 ET). Score bands: 🟢 ≥60, 🟡 35–59, 🔴 <35.

L2 group placement basis: the group is ranked by the combined mcap of ARB ($1.171B), STRK ($0.412B), OP ($0.274B) and ZK ($0.124B), which totals ≈$1.98B. Base has no token, so it contributes $0. Using the largest single token (ARB, $1.17B) gives the same rank: below SUI ($4.32B). Within the group, scores are Starknet 59, Optimism 35, zkSync 26, Base 21 and Arbitrum 15.

Extra L1 = TRON. It is #2 by stablecoin supply at $94.22B (DefiLlama, behind Ethereum's $150.77B), had 4,449,621 active accounts and 11.62M transactions on 2026-10-07 (Tronscan), and has an active PQ TIP with a live testnet.

Rubric (0–100). Applied identically to every chain.

Sub-score	Max	What earns points
R: Research depth	15	Published threat models, papers, scheme comparisons, and core-team engagement
S: Spec / proposal	15	Formal BIP/EIP/SIMD/TIP/ZIP text. More points for merged, accepted, or scheduled
I: Implementation / testnet	15	Client code, devnets/testnets running PQ paths, audits
M: Mainnet PQ capability today	20	What a user can do today on mainnet. Native PQ signatures score highest; app-level vaults and recoverability earn partial credit
G: Migration plan for existing funds	20	Concrete path for already-exposed keys and legacy funds, such as sunset rules, recovery proofs, or key rotation
C: Governance momentum / dated commitment	15	Official dated targets, scheduled forks, funding, and absence of blocking disputes

Stages: 0 none · 1 research · 2 spec drafts · 3 testnet/devnet · 4 partial mainnet · 5 full PQ mainnet. Badges in tables: 🟢 done or High likelihood · 🟡 in progress or Med · 🔴 blocked, absent, or Low. Scores are my judgment applied to the sourced facts below (Speculative by nature). The sub-scores are shown so they can be re-weighted.

---

Bitcoin (BTC)

Snapshot

Readiness score: 42 / 100 🟡

The deep research and two merged BIP drafts drive the score. It is held down by having no PQ signature spec, no activation path, and only a nonstandard workaround on mainnet.

Completed milestones

Active proposals

Roadmap

Risks and open questions

• About 1.9M BTC is structurally exposed (P2PK, early coins; Glassnode May 2026 put it at 1.92M) and cannot be protected by its owners if the keys are lost. Whether those coins get frozen is unresolved (Reported).
• Binance's 83% exposure rate means a single exchange's hygiene drives a large share of the operational exposure (Reported).
• Activation politics: there is no activation client or signaling plan, and the 2017-style dispute risk is untested for a freeze proposal (Speculative).
• Signature size and block weight: PQ signatures are 10–100x the size of Schnorr. The fee-market impact is unquantified on-chain (Unknown).

---

Ethereum (ETH)

Snapshot

Readiness score: 65 / 100 🟢

The score comes from an official dated target, a named fork sequence, multi-client PQ devnets and the AA rails (EIP-8141). It is held down because no PQ signature is native on mainnet. Smart-contract wallets can verify PQ signatures only at high gas cost.

Completed milestones

Active proposals

Roadmap

Risks and open questions

• Fork-cadence risk: the Dec 2029 target needs roughly five forks in three years (Speculative).
• Vitalik warned that botched migrations cause losses. Rushing EOA migration could create phishing and loss events (Reported).
• PQ signature sizes vs. consensus bandwidth: leanMultisig/leanVM aggregation is unproven at mainnet scale (Speculative).
• Justin Drake's "bunker mode" (Oct 2026) argues AI could break ECDSA before quantum computers do and advises moving to never-exposed addresses. No practical attack has been shown (Reported).
• ZK rollups and bridges that rely on BN254/KZG precompiles inherit the L1 schedule (Fact).

---

Solana (SOL)

Snapshot

Readiness score: 37 / 100 🟡

App-level vaults are live, and two clients have Falcon prototypes. There is no active PQ SIMD beyond a hash syscall, the migration plan is conditional ("if the threat becomes credible"), and there are no dates.

