NIST published the final version of Internal Report 8547 on October 27, 2026, setting hard deadlines to deprecate all elliptic curve cryptography (ECC) and RSA public-key algorithms after 2030 and disallow them entirely after 2035. The timeline applies to every approved key size, including the se...
"Ethereum's target of 2029 to become quantum-safe is too late, and deadlines slip." — Eli Ben-Sasson, CEO, StarkWare
NIST published the final version of Internal Report 8547 on October 27, 2026, setting hard deadlines to deprecate all elliptic curve cryptography (ECC) and RSA public-key algorithms after 2030 and disallow them entirely after 2035. The timeline applies to every approved key size, including the secp256k1, P-256, and Ed25519 curves that underpin transaction signing on Bitcoin, Ethereum, Solana, and virtually every other major blockchain.
The implications are structural. Approximately 6.9 million BTC — roughly one-third of circulating supply, valued at an estimated $560 billion — sit in quantum-vulnerable addresses, according to Project Eleven's May 2026 report. For Ethereum, Deloitte estimates over 65% of all Ether resides in quantum-exposed addresses. Europol, in two reports published October 7, 2026, identified cryptocurrency wallets as "the primary point of exposure to quantum threats," urging pre-emptive migration before quantum-capable hardware arrives.
No top-20 blockchain by market capitalization currently uses quantum-resistant signature algorithms in production. Multiple chains have published migration roadmaps — Bitcoin's BIP 360/361, Ethereum's post-quantum security team, Solana's Falcon-based strategy — but none have completed a full transition. The gap between NIST's deprecation clock and blockchain governance timelines creates a measurable policy and security risk for an industry holding over $2 trillion in digital assets.
NIST's final IR 8547, published October 27, 2026, materially tightened the post-quantum transition schedule relative to its November 2024 draft. The draft had exempted signatures at 128-bit security or higher (P-256, P-384, RSA-3072, Ed25519) from the deprecation step, scheduling only a 2035 disallowance. The final version eliminates that exemption: all quantum-vulnerable public-key algorithms face deprecation after 2030 and disallowance after 2035, regardless of key size.
Three specific deadlines matter for blockchain infrastructure:
NIST's replacement suite consists of four families of post-quantum digital signature algorithms and one family of quantum-resistant key-encapsulation mechanisms (Module-Lattice-Based KEM, standardized as FIPS 203). These are not blockchain-specific standards, but their adoption by regulated financial institutions — the same institutions now entering tokenized asset markets — will create compliance pressure that flows into on-chain infrastructure.
Every major blockchain uses some form of elliptic curve cryptography for transaction signing. Bitcoin uses secp256k1 ECDSA. Ethereum uses secp256k1 ECDSA for externally owned accounts and BLS12-381 for validator attestations. Solana uses Ed25519. All are vulnerable to Shor's algorithm on a fault-tolerant quantum computer.
The scale of exposure is quantifiable:
| Chain | Signature Scheme | Vulnerable Assets | Source | |-------|-----------------|-------------------|--------| | Bitcoin | secp256k1 ECDSA | ~6.9M BTC (~$560B) in exposed addresses | Project Eleven, May 2026 | | Ethereum | secp256k1 ECDSA + BLS12-381 | >65% of ETH in exposed addresses | Deloitte | | Solana | Ed25519 | All accounts (public keys visible on-chain) | Helius/Solana Foundation |
Project Eleven's Bitcoin Risq List breaks down the 6.9 million exposed BTC by category. Address reuse accounts for 4.99 million BTC, or 72% of the total. P2TR (Taproot) outputs encode an x-only public key in the address itself, making every Taproot output vulnerable from the moment it receives funds. For Ethereum, the account model and public-key recovery from signed transactions create broader exposure than Bitcoin's UTXO model.
Google Quantum AI's March 2026 research estimated that breaking 256-bit ECC could require roughly 1,200 logical qubits — a 65% reduction from earlier estimates. Current hardware stands at approximately 1,000-1,200 physical qubits, a gap of roughly 400-500x when accounting for error correction overhead. Most expert timelines place a cryptographically relevant quantum computer (CRQC) between 2031 and 2035, with Google's own estimate as early as 2029.
Bitcoin Improvement Proposal 360 (BIP 360) introduced a quantum-resistant output type, and BIP 361 laid out a three-phase plan to sunset ECDSA and Schnorr signature spends. BTQ Technologies deployed BIP 360 on Bitcoin's quantum testnet in early 2026. The migration plan forces a hard choice: coins in addresses whose public keys are already exposed must be moved to new quantum-resistant addresses, or they remain vulnerable. Coins that are not moved within a grace period could, under one proposal variant, be frozen — a governance decision with no precedent in Bitcoin's history.
Status: Testnet only. No mainnet activation timeline. Governance consensus on frozen-coin policy unresolved.
The Ethereum Foundation formed a Post-Quantum Security team in January 2026, led by Thomas Coratger. Vitalik Buterin's February 2026 roadmap identified four areas requiring post-quantum upgrades: account signatures (ECDSA), validator attestations (BLS), zero-knowledge proof systems, and the random beacon. Account abstraction (EIP-4337) provides a path for users to adopt post-quantum signatures without a hard fork, but this requires individual wallet migration.
