This guide covers where Solana's quantum exposure sits and what its quantum-safe options do and don't change, as of October 2026.
The verdict up front
Solana's transaction signatures use Ed25519, an elliptic-curve signature scheme (EdDSA on the edwards25519 curve). As of the time of writing, its current validator-voting mechanism also uses Ed25519. Shor's algorithm can recover a private key from an exposed public key and forge a signature, and Ed25519 rests exactly on the type of discrete-log problem Shor specializes in solving.
In other words, the base layer is quantum-vulnerable, and Solana hasn't yet shipped a network-wide post-quantum migration. What it does have at the moment is an opt-in hash-based vault and published migration research, which put it in the active group of chains that qLABS tracks in terms of quantum preparedness level.
Through late 2026, this work picked up pace, and two developments below show where it stands.
On some chains the public key stays hidden behind a hash until spend; on Solana an ordinary account’s address is the Ed25519 public key itself.
Why Solana exposes your key by default
Let's look at what sets Solana apart from other major blockchains. Fresh Bitcoin P2PKH and P2WPKH outputs can keep the public key hidden until the coins are spent, as long as that key hasn't been disclosed elsewhere, and P2PK and Taproot expose it from the outset. Ethereum's externally owned accounts use hashed addresses, though a recoverable signature and its signed message can disclose the key. On Solana, an ordinary wallet address directly encodes its Ed25519 public key, written in base58, with no hash in front.
Therefore, the key a quantum attacker would target becomes public as soon as the address is known, before the account has ever signed anything. The Bitcoin habit of using a fresh address and not spending from it doesn’t help on Solana. Once an ordinary wallet’s address is shared or appears on-chain, its public key is disclosed, and funding that address adds no hash in front of the key.
Program-derived addresses are a different case, since they aren’t valid public keys and have no private key at all, though whatever keys or programs can move their funds still need their own review.
There's a timing twist to this as well. Because the key is visible, an attacker could record it today and break it once the capable enough quantum hardware exists, so an ordinary account's key is exposed as soon as its address is disclosed, including the first time it appears on-chain, and doesn't wait for the moment you transact.
Consensus and the rest of the stack
The exposure isn't limited to user funds. As of October 2026, Solana's voting still uses Ed25519. BLS public-key registration has been active on mainnet since July 2026, and validators without a registered BLS key are already excluded from voting, but the Alpenglow consensus switch itself waits on the Agave 4.3 mainnet release expected in Q4 2026.
BLS lets validators aggregate votes, and it stays open to a capable quantum discrete-log attack. So, the fix can’t stop at wallets. Whole-chain quantum resistance means replacing every signing surface the chain relies on, including user accounts and validator keys.
The Winternitz Vault, and what it does
This all doesn't mean Solana is ignoring the problem. In January 2025, developer Dean Little published the Winternitz Vault, an opt-in program that guards SOL with a hash-based authorization rule instead of an ordinary signature alone. It signs with Winternitz one-time signatures, using truncated Keccak256 hashes inside the signature construction and a full 256-bit public-key Merkle root as the seed for the vault's program-derived address.
Hash-based signatures sidestep the elliptic-curve discrete-log problem Shor targets. They're still open to quantum hash-search attacks like Grover's algorithm, which gives a square-root speedup: a 224-bit hash has an idealized generic quantum preimage-search cost of about 2^112 queries, with heavy implementation costs on top, so that figure isn't a full security estimate. Transactions that call the program still use Solana's ordinary Ed25519 transaction signatures, and the vault's job is to stop an ordinary wallet signature alone from authorizing a withdrawal.
Its reach is narrow, but it's intentional. The vault is opt-in, so you move funds into it yourself, and it's a program-level tool that doesn't change how ordinary accounts or consensus sign. Each Winternitz key is meant for a single signing use: spending closes the existing vault, funds that should stay protected have to move into a new vault under fresh one-time keys, and withdrawing into an ordinary Ed25519 wallet returns those holdings to classical authorization. Headlines calling Solana 'now quantum-resistant' overstate what it does.
The Foundation describes the vault as an existing application-layer option, and its README names no independent audit or deployment details. Before treating a particular deployment as suitable for custody, verify its program ID, the deployed code, any applicable audit, and the privileged controls, since a Solana program can stay upgradeable as long as an authority is set. Even a correctly implemented vault protects only its own spending authorization, and it doesn't make Solana's consensus quantum-safe. It still depends on the underlying network's security and availability.
The vault rotates a fresh one-time key per spend, and it protects only its own spending authorization, not the network’s consensus.
Solana's published roadmap
The vault isn't Solana's only work in quantum preparation. The Solana Foundation's April 2026 quantum-readiness roadmap describes Anza and Firedancer research into Falcon and an eventual path for new and existing wallets. This is preparation, and the mainnet migration isn't done. A proposed Falcon verification syscall, SIMD-0461, was closed in June 2026 pending demand, with the effort pointed toward an application-level implementation.
What changed in September and October 2026
On September 15, 2026, Solana raised its maximum transaction size from 1,232 to 4,096 bytes in an upgrade called ‘Transaction V1’. It’s a general scaling change (so not a quantum feature), and it counts toward post-quantum work.
Falcon and other post-quantum signatures run much larger than Ed25519 signatures and didn’t fit inside a Solana transaction before. Now they do, and Solana’s own write-up names Winternitz one-time signatures and schemes like BLS among the workloads the extra room unlocks.