Completed milestones

Active proposals

Roadmap

Risks and open questions

• Address = public key means no "hash shield." Exposure is close to 100% of non-PDA balances (Fact by construction).
• BLS in Alpenglow will need its own PQ replacement later (Speculative).
• The roadmap is conditional on a threat trigger, so lead time depends on how quickly the trigger can be recognized (Speculative).

---

TRON (TRX), extra L1

Why TRON: #2 chain by stablecoin supply ($94.22B, DefiLlama, pulled today); 4,449,621 active accounts and 11.62M transactions on 2026-10-07 (Tronscan); has an active consensus-level PQ TIP.

Snapshot

Readiness score: 48 / 100 🟡

A detailed TIP and a live testnet drive the score. It is held down because nothing is on mainnet, the mainnet date has already slipped, and the audit plan is undetermined.

Completed milestones

Active proposals

Roadmap

Risks and open questions

• Throughput: reports say PQ signatures could cut TPS by up to 95% in testing (Reported, Coindoo). This has not been verified independently.
• Concentrated governance (27 SRs) makes activation fast but also concentrates the decision (Fact on structure).
• Some wallets may be able to pay but not replace keys under the current design (Reported).
• No audit commitment yet (Fact as of Jul 20).

---

Zcash (ZEC)

Snapshot

Readiness score: 68 / 100 🟢

This is the only chain here with a consensus change on mainnet aimed at the quantum transition, plus a written migration model. It is held down because recoverability is not PQ security, the Recovery Protocol is unspecified, and Tachyon's Ragu stack is unaudited.

Completed milestones

Active proposals

Roadmap

Risks and open questions

• Two critical soundness bugs in shielded pools (2018, 2026) show implementation risk is at least as large as quantum risk (Fact).
• There is now a single full-validator implementation (Zebra) for NU6.3+ (Fact).
• Migration burden: unmigrated Sapling/Orchard value is unrecoverable in the recovery model, and the share already migrated is Unknown.
• Harvest-now-decrypt-later: historical shielded transactions remain exposed to future decryption until ML-KEM ships (Fact by design).

---

Hyperliquid (HYPE)

Snapshot

Readiness score: 5 / 100 🔴

Completed milestones

Active proposals

Roadmap

Risks and open questions

• Closed-source core plus an undocumented consensus signature scheme makes external assessment impossible (Fact).
• The small validator set (27 active) controls the bridge. Quantum or AI key recovery against those keys would be systemic (Speculative).

---

Monero (XMR)

Snapshot

Readiness score: 31 / 100 🔴

Completed milestones

Active proposals

Roadmap

Risks and open questions

• Privacy coins face harvest-now-decrypt-later on all historical transactions. Forward secrecy only protects new Carrot outputs (Fact by design).
• Inflation detection under a quantum adversary is unsolved for legacy outputs (Reported, MRL).
• The FCMP++ timeline has repeatedly been "when ready" with no date (Fact).

---

Sui (SUI)

Snapshot

Readiness score: 54 / 100 🟡

The score is driven by the chosen NIST schemes, dated targets and an in-place key-rotation path. It is held down because nothing PQ is on mainnet yet.

Completed milestones

Active proposals

Roadmap

Risks and open questions

• Validator BLS and zkLogin are not covered by the announced plan (Fact by omission).
• ML-DSA-65 signatures (3,309 bytes per FIPS 204) increase transaction size and storage (Fact on size; throughput impact Unknown).

---

Ethereum L2s (grouped)

Group mcap: combined ARB+STRK+OP+ZK ≈ $1.98B. The largest token is ARB at $1.171B. Base has no token. Either basis ranks the group below SUI. Shared dependency: all five settle to Ethereum L1. Their bridges, blob data (KZG) and any L1 ECDSA/BLS signer inherit Ethereum's Dec 2029 timeline (Fact).

