Update future-proofing page + add post-quantum cryptography subpage #17943

---
title: Future-proofing Ethereum
description: These upgrades cement Ethereum as the resilient, decentralized base layer for the future, whatever it may hold.
lang: en
image: /images/roadmap/roadmap-future.png
alt: "Ethereum roadmap"
template: roadmap
---

Some parts of the roadmap are not necessarily required for scaling or securing Ethereum in the near-term, but set Ethereum up for stability and reliability far into the future.

## Quantum resistance {#quantum-resistance}

Some of the [cryptography](/glossary/#cryptography) securing present-day Ethereum will eventually be vulnerable to quantum computers. Recent research has accelerated the timeline for taking this seriously. In March 2026, Google Quantum AI published a paper showing that breaking 256-bit elliptic curve cryptography could require roughly 1,200 logical qubits, about 20 times fewer than previous estimates suggested. Google has set a 2029 internal deadline for migrating its own systems to post-quantum cryptography.

This does not mean quantum computers can break Ethereum today. Current quantum hardware is far from the scale needed. But the research community now treats post-quantum preparation as a priority rather than a distant concern.

### What is vulnerable?

Vitalik Buterin outlined four areas of Ethereum's cryptography that need post-quantum upgrades:

1. **Consensus-layer BLS signatures**: The [proof-of-stake](/glossary/#pos) protocol relies on BLS signatures to aggregate validator votes on valid [blocks](/glossary/#block). These are broken by sufficiently powerful quantum computers.
2. **Data availability (KZG commitments)**: The ["KZG" commitment schemes](/roadmap/danksharding/#what-is-kzg) used across Ethereum are quantum-vulnerable. Current mitigations rely on trusted setups where many users generated randomness that cannot be reverse-engineered by a quantum computer, but the long-term solution is to replace them with quantum-safe alternatives.
3. **EOA signatures (ECDSA)**: The signature scheme protecting individual Ethereum accounts. A quantum computer could derive a private key from a public key, potentially allowing theft of funds from exposed accounts.
4. **Application-layer ZK proofs**: Zero-knowledge proof systems used by rollups and other applications rely on cryptographic assumptions that quantum computers could undermine.

### What is being done?

The Ethereum Foundation formed a dedicated Post-Quantum Security team in January 2026, led by Thomas Coratger. The team launched [pq.ethereum.org](https://pq.ethereum.org) in March 2026 as a central hub for tracking post-quantum research and progress.

Active work includes:

- **leanXMSS**: A hash-based signature scheme being developed for validators as a quantum-resistant replacement for BLS signatures.
- **leanVM**: A minimal zkVM for SNARK-based signature aggregation, designed to maintain the efficiency benefits of BLS while using quantum-safe cryptography.
- **Weekly interop devnets**: More than 10 client teams participate in regular post-quantum interoperability testing.
- **Poseidon Prize**: A $1 million research prize targeting improvements in hash-based cryptographic primitives.

The national standards body NIST finalized three post-quantum cryptography standards in August 2024: ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205). These provide a foundation that Ethereum's post-quantum work builds upon.

### Signature agility through account abstraction

A key part of the transition strategy is EIP-8141, which introduces native [account abstraction](/roadmap/account-abstraction/). This allows individual accounts to choose their own signature verification logic, meaning users could switch to post-quantum signature schemes without requiring a single protocol-wide migration. EIP-8141 is being considered for the Hegota hard fork in the second half of 2026.

### Timeline

The Ethereum Foundation has outlined structured fork milestones for post-quantum L1 upgrades, with a target of completing the transition by 2029. This is active, ongoing work. Not all details are finalized, and timelines may shift as research progresses.

<InfoBanner>
Want to go deeper? Visit <a href="https://pq.ethereum.org">pq.ethereum.org</a> for the latest research, devnet progress, and technical details. Or read our <a href="/roadmap/future-proofing/quantum-resistance/">detailed guide to post-quantum cryptography on Ethereum</a>.
</InfoBanner>

[Read about KZG and trusted setups](/roadmap/danksharding#what-is-kzg)

## Simpler and more efficient Ethereum {#simpler-more-efficient-ethereum}

Complexity is a risk. The more complex a protocol becomes, the harder it is to audit, maintain, and reason about. Ethereum's roadmap includes ongoing efforts to simplify the protocol and remove technical debt.

