However, it sets itself apart from other major chains in preparation for this future scenario. Specifically, it has the lowest overall vulnerability score among the ten chains in qLABS' index, its key-controlled addresses hash the public key, and Input Output runs an active post-quantum research program, though none of that is a shipped base-layer migration yet.
This guide covers where Cardano's quantum exposure sits and how far its preparation goes, as of October 2026.
Where Cardano stands today
Cardano signs ordinary transactions with Ed25519, and its block production uses an Ed25519-based scheme called KES. Shor's algorithm, on a large fault-tolerant quantum computer (that will one day become a reality), can recover an Ed25519 private key from its public key and forge a signature. That's the base exposure, and it's the same class of threat that Bitcoin and other major chains face.
How Cardano handles your public key
But there's one reason Cardano looks better than a chain like, say, Solana. A key-controlled Shelley address contains a blake2b-224 hash of its payment verification key, not the key itself. Other Shelley addresses use script credentials, whose exposure depends on their spending conditions. Shelley addresses are written in Bech32, a text format that packs the data into one string with a built-in typo check, and until a key is disclosed, the key a quantum attacker needs stays hidden.
Receiving funds doesn't by itself disclose a payment verification key, as long as that key hasn't been shared elsewhere. On its own, never signing isn't proof of secrecy, since keys can be shared directly or through wallet interfaces, and some off-chain message-signing formats disclose them. When you spend, the transaction carries a witness, the signature data that proves you control the funds, and that witness includes the verification key. The key becomes visible once the transaction reaches other nodes, and confirmation records it on-chain.
That disclosure then affects other unspent outputs controlled by the same key.
Grover's algorithm, the quantum method for searching through hashes, would still need on the order of 2^112 tries against Cardano's 224-bit hash, and that's before the heavy practical costs of running it at scale, so it isn't an attack you can put a date on. That's a separate problem from recovering an exposed Ed25519 key, which is what Shor's algorithm goes after. Hence, the hash in front of an unspent key isn't the weak point. The disclosed key is.
A key-controlled Shelley address stores a blake2b-224 hash of the Ed25519 key, so the key stays hidden until a spend discloses it in the transaction witness.
KES, where Cardano is ahead
Cardano's block producers use key-evolving signatures, or KES. The signing key changes on a schedule, about every 36 hours, and the old version is wiped. One key set covers 62 of these periods, around 93 days, before a pool creates a new one.
The payoff is that if someone steals today's key, they still can't sign for past periods, because the earlier keys are already gone. That protection is a classical one, so it doesn't make KES quantum resistant.
The catch is the building block underneath. KES still signs with Ed25519, so it's quantum-vulnerable at that base. The same design can be rebuilt on a post-quantum signature, and a 2026 research paper describes doing exactly that for Cardano, calling its current KES setup unusually mature. Getting there would still take a worked-out design, tested settings, a working implementation, a security review, and a network upgrade.
KES isn't the whole job either. Choosing who produces the next block relies on another piece of elliptic-curve math (a VRF), and the keys that run a stake pool and vote in governance would each need their own fix.
KES keys evolve each ~36-hour period and delete the old state, so past blocks can’t be forged later, but the Ed25519 leaf keeps it quantum-vulnerable.
How Cardano ranks, and what that means
qLABS' Top 10 L1 index gives Cardano the lowest overall vulnerability score of the 10 major chains, specifically 5.60. On migration preparedness, Cardano shares the best score with Ethereum, the XRP Ledger, and Solana, and its overall standing also reflects economic exposure and chain age. According to the index, its preparedness scoring rewards published intent over delivery. qLABS publishes this index and builds a competing product, so weigh the ranking accordingly.
The groundwork is already underway. Input Output's Cardano Vision 2026 names post-quantum security as a core research priority, with evaluation and migration planning for the chain's quantum-vulnerable primitives. A wallet proposal, provisionally numbered CIP-0197 and submitted in August 2026, explores extra proofs of control over seed-derived secrets without changing existing addresses.
At the time of writing, CIP-0197 remains open and unmerged, with a “Waiting for Author” label applied on September 3 pending planned revisions. Its security and implementation questions remain unresolved. Its proposed first phase leaves Ed25519 authorization unchanged on-chain, so those optional checks don't by themselves stop the ledger from accepting a forged classical signature. Ledger-enforced post-quantum protection would need further changes, therefore this isn't an available migration mechanism yet.
A separate proposal, submitted by Quantova on October 15, 2026, would add ML-DSA and SLH-DSA signature-verification builtins to Plutus. These would give script developers native verification operations for two NIST-standardized post-quantum signature families. As of October 23, pull request #1300 remains in triage, with cryptographic review and implementation work outstanding. The proposal requires a hard fork and wouldn’t, by itself, replace ordinary wallet signatures or Cardano’s consensus cryptography.
