As of November 12, 2026, the crypto market is in a mild pullback. According to Gate market data, Bitcoin (BTC) is trading at $73,552.9, with a market cap of about $1.57 trillion and a 24-hour decline of 0.35%. Ethereum (ETH) is at $2,047.37, with a market cap of about $275.523 billion and a drop of 1.09%. XRP is $1.0411, with a market cap of about $66.470 billion and a 24-hour decline of 1.94%, ranking #6 by market cap. Price volatility itself does not directly map to quantum risk. But it offers a view into the timeline: while the market focuses on short-term positions, the migration cycle of underlying cryptography is moving forward on a yearly scale.
Technically, the threat of quantum computing to blockchains can be reduced to a very concrete engineering problem. Bitcoin and Ethereum account control rely on the Elliptic Curve Digital Signature Algorithm (ECDSA). Once a transaction is broadcast, the public key is exposed on-chain. With a sufficiently powerful quantum computer running Shor’s algorithm, an attacker could theoretically reverse-engineer the private key from the public key. The XRP Ledger Foundation’s design documentation states the same point plainly: any account that has ever sent payments—including exchange wallets—has already had its public key exposed. That means the risk is not distributed evenly. A long-idle cold wallet and an active address that initiates frequent transactions do not present the same attack surface.
What’s truly worth unpacking isn’t the hard-to-falsify question of "when quantum computers will arrive." It’s the response paths chosen by each major chain, the engineering resources already invested, and the trade-offs each path creates. The answers that XRP, Bitcoin, and Ethereum provided in 2026 happen to represent three distinct organizational logics.
XRP’s Approach: Shift the Anti-Quantum Cost from Users to Validators
In November 2026, the Foundation of the XRP Ledger published an anti-quantum account design in its 2027 protocol roadmap. The core mechanism is this: account owners can add an anti-quantum signing key based on ML-DSA-44. The scheme was approved in 2024 by the U.S. National Institute of Standards and Technology (NIST). After approval, the system closes the original elliptic-curve keys, cutting off the paths an attacker might exploit. The migration is designed to be opt-in, and the base transaction fee remains unchanged.
Source: XRP Ledger Foundation
The cost of this design shows up in another form. The combined storage required for the anti-quantum key and signature totals 3,732 bytes. By contrast, a typical payment on the XRP Ledger uses only 105 bytes. After accounting for historical records and database overhead, the storage estimate for each protected payment is about 5,331 bytes in the general case, compared with 1,704 bytes in the baseline scenario. Because the XRP Ledger destroys the base fee instead of paying it to validators, the additional storage burden falls entirely on node operators. Nodes have no extra revenue to cover these costs.
Audit budgets can also be quantified. The roadmap reserves 215,000 to 255,000 USD for review and audit of this amendment, plus 640 development hours. The migration research plan runs in the first half of 2027, while development and audit work could land at the end of 2027 or in 2028. Developers still need to fix potential key-mismatch issues between the Python prototype and the server/JavaScript versions that could generate different keys.
A reasonable assessment of this path is that XRP’s fee structure is user-friendly on the surface, but it shifts the cost to the validator set that keeps the network running. Whether validators are willing to shoulder continuously growing storage overhead without direct compensation is a governance variable that has not yet been validated on the mainnet.
Source: Gate market data
Bitcoin’s Path: An Incremental Soft Fork Under the Principle of Minimal Interference
Bitcoin’s quantum-security strategy shows stronger path-dependency characteristics. In February 2026, BIP-360 was merged into the Bitcoin Improvement Proposal repository. It proposes a new output type called "Pay-to-Merkle-Root" (P2MR): while retaining Taproot’s script upgradability, it hides the public key and removes the quantum-weak path where public keys are directly exposed on-chain. The proposal is designed as a backward-compatible soft fork. Nodes that do not upgrade will ignore the new output type. But as of the second half of 2026, it remains inactive on the main chain.
Source: Gate market data
Ethan Heilman, a co-author of BIP-360, offered a more conservative time estimate than many roadmap documents. Even if migration starts tomorrow, the Bitcoin network’s full realization of post-quantum security is expected to take about seven years, assuming all parties reach consensus on the roadmap. The proposal itself needs about two and a half years to complete code review and testing. After that, wallets, custodians, Lightning Network nodes, and funds-management software each need years of upgrades. He also pointed out an easy-to-overlook boundary: BIP-360 can only defend against long-term attacks, such as public-key derivation targeting long-idle addresses. It cannot defend against short-term attacks during transaction broadcasting. Those require directly introducing post-quantum signature algorithms into the tapscript. Post-quantum signatures are 10 to 100 times larger than existing ones, which may force Bitcoin to make trade-offs among witness discounts, block space, or zero-knowledge compression.