### Recent simplification progress

Several recent network upgrades have delivered meaningful simplification and efficiency gains:

- **Pectra (May 2025)**: Introduced EIP-7702, which allows externally owned accounts to temporarily delegate to smart contract code. This is a stepping stone toward full account abstraction. Pectra also added the BLS12-381 precompile (EIP-2537), on-chain deposit handling (EIP-6110), historical block hash access in the EVM (EIP-2935), and increased the maximum effective balance for validators (EIP-7251).
- **Fusaka (December 2025)**: Deployed PeerDAS (EIP-7594), a peer-to-peer data availability sampling system that distributes the data availability workload across the network. Fusaka also increased blob parameters, expanding Ethereum's data throughput for rollups.
- **Glamsterdam (planned, H1 2026)**: Expected to include enshrined Proposer-Builder Separation (EIP-7732), block-level access lists (EIP-7928), and gas repricing to better align costs with actual resource consumption.
- **Hegota (planned, H2 2026)**: Expected to include Verkle Trees, which replace the current Merkle Patricia trie with a more efficient data structure. This enables stateless clients and significantly reduces the data validators need to store and transmit. Hegota is also targeted to include EIP-8141 for native account abstraction.

### Ongoing work

Efforts to simplify the EVM, harmonize client implementations, and remove deprecated features continue across the Ethereum development community. The restriction of `SELFDESTRUCT` (EIP-6780), implemented in the Dencun upgrade (March 2024), removed a long-standing source of complexity in state management.

## Current progress {#current-progress}

Future-proofing Ethereum involves both near-term simplification and longer-term cryptographic upgrades. Here is where things stand as of early 2026:

**Simplification and efficiency**: Significant progress. Pectra and Fusaka delivered real improvements in account flexibility, data availability, and validator operations. Glamsterdam and Hegota are in active development with clear EIP targets.

**Post-quantum cryptography**: Active research and early implementation. The Ethereum Foundation has a dedicated team, funded research prizes, and weekly interop devnets running across multiple clients. Standardized post-quantum algorithms exist (NIST finalized three in 2024). However, full quantum resistance for core Ethereum protocols is still in development and the structured fork milestones target 2029 for completion.

**Account abstraction and signature agility**: EIP-8141, being considered for Hegota (H2 2026), will allow accounts to use any signature scheme. This is a critical bridge that lets individual users adopt post-quantum signatures before the full protocol transition is complete.

No part of this work is finished. Timelines are targets, not guarantees. But the scope and pace of active development represent a clear commitment to keeping Ethereum secure and efficient for the long term.

**Further reading**

- [pq.ethereum.org](https://pq.ethereum.org)
- [Gas](/developers/docs/gas)
- [EVM](/developers/docs/evm)
- [Data structures](/developers/docs/data-structures-and-encoding)

---
title: Post-quantum cryptography on Ethereum
description: How Ethereum is preparing for the post-quantum era, what is vulnerable, and what is being built to protect it.
lang: en
image: /images/roadmap/roadmap-future.png
alt: "Ethereum roadmap"
template: roadmap
---

Quantum computers will eventually be able to break the cryptographic schemes that secure Ethereum and most other digital systems today. This page explains what that means for Ethereum, what is being done about it, and what you need to know.

## Why this matters {#why-this-matters}

Ethereum relies on several forms of [cryptography](/glossary/#cryptography) to keep the network secure and protect user funds. The most important are:

- **Elliptic curve cryptography (ECDSA)**: Used to sign transactions. Your Ethereum account's security depends on this.
- **BLS signatures**: Used by [validators](/glossary/#validator) to reach [consensus](/glossary/#consensus) on the state of the network.
- **KZG polynomial commitments**: Used for [data availability](/glossary/#data-availability) in Ethereum's scaling roadmap.
- **ZK proof systems**: Used by rollups and other applications to verify computations off-chain.

All of these rely on mathematical problems that are hard for classical computers but could be solved efficiently by a sufficiently powerful quantum computer.

### How close are quantum computers? {#how-close}

In March 2026, Google Quantum AI published research showing that breaking 256-bit elliptic curve cryptography (the type Ethereum uses for account signatures) could require roughly 1,200 logical qubits. Previous estimates had put this number much higher. Google has set a 2029 internal deadline for migrating its own systems to post-quantum cryptography.

Current quantum hardware operates with a few thousand noisy physical qubits. Logical qubits (which correct for errors and can perform reliable computation) require many physical qubits each. The gap between current hardware and what is needed to break Ethereum's cryptography remains significant, but it is narrowing faster than many expected.

This is not an imminent threat. But cryptographic transitions take years, and Ethereum's security model is designed to last decades. Preparation now is prudent.

## The four vulnerable areas {#four-vulnerable-areas}

In February 2026, Vitalik Buterin published a roadmap identifying four distinct areas of Ethereum's cryptography that need post-quantum upgrades. Each has different challenges and different solution paths.