When could this happen?
Currently, no publicly demonstrated quantum computer can recover an Ed25519 key at the required scale. One recent architecture-specific estimate comes from IonQ, which in September 2026 published an end-to-end estimate for breaking 256-bit elliptic-curve signatures: about 19,397 physical qubits and 25.7 days per attempt, tied to its 2028 hardware roadmap, with neither the machine nor the attack demonstrated. That estimate targeted secp256k1, Bitcoin's curve, so it isn't an Ed25519 number. Ed25519 faces the same class of discrete-log attack, with different circuit and hardware assumptions.
Other forecasts spread across the late 2020s and the 2040s. An exposed Ed25519 public key can be recorded today and attacked later if it still controls funds or other authority when a capable quantum computer exists. The threat here is future key recovery and forged signatures, which isn't the same as decrypting data that was collected earlier.
Address hashing cuts long-term public-key exposure only as long as the key stays undisclosed, and spending can open a shorter attack window before confirmation.
If you hold ADA
Cardano hasn't migrated its ordinary key-based authorization to post-quantum signatures (so far). For key-controlled holdings, using fresh receiving addresses under different, undisclosed payment keys can cut long-term exposure. Spending reveals the relevant payment verification key, which can expose other unspent outputs controlled by it. Script-controlled holdings need their own assessment of their spending conditions.
Follow the research reports and individual proposals separately. Input Output’s July 2026 mid-year report records progress on post-quantum VRF design within the approved Cardano Vision research program. CIP-0197 remains an unmerged wallet proposal awaiting author revisions, while the October proposal for post-quantum Plutus verification is still in triage. None establishes an activated network-wide migration. For a plain-language primer on protecting holdings before Q-Day, QNews keeps a running guide.
Meanwhile, qLABS' qVAULT targets HyperEVM, with Ethereum support planned, and doesn't directly protect native ADA. Cardano supports programmable spending rules through Plutus, so application-layer post-quantum authorization is a separate possibility to evaluate there. Any implementation would have to resist a classical bypass and hold up on verification cost and recovery controls, and it would still depend on the underlying network.
One thing to keep in mind is that qLABS makes qVAULT, so we benefit when people use it, so weigh that against anything we say about it. As with the rest of this guide, approach is as general information, and not financial advice.
So where does ADA land?
Cardano isn't quantum-safe today, and like every major chain, it signs with cryptography a large quantum computer would break someday. What it has is a better starting position. Its key-controlled addresses hash the public key, and its block-production signatures already rotate the signing key in a way that could take a post-quantum primitive later.
Its research program takes the migration seriously. Even so, Cardano hasn't completed a network-wide post-quantum migration, and the lead it holds is in research and design, with nothing yet running on mainnet. A head start like that is great to have, though it only becomes protection once the migration ships.
FAQ
Is Cardano quantum safe?
Not at the moment. Cardano signs with Ed25519, which a large enough quantum computer could break using Shor's algorithm. Though it has the lowest overall vulnerability score in qLABS' index, Cardano hasn't adopted post-quantum signatures for ordinary key-controlled spending or completed a network-wide migration as of October 2026.
How does Cardano rank on quantum preparedness?
qLABS' top 10 L1 index gives Cardano the lowest overall vulnerability score of the 10 rated chains. In terms of migration preparedness, it shares the best score with Ethereum, the XRP Ledger, and Solana. The index notes that its preparedness scoring rewards published intent over delivery, so read the ranking as relative comparison between chains. It doesn't certify any of them as safe.
Can a quantum computer steal my ADA?
No publicly demonstrated quantum computer can recover Cardano signing keys at the required scale today. The risk is that an Ed25519 key disclosed when you spend could be recorded and then broken later, once hardware catches up to estimates like IonQ's.
Is Cardano more exposed than Bitcoin?
Both have quantum-vulnerable elliptic-curve signing paths. Cardano's key-controlled Shelley addresses hash the payment verification key. Bitcoin exposure depends on the output type: P2PK and Taproot outputs expose public keys, and fresh P2PKH and P2WPKH outputs can conceal them as long as those keys stay undisclosed elsewhere. Cardano's edge is preparation, including forward-secure block signatures and an active research program. qLABS ranks Bitcoin the most exposed major chain under its own methodology, so it's a useful data point, and far from the only one that counts.
When will Cardano be quantum-safe?
No date has been confirmed for a network-wide migration yet. Input Output’s research program includes post-quantum work, CIP-0197 remains unmerged and awaits author revisions, and a separate October 2026 proposal seeks post-quantum signature verification in Plutus. These efforts haven’t produced an activated network-wide upgrade so far.
qLABS Editorial. Sources are linked inline. See the L1 Quantum Vulnerability Index for our full methodology and conflict-of-interest disclosure.