Arbitrum (ARB, $1.171B): score 15 🔴

Base (no token): score 21 🔴

Optimism / OP Stack (OP, $0.274B): score 35 🟡

zkSync (ZK, $0.124B): score 26 🔴

Starknet (STRK, $0.412B): score 59 🟡

---

Cross-chain takeaways

1. Hash-based is winning at the base layer, lattice at the account layer. ETH lean consensus uses XMSS/leanSig, BTC's leading candidate is SHRINCS/SLH-DSA, and Sui vaults use SLH-DSA. Accounts on Sui, TRON, Solana prototypes and Starknet use ML-DSA or Falcon (Fact). The pending FIPS 206 (Falcon) is a gating item for TRON's FN-DSA and some Solana designs (Fact).
2. Account abstraction is the migration rail. Chains with native AA or key rotation (Starknet, zkSync, Sui aliases, ETH via EIP-8141/7702, TRON's key registry) can move users without moving funds. Bitcoin and Monero cannot, so they need new output types and turnstiles (Fact by design).
3. Exposure measurement is diverging. BTC estimates range from 31.2% (Glassnode) to 34.45% (Project Eleven) and 20–50% (Chaincode). ETH estimates of 50–65% trace back to a 2021 Deloitte figure. Treat any single "% exposed" number as methodology-dependent (Reported).
4. Dated commitments now exist in four places: ETH (Dec 2029), Sui (Q1 2027), TRON (year-end 2026, already slipped once), and OP (Jan 2036). Zcash has a dated end-2027 crypto target from one org. Bitcoin, Solana, Monero, Hyperliquid, Arbitrum and zkSync have none (Fact).
5. New classical surfaces keep being added. Solana's Alpenglow BLS, zkSync's BN254 wrapper, Ethereum KZG blobs and Sui's zkLogin SNARK all add pairing-based dependencies that will need their own migration (Fact).
6. Implementation bugs and AI cryptanalysis compete with quantum as the near-term risk. Examples: the Zcash Orchard bug, AI weakening HAWK, and Drake's "bunker mode" warning (Reported).

Timeline of expected milestones

WHAT COULD I BE WRONG ABOUT?

• Scores are judgment calls. Zcash outranks Ethereum only because shipped mainnet changes are weighted at 20+20 points. Weighting dated commitments more heavily would flip them. The sub-scores are shown so they can be re-weighted.
• Timelines from founders slip. TRON already moved from Q3 to year-end, and Sui's "2026" vault target has under 3 months left. Glamsterdam's December date is tentative, and the official schedule says TBD.
• Exposure figures are methodology-driven. The Glassnode 31.2%, Project Eleven 34.45% and ETH 55–60% figures all count visible pubkeys, not economically attackable coins. Project Eleven's filtered "attractive" set is only 351,654 BTC (Reported).
• Threat timing could move either way. Google's <500k-physical-qubit estimate and ECDSA.fail's 793-logical-qubit point-addition circuit are resource estimates, not demonstrations. ECDSA.fail's figure is per point-addition, not a full attack. AI-cryptanalysis warnings (Drake) are unproven.
• I may have missed non-public or non-English work, especially for Hyperliquid (closed source), Arbitrum (no official plan found) and Solana client repositories.
• Some items are unverified. These include the Base EIP-8130 mainnet status, the Sui validator signature scheme, the Sui address-alias mainnet status, the pq-devnet-4 status, the HyperBFT signature scheme, and the Nile build and proposal numbers (from press).
• The extra-L1 choice is debatable. BNB ($97.5B) and XRP ($86.8B) are larger by mcap. TRON was picked on usage (stablecoin settlement) plus active PQ work. Using pure mcap would favor BNB.

Sources / technical notes

Market and on-chain data (pulled 2026-10-08, 16:30–16:43 ET)

• CoinGecko simple price API: https://api.coingecko.com/api/v3/simple/price
• mempool.space (BTC height, hashrate): https://mempool.space/
• validatorqueue.com (ETH validators and staked ETH): https://www.validatorqueue.com/
• Solana JSON-RPC (getVoteAccounts, getAgGenesisCert): https://api.mainnet-beta.solana.com
• Hyperliquid info API (validatorSummaries): https://api.hyperliquid.xyz/info
• xmrchain.net (XMR height, hashrate): https://xmrchain.net/
• Tronscan (TRON accounts, txs, nodes): https://tronscan.org/
• DefiLlama stablecoins by chain: https://defillama.com/stablecoins/chains

