Loading blog post...
Here's a scenario that should make you genuinely uncomfortable right now.
Somewhere, someone is quietly downloading the entire Ethereum blockchain. Every block. Every transaction. Every signature you've ever made. They're not cracking anything today. They don't need to. They're just... waiting!
Microsoft dropped a bombshell in February 2026: their Majorana based quantum processors are heading to real data centers by 2029. IBM's roadmaps say similar things.
So, By 2029, quantum computers will be powerful enough to crack the signatures protecting those archived transactions. And your "safe" wallet from 2024 is wide open. Funds drained. NFTs forged. DAO treasury? Gone. Every ECDSA or Ed25519 signature you've ever made is a ticking time bomb. The quantum machine just hasn't arrived yet. Emphasis on yet.
This isn't paranoia. The attack model has a name: Harvest Now, Decrypt Later (HNDL).
Why current crypto breaks
Your wallet uses ECDSA or Ed25519 - the math problem behind them is called the discrete logarithm problem. Classical computers would take millions of years to crack it. But Shor's algorithm, running on a quantum computer with ~4 million logical qubits, solves it in hours. Shor's algorithm is a quantum algorithm that breaks the math behind ECDSA and RSA. Once a "cryptographically relevant quantum computer" (CRQC) exists, every existing wallet key is crackable. We're talking about roughly 4 million logical qubits - still a few years out, but no longer theoretical. Hash functions like SHA-256 are slightly luckier. Grover's algorithm gives quantum computers a speedup, but only quadratic meaning 256-bit classical security drops to 128-bit quantum security. Annoying, not catastrophic. Signatures are the real problem.
The three algorithms that actually survive
NIST finalized the standards in 2024. Blockchain is shipping them in 2026.
CRYSTALS-Dilithium aka ML-DSA (FIPS 204): The main one. Lattice-based signatures. Survives Shor. Fast to verify. The downside? Signatures are 40× bigger than Ed25519.
Kyber aka ML-KEM (FIPS 203): Same math, but for key exchange, not signing. Useful for encrypted mempools and cross-chain handshakes. Not for transaction signatures.
SPHINCS+ aka SLH-DSA (FIPS 205): Ultra-conservative. Only trusts hashes. Tiny public key but massive signatures (8–50 KB). The "I only trust SHA-256" option.
Everything else? Dies to Shor!
The biggest engineering headache is raw byte size. Here's how the signatures stack up:
On Ethereum, that 64-byte transaction grows to ~2.5 KB with ML-DSA. Gas costs Up 25–40× unless smart precompiles absorb the hit. On Solana, a 2.4 KB signature eats 60% of the entire 4 KB transaction budget before you've added a single instruction. Dilithium verification is actually faster than Ed25519 in raw CPU cycles. The pain is bandwidth and storage, not compute.
What Ethereum and Solana are actually doing about it
Ethereum
Dedicated PQ team launched Jan 2026
$2M in prizes (Poseidon + Proximity)
Multi-client consensus devnets live now
Testing both hash-based & lattice pilots
Bi-weekly All Core Devs calls on PQ roadmap
Solana
Project Eleven testnet live since Dec 2025
Full-scale PQ signatures benchmarked
Winternitz Vault live on GitHub
One-time signature per tx, key rotation built in
Community testnets spinning up now
Both chains are moving fast. Ethereum is betting big on hash-based approaches (Poseidon for leanVM + STARKs). Solana is going lattice-first with Winternitz as a pragmatic bridge.
The math
Why trust Dilithium and Kyber at all?
Most crypto proofs work like: "if you break my scheme, you break something hard."
Lattice proofs flip it: "if you break my scheme, you solve the hardest math problem known to exist."
The core problem is called Learning With Errors (LWE). Imagine someone gives you a bunch of equations like b = (a · s) + noise, where s is a secret and the noise is tiny. Without the noise, trivial to solve. With the right amount of noise? Believed impossible even for quantum computers.
Dilithium's signatures work by committing to a masked vector, generating a challenge, then responding with a combined value and running rejection sampling so the response never leaks your secret key. That same rejection sampling is why side-channel attacks (timing, power analysis) fail against it.
The security chain goes: break average-case LWE → break Bounded Distance Decoding → break worst-case lattice problems. Every step requires solving something believed to be impossible. Module-LWE (used in Dilithium and Kyber) runs the same math over polynomial rings instead of plain integers. Same security guarantees, much better efficiency. When you call mldsa_verify in your precompile, you're sitting on top of that whole chain.
The uncomfortable open questions
Nobody has clean answers to these yet, and you should be skeptical of anyone who claims otherwise:
Can Solana absorb 2–4 KB signatures without torching its 65k TPS? The 2026 tx-size bump buys some breathing room. But validator bandwidth and state bloat are real engineering problems that benchmarks on paper don't solve.
Will hybrid schemes buy enough time before 2029 QPUs ship? Maybe. But HNDL attackers don't need the machine tomorrow — they need it in 2030 to unlock transactions signed today. The window is tighter than it looks.
Ethereum's hash-based bet vs. Solana's lattice pragmatism - which wins on gas + security? Genuinely unsettled. Hash-based approaches (SPHINCS+/Poseidon) are more conservative. Lattice (ML-DSA) is more efficient.
The answer is probably "both, in different contexts" but the ecosystem hasn't figured out the split yet.