### 1. Consensus-layer BLS signatures {#consensus-bls}

**What it does**: Ethereum's [proof-of-stake](/glossary/#pos) protocol uses BLS signatures to aggregate votes from hundreds of thousands of validators. BLS is used because it allows many signatures to be combined into one, keeping the network efficient.

**Why it is vulnerable**: BLS signatures rely on elliptic curve pairings, which a quantum computer could break.

**The challenge**: Simply replacing BLS with a quantum-safe signature scheme is not straightforward. Post-quantum signatures are much larger, and the aggregation property that makes BLS efficient does not have an obvious quantum-safe equivalent.

**The approach**: The Ethereum Foundation is developing two complementary tools:
- **leanXMSS**: A hash-based signature scheme for validators. Hash-based signatures are considered quantum-safe because they rely only on the security of hash functions, which quantum computers weaken but do not break.
- **leanVM**: A minimal zkVM (zero-knowledge virtual machine) for SNARK-based signature aggregation. This would allow validators to submit quantum-safe signatures that are then aggregated using zero-knowledge proofs, preserving the efficiency benefits of aggregation.

### 2. Data availability: KZG commitments {#data-availability-kzg}

**What it does**: KZG polynomial commitments are used to ensure that data (particularly [blob](/glossary/#blob) data from rollups) is available on the network without requiring every node to download all of it.

**Why it is vulnerable**: KZG commitments rely on elliptic curve pairings, the same mathematical structure that quantum computers can attack.

**Current mitigation**: KZG commitments use a "trusted setup" where many participants contributed randomness. As long as at least one participant was honest and discarded their secret, the setup is secure, even against quantum computers attempting to reverse-engineer it after the fact.

**Long-term solution**: Replace KZG with a quantum-safe commitment scheme. The two leading candidates are:
- **STARK-based commitments**: Rely on hash functions rather than elliptic curves. Already used in some ZK rollups.
- **Lattice-based commitments**: Rely on the hardness of lattice problems, which are believed to be quantum-resistant.

Both approaches are still being researched for efficiency and practicality at Ethereum's scale.

### 3. EOA signatures: ECDSA/secp256k1 {#eoa-signatures}

**What it does**: Every standard Ethereum account (externally owned account, or EOA) uses ECDSA on the secp256k1 curve to sign transactions. This is what protects your funds.

**Why it is vulnerable**: A quantum computer could derive a private key from a public key. For accounts that have sent at least one transaction, the public key is exposed on-chain, making them a potential target.

**Important nuance**: Accounts that have only received ETH and never sent a transaction have not exposed their public key. Only the address (a hash of the public key) is visible, which provides some additional protection.

**The approach**: Rather than a single protocol-wide migration, Ethereum plans to use account abstraction (specifically EIP-8141, being considered for Hegota in H2 2026) to give users signature agility. This means individual accounts could switch to a post-quantum signature scheme, such as those standardized by NIST (ML-DSA/Dilithium, SLH-DSA/SPHINCS+), without waiting for the entire protocol to change.

This is a pragmatic approach. Users and wallets that want post-quantum protection early can adopt it voluntarily, while the broader migration happens over time.

### 4. Application-layer ZK proofs {#zk-proofs}

**What it does**: Zero-knowledge proof systems are used by L2 rollups and other applications to verify computations without revealing underlying data.

**Why it is vulnerable**: Many popular ZK proof systems (SNARKs using elliptic curve pairings) rely on quantum-vulnerable assumptions.

**The approach**: STARKs, which rely on hash functions rather than elliptic curves, are already quantum-resistant and are used by several rollups. The transition for this layer is partly happening already through natural ecosystem adoption of STARK-based systems.

## NIST standards {#nist-standards}

In August 2024, the U.S. National Institute of Standards and Technology (NIST) finalized three post-quantum cryptography standards:

| Standard | Name | Type | Use case |
|----------|------|------|----------|
| FIPS 203 | ML-KEM | Lattice-based | Key encapsulation (key exchange) |
| FIPS 204 | ML-DSA (Dilithium) | Lattice-based | Digital signatures |
| FIPS 205 | SLH-DSA (SPHINCS+) | Hash-based | Digital signatures |

These standards provide a foundation for the broader industry's post-quantum transition. Ethereum's work builds on and extends these, with particular focus on the unique challenges of a decentralized, permissionless network where efficiency and aggregation matter.

## The Ethereum Foundation's approach {#ef-approach}

The Ethereum Foundation formed a dedicated Post-Quantum Security team in January 2026, led by Thomas Coratger. The team's work is tracked publicly at [pq.ethereum.org](https://pq.ethereum.org).