Threat baseline and standards

• Google Quantum AI blog: https://research.google/blog/safeguarding-cryptocurrency-by-disclosing-quantum-vulnerabilities-responsibly/
• Google whitepaper (arXiv 2603.28846): https://arxiv.org/abs/2603.28846
• IACR eprint 2026/625: https://eprint.iacr.org/2026/625
• ECDSA.fail (arXiv 2609.09582): https://arxiv.org/abs/2609.09582
• NIST FIPS 203: https://csrc.nist.gov/pubs/fips/203/final
• NIST FIPS 204: https://csrc.nist.gov/pubs/fips/204/final
• NIST FIPS 205: https://csrc.nist.gov/pubs/fips/205/final
• Drake "bunker mode" (CoinDesk): https://www.coindesk.com/tech/2026/10/08/bitcoin-and-ether-holders-urged-to-prepare-bunker-mode-against-possible-ai-attacks
• Drake "bunker mode" (The Block): https://www.theblock.co/news/ecosystems/2026-10-07-ethereum-researcher-justin-drake-bunker-mode-planning-private-key-recovery-risk-417954

Bitcoin

• BIP-360: https://github.com/bitcoin/bips/blob/master/bip-0360.mediawiki
• BIP-360 merge PR: https://github.com/bitcoin/bips/pull/1670
• Latest BIP-360 edits PR: https://github.com/bitcoin/bips/pull/2223
• BIP-361: https://github.com/bitcoin/bips/blob/master/bip-0361.mediawiki
• SHRINCS (Blockstream): https://blog.blockstream.com/shrincs-324-byte-stateful-post-quantum-signatures-with-static-backups/
• OP_CHECKSHRINCS (Blockstream): https://blog.blockstream.com/op_checkshrincs-a-hash-based-signature-opcode-for-post-quantum-bitcoin/
• SHRINCS draft spec: https://github.com/SHRINCS/shrincs-bip/blob/main/SHRINCS.md
• StarkWare QSB: https://starkware.co/blog/the-first-quantum-safe-bitcoin-transaction-has-been-mined/
• Glassnode exposure (CoinDesk, Oct 8 2026): https://www.coindesk.com/markets/2026/10/08/over-6-million-bitcoin-sit-behind-exposed-public-keys-as-ai-warnings-mount
• Project Eleven at block 950,000 (Bitcoin Magazine): https://bitcoinmagazine.com/print/the-quantum-issue-bitcoin-quantum-exposure-at-block-950000
• Galaxy initiative: https://www.galaxy.com/newsroom/galaxy-launches-bitcoin-quantum-readiness-initiative
• Bitcoin Security Consortium (Strategy press release): https://www.strategy.com/press/leading-financial-institutions-bitcoin-companies-launch-the-bitcoin-security-consortium_07-23-2026
• Bitcoin Security Consortium (CoinDesk): https://www.coindesk.com/business/2026/07/23/blackrock-coinbase-strategy-in-group-pledging-usd15-million-to-prepare-bitcoin-for-quantum-threats

Ethereum

• EF Protocol priorities (Sep 7 2026): https://blog.ethereum.org/2026/09/07/protocol-priorities
• Glamsterdam testnet announcement: https://blog.ethereum.org/2026/09/17/glamsterdam-testnet-announcement
• pq.ethereum.org: https://pq.ethereum.org/
• Strawmap: https://strawmap.org/
• leanEthereum pm (devnets): https://github.com/leanEthereum/pm
• leanSpec: https://github.com/leanEthereum/leanSpec
• EIP-8141: https://eips.ethereum.org/EIPS/eip-8141
• EIP-7805: https://eips.ethereum.org/EIPS/eip-7805
• EIP-8365: https://eips.ethereum.org/EIPS/eip-8365
• EIP-8051: https://eips.ethereum.org/EIPS/eip-8051
• EIP-8052: https://eips.ethereum.org/EIPS/eip-8052
• ETH exposure (arXiv 2606.14484): https://arxiv.org/abs/2606.14484
• The Block on the 2029 target: https://www.theblock.co/news/ecosystems/2026-09-08-ethereum-foundation-quantum-resistance-2029-413716

Solana

• Solana quantum readiness (Apr 27 2026): https://solana.com/news/quantum-readiness
• Jump Crypto migration paths: https://jumpcrypto.com/resources/quantum-migration-paths-for-solana
• Blueshift Winternitz vault: https://github.com/blueshift-gg/solana-winternitz-vault/
• SIMD-0461 PR: https://github.com/solana-foundation/solana-improvement-documents/pull/461
• SIMD-0563 PR: https://github.com/solana-foundation/solana-improvement-documents/pull/563
• SIMD-0579 PR: https://github.com/solana-foundation/solana-improvement-documents/pull/579
• BLS pubkey and VAT: https://solana.com/upgrades/bls-pubkey-vat
• Alpenglow: https://solana.com/upgrades/alpenglow