The cost of Bitcoin’s path is not missing technical direction. It’s coordination cost. A money network built on a philosophy of minimal consensus intervention treats its own prudence as both a security advantage and a time cost when it faces a cryptographic migration that the whole network must coordinate on.
Ethereum’s Choice: Fix with a System-Level Roadmap Instead of a Single Output Type
In January 2026, the Ethereum Foundation formed a dedicated post-quantum team. It then incorporated post-quantum protection into the "Lean Ethereum" roadmap. The official goal is for the mainnet to be fully post-quantum capable at the consensus layer, execution layer, and data layer by the end of 2029. The schedule aligns closely with the 2029 transition targets proposed by Google, Cloudflare, and Microsoft. The Foundation also suggests that "Q-day" may appear as early as 2030 as a planning assumption. It explicitly states that it will not adjust the timeline at least until January 2027, after which it will bring in external experts to reassess.
Source: Gate market data
The technical core is to replace the BLS signatures validators currently use with a hash-based signature scheme called leanXMSS. Hash functions weaken under quantum computing but are not directly broken by Shor’s algorithm. That’s why they’re viewed as more suitable primitives for the post-quantum environment. The difficulty is signature size. leanXMSS signatures are about 3,000 bytes, while BLS signatures are only 96 bytes. A direct swap would significantly bloat the amount of data per slot. Ethereum’s response is to introduce a minimal zero-knowledge virtual machine, leanVM, which aggregates and compresses large numbers of hash signatures by about 250x. This approach keeps the validators’ signature aggregation efficiency while trading for post-quantum security.
This path’s engineering complexity is far higher than adding a single optional output type. But it addresses a more fundamental issue: if the consensus layer’s own signature aggregation mechanism is quantum-vulnerable, then merely patching user transaction outputs is not enough to protect the network. The trade-off is a longer development cycle and stronger ecosystem-coordination requirements—wallets, applications, and users migrating to the new signature scheme could take longer than the base-layer upgrade itself.
Early Movers and Peripheral Experiments: Algorand and Solana’s Position
While Bitcoin and Ethereum were still advancing in the roadmap phase, Algorand had already pushed parts of its post-quantum capability into mainnet operation. Since 2022, Algorand has used Falcon signatures to generate state proofs, giving historical block data quantum-resistant authentication. In November 2025, the first post-quantum transaction authorized by Falcon signatures was committed on the mainnet through account abstraction. As of September 2026, Algorand’s mainnet had completed more than 500,000 post-quantum signed transactions. Its protocol release plan in the third quarter of 2026 aims to provide native support for post-quantum accounts. However, standard Algorand accounts still use Ed25519 signatures, and post-quantum protection has not yet covered all account types.
On the Solana side, the Winternitz Vault introduced by the development studio Blueshift stores funds using Winternitz One-Time Signatures (WOTS). Each transaction generates a new cryptographic key. The hash-based signature structure resists Shor’s algorithm. But this solution is an independent construct outside Solana’s core client, not a network-wide protocol-level migration.
The experience from these two chains offers a calibration reference: real deployment of post-quantum cryptography on blockchains is feasible, but there’s a significant gap between "feasible" and "fully covered across the network." Algorand took about four years to move from state proofs to native support at the account layer, and it has not yet completed the post-quantum replacement of the consensus mechanism.
Underestimated Constraints: Signature Bloat, Coordination Dilemmas, and Migration Time Asymmetry
Placing these paths side by side reveals three structural constraints. They’re more worth tracking than the narrative of which chain is more technically advanced.
The first constraint is the on-chain economics of signature bloat. XRP’s anti-quantum signatures grow from 105 bytes to 3,732 bytes. Ethereum’s leanXMSS grows from 96 bytes to about 3,000 bytes. Bitcoin’s post-quantum signatures could reach 10 to 100 times the size of existing schemes. These numbers are not just implementation details. They directly determine node storage costs, block-space competition, and the long-term structure of the fee market. XRP assigns costs to validators. Ethereum tries to use zero-knowledge aggregation and compression to reduce data. Bitcoin, constrained by block space, has not yet settled on a final path. Each configuration carries its own governance implications.
The second constraint is coordination time asymmetry. The difficulty of a cryptographic migration is not writing new signature verification code. It’s getting exchanges, custodians, hardware wallets, Lightning Network nodes, and ordinary users to switch within the same time window. In Heilman’s "seven-year" estimate, two and a half years go to proposal review and testing, while the remaining years go to ecosystem upgrades. Ethereum’s roadmap also acknowledges that wallet and application migration may outpace—or at least not perfectly match—the base-layer upgrade schedule. If the urgency of the quantum threat suddenly rises, whether ecosystem coordination can accelerate in sync is a question without historical precedent.