### Current activity (as of April 2026)

- **Weekly interop devnets**: More than 10 client teams participate in regular post-quantum interoperability testing, including Lighthouse, Grandine, Zeam, Ream Labs, PierTwo, and others.
- **Poseidon Prize**: A $1 million research prize targeting improvements in hash-based cryptographic primitives, announced alongside the team formation.
- **Open-source implementations**: leanXMSS, leanVM, leanSpec (Python), leanSig (Rust), leanMultisig.
- **2nd Annual PQ Research Retreat**: Planned for October 9-12, 2026, in Cambridge, UK.
- **Structured fork milestones**: The team has outlined a series of protocol upgrades to incrementally introduce post-quantum cryptography into Ethereum's L1, with a target of completing the transition by 2029.

### Migration milestones

The high-level plan involves four milestone phases (labeled I*, J*, L*, M* on pq.ethereum.org). These are planning milestones, not guaranteed commitments. Names and ordering may change.

- **I***: PQ key registry on the consensus layer. Validators can register PQ public keys alongside existing BLS keys.
- **J***: PQ signature verification precompiles on the execution layer. Smart contracts and wallets can verify PQ signatures natively.
- **L***: PQ attestations and real-time consensus-layer proofs via leanVM. Validators begin using PQ signatures for consensus.
- **M***: Full PQ signature aggregation and PQ-safe blob commitments.

Target: core PQ infrastructure in place by ~2029. Full execution-layer and ecosystem migration extends beyond that.

## Frequently asked questions {#faq}

### Can quantum computers steal my ETH today? {#is-my-eth-safe}

**No.** No quantum computer today can break Ethereum's cryptography. Current quantum hardware is far from the scale needed. The work described on this page is preparation for the future, not a response to an active threat.

### When could quantum computers become a threat? {#when-could-quantum-threat}

Estimates vary. Google's 2026 research suggests the hardware needed to break 256-bit elliptic curve cryptography could arrive sometime around the end of this decade at the earliest, but significant engineering challenges remain. Most researchers consider a realistic threat to be several years away at minimum. The honest answer is that no one knows the exact timeline, which is why preparing now is important.

### Will I need to do anything to protect my wallet? {#what-do-i-need-to-do}

Eventually, yes. Once post-quantum signature schemes are available on Ethereum (expected to begin with EIP-8141), users will want to migrate their accounts to quantum-safe signatures. Wallet software will likely handle this transition for you.

If you have not yet sent any transaction from an account (meaning your public key has not been exposed on-chain), that account has an additional layer of protection because an attacker would need to break both a hash function and ECDSA.

For now, there is nothing you need to do. When action is needed, the Ethereum community and wallet developers will provide clear guidance and tools.

### What about my tokens, NFTs, and DeFi positions? {#what-about-tokens}

Assets on Ethereum are controlled by account signatures. Once your account is migrated to a quantum-safe signature scheme, everything in that account is protected. You do not need to migrate each asset individually.

Smart contracts that hold funds (like DeFi protocols) may need their own upgrades depending on what cryptographic primitives they use internally. This is an active area of research and development.

### What is the "harvest now, decrypt later" risk? {#harvest-now-decrypt-later}

An attacker could record exposed public keys today, then derive private keys in the future once a sufficiently powerful quantum computer exists. For Ethereum, this is most relevant to accounts whose public keys are already exposed on-chain (any account that has sent a transaction). This is one reason why the community is treating post-quantum migration as time-sensitive even though the quantum threat is not yet immediate.

### Where can I learn more? {#learn-more}

- **[pq.ethereum.org](https://pq.ethereum.org)**: The Ethereum Foundation's post-quantum security hub, with research updates, devnet status, and technical documentation.
- **[NIST Post-Quantum Cryptography](https://csrc.nist.gov/projects/post-quantum-cryptography)**: The U.S. government's standardization effort for post-quantum algorithms.

## Further reading {#further-reading}

- [pq.ethereum.org](https://pq.ethereum.org)
- [NIST FIPS 203, 204, 205 (August 2024)](https://csrc.nist.gov/projects/post-quantum-cryptography)
- [Google Quantum AI blog: Safeguarding Cryptocurrency (March 2026)](https://research.google/blog/safeguarding-cryptocurrency-by-disclosing-quantum-vulnerabilities-responsibly/)
- [Google: Quantum Frontiers May Be Closer Than They Appear (March 2026)](https://blog.google/innovation-and-ai/technology/safety-security/cryptography-migration-timeline/)
- [Read about KZG and trusted setups](/roadmap/danksharding#what-is-kzg)
- [Account abstraction on Ethereum](/roadmap/account-abstraction/)