TRON

• TIP-899: https://github.com/tronprotocol/tips/issues/899
• Sun year-end target: https://www.livebitcoinnews.com/tron-targets-quantum-resistant-network-upgrade-by-year-end/
• Key-replacement limitation: https://cryptonews.net/news/altcoins/33441512/
• TPS impact report: https://coindoo.com/tron-quantum-signatures-cut-tps/

Zcash

• ZIP 2005: https://zips.z.cash/zip-2005
• ZIP 258: https://zips.z.cash/zip-0258
• ZIP 259: https://zips.z.cash/zip-0259
• Ironwood Book on quantum recoverability: https://zcash.github.io/ironwood/concepts/quantum-recoverability.html
• Epoch announcement: https://forum.zcashcommunity.com/t/epoch-future-proof-cryptography-for-zcash/57955
• Orchard bug (ZF): https://zfnd.org/zebra-4-5-3-and-5-0-0-emergency-soft-fork-and-nu6-2-activation/
• Orchard bug advisory: https://github.com/advisories/GHSA-ww9q-8r59-xv46

Hyperliquid

• qVAULT commercial availability: https://www.newsfilecorp.com/release/301993/01-Quantum-and-qLABS-Announce-qVAULT-Commercial-Availability

Monero

• Stressnet v3.0: https://monero.observer/fcmp++-carrot-beta-stressnet-v3.0-released/
• MRL #151: https://github.com/monero-project/research-lab/issues/151
• MRL #159: https://github.com/monero-project/research-lab/issues/159
• Jamtis (tevador): https://gist.github.com/tevador/639d083c994c1ef9401832c08e2b7832
• CCS !663: https://repo.getmonero.org/monero-project/ccs-proposals/-/merge_requests/663

Sui

• Making Sui Quantum Ready: https://www.sui.io/blog/making-sui-quantum-ready
• Sui's post-quantum signature schemes: https://www.sui.io/blog/suis-post-quantum-signature-schemes
• eprint 2025/1368: https://eprint.iacr.org/2025/1368

L2s

• Arbitrum forum PQ overview: https://forum.arbitrum.foundation/t/post-quantum-cryptography-risk-in-arbitrum-smart-contracts-a-technical-overview/31027
• Stylus ML-DSA-65 verifier: https://doc.quantum.systems/smart-account/stylus-verifier
• eprint 2026/1660: https://eprint.iacr.org/2026/1660
• Coinbase PQ blog: https://www.coinbase.com/blog/what-coinbase-is-doing-to-prepare-for-post-quantum-cryptography
• Base Cobalt overview: https://docs.base.org/upgrades/cobalt/overview
• EIP-8130: https://eips.ethereum.org/EIPS/eip-8130
• Optimism PQ roadmap: https://optimism.io/blog/a-post-quantum-roadmap-for-the-superchain
• zkSync Airbender: https://docs.zksync.io/zk-stack/components/zksync-airbender
• L2BEAT Airbender: https://l2beat.com/zk-catalog/airbender
• StarkWare Starknet PQ roadmap: https://starkware.co/blog/the-architecture-advantage-starknets-quantum-readiness-roadmap/
• Starknet migration register: https://quantum.starkware.co/migration-register
• OpenZeppelin Cairo PQ verifiers: https://github.com/OpenZeppelin/cairo-pq-verifiers
• Starknet blog on quantum resistance: https://www.starknet.io/blog/quantum-resistance/

Technical notes

• CoinGecko last_updated_at = 1791491818. Box clock at pull: 16:38:39 EDT.
• Solana getAgGenesisCert returned null at 16:43 ET, meaning mainnet is on TowerBFT.
• Sui stats came from GraphQL (JSON-RPC is deprecated).
• The ETH validator count came from an aggregator because beaconcha.in requires an API key.
• Blockchair confirms Zcash block 3,428,143 at 14:07 UTC (10:07 ET) on 2026-07-28.