The third constraint is disagreement over threat assessment itself. A March 2026 paper from Google’s Quantum AI team estimated that about 1,200 logical qubits could, in theory, pose a threat to 256-bit elliptic-curve cryptography. It also constructed a quantum circuit capable of deriving Bitcoin private keys from public keys within about 9 minutes. But another class of analysis argues that today’s quantum hardware still runs with only thousands of noisy physical qubits. Logical qubits require large-scale quantum error correction, and today’s compute capacity still has a clear gap from reliably executing cryptographic attacks. There is also no evidence that the relevant capabilities will become reality within the next decade. These two judgments do not have to contradict. The first describes the rate at which theoretical lower bounds fall. The second describes the gap between engineering implementation and stability. For users holding long-term assets, the meaningful information isn’t choosing which side to believe. It’s understanding how much resource each chain has already locked into its migration path. XRP’s $255,000 audit budget, Bitcoin’s seven-year coordination window, and Ethereum’s 2029 targets are all institutionalized responses to this uncertainty.
Conclusion
As of November 12, 2026, no mainstream blockchain has implemented real-time, network-wide quantum protection. XRP offers an optional design with a clear fee structure, but shifts storage costs to validators. Bitcoin moves forward under a minimal-intervention philosophy via BIP-360, but main-chain activation timing and short-term attack defenses remain open questions. Ethereum embeds post-quantum protection into a system-level roadmap, at the cost of higher engineering complexity and greater ecosystem coordination needs. Algorand’s early deployment shows technical feasibility, yet it also draws a real distance from local usability to full network coverage. In the end, the challenge quantum computing poses to blockchains is not whether any single chain can write post-quantum signatures. It’s whether the entire ecosystem can complete a coordinated migration—including node operators, wallets, custodians, and users—within the time window in which cryptographic assumptions still hold. In that sense, the migration itself is more worth continuous observation than any specific threat timeline.
FAQ
Will XRP’s anti-quantum scheme raise transfer fees for ordinary users?
No. The XRP Ledger Foundation explicitly keeps the base transaction fee unchanged. Additional storage is borne by validator nodes. Anti-quantum signatures take up 3,732 bytes, while a typical payment takes only 105 bytes—so the storage increment lands on the node infrastructure side. However, because XRP fees are destroyed rather than paid to validators, nodes have no added revenue to cover these costs. Whether it will affect validators’ willingness to participate in the long run still needs to be observed on the mainnet.
Can Bitcoin’s BIP-360 completely eliminate the quantum threat?
No. BIP-360 hides public keys through the P2MR output type, mainly defending against long-term attacks against long-idle addresses. It cannot defend against short-term attacks during transaction broadcasting. Those require directly introducing post-quantum signature algorithms into tapscript. Post-quantum signatures are 10 to 100 times larger than existing schemes, which forces trade-offs involving block space and verification costs. The proposal is still in draft form, and the main chain has not activated it.
Why does Ethereum choose the 2029 timeline?
Ethereum’s roadmap aligns closely with the 2029 post-quantum migration targets proposed by Google, Cloudflare, and Microsoft. It also assumes that "Q-day" may appear as early as 2030. The Foundation states clearly that it will not adjust the timeline at least until January 2027, after which it will bring in external experts for reassessment. 2029 is an engineering planning target, not a precise prediction of when quantum threats will materialize.
Algorand has already used post-quantum signatures—does that mean it’s safer than Bitcoin and Ethereum?
You need to distinguish between "deployed" and "fully covered." Since 2022, Algorand has used Falcon signatures to generate state proofs. In November 2025, it completed the first post-quantum transaction. As of September 2026, post-quantum signed transactions on the mainnet exceed 500,000. But standard accounts still use Ed25519, and the post-quantum replacement of the consensus mechanism is not complete. Its significance is that it demonstrates the technical path is feasible, not that it provides a complete network-security conclusion.
What do everyday holders need to do now?
Nothing immediately. But you should watch two things: whether your wallet and custodian have published a post-quantum migration support plan, and whether the migration for the chain where your assets are held has entered the mainnet activation stage. There’s significant disagreement on the timing of the quantum threat, but the coordination cycle for cryptographic migration happens on a yearly timeframe. Identifying how far custodians and on-chain tools have progressed toward migration is more closely aligned with how this risk actually propagates than adjusting positions based on short-term price volatility.