Ethereum's stated target for quantum safety is 2029, which Starknet CEO Eli Ben-Sasson has publicly criticized as too slow. Starknet's October 2026 governance vote — 93.52% in favor of researching an independent post-quantum Layer 1 — was motivated in part by Ethereum's timeline.
Status: Research phase. Account abstraction available but unused for PQC. No hard fork scheduled.
The Solana Foundation, Anza, and Jump Crypto's Firedancer team published a quantum readiness roadmap on April 27, 2026. Both Anza and Firedancer independently selected Falcon as the post-quantum signature scheme. The plan phases new wallets onto PQC first, with existing wallet migration triggered only when threats are confirmed. Blueshift's Winternitz Vault — a hash-based one-time signature scheme — has been available for over two years and was cited by Google Quantum AI as a leading example of proactive PQC work.
Status: Roadmap published. Falcon selected. No mainnet deployment date.
Algorand executed a post-quantum transaction on mainnet using Falcon signatures in November 2025 through an opt-in account abstraction path. Its roadmap targets broader quantum resilience by end of 2027, including native post-quantum accounts, wallet and SDK support, post-quantum multisig, and quantum-resistant VRFs for consensus.
Status: Falcon on mainnet (opt-in). Full transition targeted for 2027.
QRL (Quantum Resistant Ledger) launched with XMSS post-quantum signatures from genesis in 2018 and is moving toward SPHINCS+. Abelian and Cellframe also claim protocol-level quantum resistance. These chains hold minimal market share — QRL's market capitalization is under $50 million — but serve as existence proofs that post-quantum blockchain operation is technically feasible.
Europol's October 7, 2026 report on "harvest now, decrypt later" (HNDL) attacks outlines a specific threat to blockchain systems. Because all Bitcoin and Ethereum transaction signatures are permanently recorded on public ledgers, an adversary can collect signed transactions today and attempt private key recovery when quantum hardware becomes available.
The 2026 Thales Quantum & AI Threat Report names HNDL the top quantum concern, cited by 61% of surveyed organizations. Citi's research estimates between $350 billion and $500 billion in Bitcoin at direct quantum risk.
For blockchain systems, the HNDL problem is structurally worse than for traditional IT systems. Encrypted enterprise data can be re-encrypted or rotated. Blockchain addresses holding exposed public keys cannot be retroactively protected — the only remedy is moving funds to a new, quantum-resistant address type that does not yet exist on most chains.
Europol found "no clear evidence" that HNDL collection is occurring systematically at scale against cryptocurrency networks. However, the agency noted that the low cost of data storage and the public availability of blockchain data make the attack economically trivial.
Post-quantum signatures are substantially larger than their classical counterparts. Falcon-512 signatures are 666 bytes, compared to 64 bytes for Ed25519 or 71 bytes for ECDSA. SPHINCS+ signatures range from 7,856 to 49,856 bytes depending on the parameter set. This 10-700x increase in signature size directly impacts transaction throughput, block size, and storage costs.
For Bitcoin, one academic study flagged a DDoS risk during migration: if millions of users simultaneously create migration transactions with larger post-quantum signatures, the network could face sustained congestion. Lattice-based aggregate signature schemes have been proposed to mitigate this, but none are production-ready.
Governance presents a parallel bottleneck. Bitcoin's consensus mechanism requires broad community agreement for any hard fork, and the frozen-coin question — what happens to BTC that is not migrated before a quantum threat materializes — divides the community along philosophical lines. Ethereum's account abstraction pathway avoids a hard fork for individual users but does not address the validator attestation layer (BLS), which does require a protocol-level change.
NIST's IR 8547 applies directly only to U.S. federal systems and contractors. However, its influence extends further: regulated financial institutions, including those entering tokenized asset markets through the DTCC, J.P. Morgan, and Citi's recently launched tokenization platforms, will face compliance requirements to transition off quantum-vulnerable cryptography. Any on-chain infrastructure that interacts with these institutions — bridges, settlement layers, custody systems — inherits the same migration pressure.
NIST's IR 8547 converts the quantum threat from an abstract research concern into a dated compliance obligation. The 2030 deprecation and 2035 disallowance deadlines apply directly to federal systems, but their gravitational pull extends to every institution touching regulated finance — including the banks, asset managers, and exchanges now building on blockchain rails.
The technical solutions exist in various stages of readiness. Falcon, SPHINCS+, and lattice-based KEMs are standardized. Algorand has demonstrated mainnet post-quantum transactions. Bitcoin and Ethereum have published credible roadmaps. The bottleneck is not cryptography; it is governance speed, signature size economics, and the coordination problem of migrating billions of dollars in assets across decentralized networks with no central authority to mandate upgrades.
The clock started October 27. The industry's track record on meeting externally imposed deadlines — MiCA compliance, tax reporting frameworks, custody standards — suggests the transition will be neither smooth nor early.