Weeks later, on October 13, 2026, a co-founder of Squads, Solana’s main multisig provider, reported that multisig approvals signed with Falcon-512, a NIST-selected post-quantum scheme, had been tested on Solana mainnet. A separate program checks the Falcon signature before an approval counts, and the design leaves Solana’s native Ed25519 signatures and the Squads program itself untouched.
It can mix schemes too, so a 2-of-3 multisig could pair Falcon-512 signers with an Ed25519 one and still raise the bar for an attacker.
Ultimately, it’s all about the limits. This is a builder’s own test, with no release date or audit, and no public transaction to verify, and it covers multisig approvals, not ordinary wallets. Every regular Solana transaction still signs with Ed25519.
In other words, Solana is preparing for post-quantum security, and Squads is testing quantum-safe multisig approvals on it. Solana hasn’t become quantum-safe, and it hasn’t hard-forked to add Falcon.
How close is Q-Day?
No publicly demonstrated quantum computer can recover an Ed25519 key at the required scale today. In September 2026, IonQ published an estimate of 19,397 physical qubits and 25.7 days per attempt to recover a key, tied to its 2028 hardware roadmap, with neither the machine nor the attack demonstrated.
That estimate was run against secp256k1, Bitcoin's curve, so it isn't an Ed25519 figure. Ed25519 faces the same general class of quantum discrete-log attack, though the curve arithmetic and the circuit and hardware assumptions change the resources an Ed25519 attack would need. Other forecasts spread across the 2030s and 2040s. Once an ordinary Solana address is disclosed, there's no additional hash layer hiding its public key.
For a plain-language primer on how that timeline is framed, see QNews’s running explainers on Q-Day.
What SOL holders can do now
The base layer hasn't migrated so far, so protection is at the application layer. One option to evaluate is a hash-based vault like the Winternitz Vault, which moves specific holdings onto a hash-based authorization rule.
Check its deployed code and audit status, and the upgrade authority behind it, before relying on it, since the vault's resistance depends on how that authority is handled. If you hold a significant amount of SOL, start by reviewing the keys and programs that control your largest holdings, and judge any proposed migration against the deployed program's security and recovery controls before moving funds.
Squads’ test works the same way as the Winternitz Vault and as qLABS’ own qVAULT. An extra quantum-safe signature, enforced by a program or smart contract, on a chain that isn’t quantum-safe underneath. qLABS, which publishes the preparedness index cited above, runs qVAULT on HyperEVM, with Ethereum support planned. Its lock and unlock actions are paid for in qONE, the protocol’s token. Because it runs through EVM smart contracts, qVAULT doesn’t cover Solana.
qLABS would gain if you used it, so factor that in. Cold and hardware storage still cut ordinary key-theft risk, and they don't prevent quantum key recovery from an exposed public key. As with everything here, treat this as general information, not advice on what to do with your money.
What this means for your SOL
Solana isn't quantum-safe today, and in one respect it's more exposed than its peers: an ordinary address is the public key, so there's no hiding the target behind a hash.
Set against that, Solana has an opt-in hash-based vault and published Falcon research, and in qLABS' own preparedness index, whose rubric rewards published intent more than delivery, it lands in the active group.
That said, this index measures preparedness, but it doesn't guarantee security. The durable fix is a base-layer migration to post-quantum signatures, and that hasn't happened yet. Q-Day's timing is uncertain, and the exposure is already here.
FAQ
Is Solana quantum safe?
No. Solana's ordinary accounts and its validators sign with Ed25519, which a large enough quantum computer could break, and there's no network-wide post-quantum migration as of October 2026. An opt-in hash-based vault and published migration research exist, but neither is a completed base-layer upgrade.
Isn't Solana already quantum-resistant?
Not at the base layer. The Winternitz Vault is an opt-in program that guards funds you move into it with a hash-based rule, and Solana has published Falcon research, but ordinary Ed25519 accounts and consensus stay exposed. Headlines calling the entire chain quantum-resistant overstate it.
Does the Squads Falcon-512 test make Solana quantum-safe?
No. A Squads co-founder reported testing Falcon-512 signing for multisig approvals on mainnet in October 2026, but it’s an early test with no release or audit, and it covers multisig approvals, not ordinary accounts. Solana’s regular wallets and its consensus still sign with Ed25519. It’s a sign of preparation, but the base chain isn’t yet quantum-safe.
Can a quantum computer steal my SOL?
No publicly demonstrated quantum computer can recover Solana signing keys at the required scale at the moment. The risk arrives once a capable machine exists. On Solana, the key is exposed early, because an ordinary address is the public key, so a funded account never gets the hidden-key phase a fresh Bitcoin output can have.
Is Solana more exposed than Bitcoin or Ethereum?
The signature-breaking threat is in the same class for all three. The difference is disclosure: fresh Bitcoin P2PKH and P2WPKH outputs can hide the key until spending, whereas Ethereum's hashed addresses hide it until a signature reveals it. Meanwhile, an ordinary Solana address encodes the key directly. On preparedness, Solana has an opt-in vault and Falcon research, so it looks worse on key disclosure and more active on preparation, depending on which you weigh.
How do I protect my SOL from quantum?
One option to evaluate is a hash-based vault such as the Winternitz Vault for holdings you want to protect, after checking its deployed code and audit status, and the upgrade authority behind it. Track Solana's published roadmap, and tell research and proposals apart from activated changes. Cold or hardware storage still guards against ordinary theft, and it doesn't prevent quantum recovery from an exposed public key.
qLABS Editorial. Sources are linked inline. See the L1 Quantum Vulnerability Index for our full methodology and conflict-of-interest disclosure.
