Blockchain Quantum Readiness Index / Ethereum
L1 · EVM
Ethereum
Users and validators still sign with elliptic-curve keys, and a probe of recently active accounts found almost all sampled value behind already-revealed public keys. Ethereum has an official post-quantum roadmap: hybrid post-quantum smart accounts run on the Sepolia testnet, the transaction type for native post-quantum accounts is scheduled for the Hegotá upgrade, hash-based consensus signatures run on client developer networks, and core infrastructure targets around 2029.
Last reviewed 2026-10-19
Is Ethereum quantum safe?
Not yet. Ethereum is at Stage 3 (Testnet) in LimeChain's Blockchain Quantum Readiness Index, with a progress score of 40/100. Post-quantum accounts run on a testnet, or on mainnet without keeping funds safe at rest, so users cannot rely on them yet.
What Ethereum needs for Stage 4: Live option
- Stage 4 needs PQ user accounts on mainnet that keep funds at rest out of reach of ECC keys (U is: testnet, hold: hidden-until-spend)
Caps and adjustments
- cap 40: users cannot hold and spend funds under a production PQ mechanism on mainnet
- cap 60: consensus PQ not even on testnet
Rosette slices
| Slice | State | Points | Weight | Reason & evidence |
|---|---|---|---|---|
| U User keys | Testnet At rest: Hidden until first spend Best option: a never-sent EOA; the address is the last 20 bytes of Keccak-256 of the secp256k1 public key, revealed only by the first signature. No PQ smart account is on mainnet: the ZKNOX/Kohaku PQ ERC-4337 account is deployed only on Sepolia testnets (designed as a hybrid with ECDSA), and ZKNOX's PQbeat tracker still lists the verifier contracts as pending deployment. |
6/10 | 25 | EOAs verify secp256k1 ECDSA and 99.99% of sampled account value has its public key already on-chain (results/ethereum.json block 26123645). The official ethereum/kohaku pq-account (ERC-4337, ML-DSA or Falcon plus ECDSA, both required) is deployed on Sepolia (factory 0xF451...8C2e, 6,500 bytes of code, measured 2026-10-19); nothing is on mainnet. Native PQ accounts depend on EIP-8141 (Frame Transaction), now Scheduled for Inclusion in Hegotá (EIP-8081) but still a Draft. |
| C Consensus | In development | 4/10 | 20 | Mainnet attestations use BLS12-381. The EF roadmap commits to replacing BLS with hash-based leanXMSS, and 10+ client teams run weekly PQ interop devnets, but nothing is on a public testnet yet. |
| P Proof system | Not applicable | — | — | L1 with no validity or fraud proof system. no evidence |
| B Bridges & messaging | Not applicable | — | — | Ethereum L1 is the settlement layer, with no canonical bridge: the ethereum.org bridges doc describes only L2-native and third-party bridges, none protocol-operated. Sources 10 |
| A Admin & upgrade keys | Not applicable | — | — | No admin or upgrade keys: governance is off-chain social consensus over EIPs, implemented by client teams and activated via network upgrades; no one owns the protocol. Sources 11 |
| M Migration & recovery | Planned | 2/10 | 15 | Official EF roadmap: move all accounts to quantum-safe authentication via account abstraction 'without a disruptive flag day' and complete core PQ infrastructure by ~2029; no ratified activation date (dormant-fund handling has no consensus). |
Stage gates
| Requirement | Status | Details & evidence |
|---|---|---|
| Current audit of the deployed PQ signing code (Stage 5) | Not met | not claimed |
| Admin timelock of at least 30 days with a PQ override (Stage 6, alternative to PQ admin keys) | Not met | not claimed |
| Ratified migration plan with an activation date (Stage 6) | Not met | not claimed |
| New accounts PQ or hybrid by default (Stage 6) | Not met | not claimed |
| ECC sunset enforced (Stage 7) | Not met | not claimed |
PQ adoption published, not scored
There are no PQ accounts on mainnet yet. Having PQ accounts does not mean people move to them. This tracks the share of value and accounts that actually moved, over time.
Measured exposure published, not scored
Only recently active addresses are sampled, so on account chains almost every sampled key is already revealed. The score will use this once a full-state snapshot exists.
Native value by account class
| Account class | Addresses | Native balance | Share |
|---|---|---|---|
| EOA, key revealed | 670 | 365,373 | 14.39% |
| EIP-7702 delegated EOA | 66 | 630 | 0.02% |
| EOA, key not revealed | 68 | 21.27 | 0.00% |
| Contract | 187 | 2,173,035 | 85.58% |
Pinned at block 26,123,645, hash 0x927e15c9484d297500800f703712a12b27adeeeeea8f1b1528511a4c4baad2cb, RPC https://ethereum-rpc.publicnode.com.
Method: active-address sample (biased toward revealed keys); native asset only. 0 RPC errors.
Evidence and sources (11)
Every non-zero rating above cites at least one of these public sources.
- ethereum.org/roadmap/security/quantum-resistance/
- pq.ethereum.org/
- eips.ethereum.org/EIPS/eip-8141
- raw.githubusercontent.com/ethereum/kohaku/master/packages/pq-…
- github.com/ethereum/kohaku/blob/master/packages/pq-account/de…
- eips.ethereum.org/EIPS/eip-8081
- ethereum.org/en/developers/docs/accounts/
- raw.githubusercontent.com/ZKNoxHQ/kohaku/master/packages/pq-a…
- raw.githubusercontent.com/ZKNoxHQ/PQbeat/main/readme.md
- ethereum.org/en/developers/docs/bridges/
- ethereum.org/en/governance/
Source: chains/ethereum.json. Reproduce: python3 score.py chains/ethereum.json
Building on Ethereum?
LimeChain helps teams plan their post-quantum migration: what is exposed, what to change first, and the engineering to get there.
Talk to usOpen, repeatable scoring. Non-zero ratings need public evidence; missing evidence means unknown. Methodology v0.4 · mechanism registry 2026-10-13.