Solana is one of the fastest layer-1 blockchains in production. It processes tens of thousands of transactions per second, confirms in under a second, and has attracted more developer activity than almost any other chain outside Ethereum. None of that throughput changes its exposure to quantum computing. Solana uses Ed25519, a classical elliptic-curve signature scheme, and every account that has ever signed a transaction has left its public key permanently on-chain.
That exposure is the core of the quantum risk. When a cryptographically relevant quantum computer exists, Shor's algorithm can derive private keys from those public keys in polynomial time. This article explains the precise mechanics of that risk for Solana, how quickly the threat is advancing, and what practical options exist for holders now.
What Signature Scheme Does Solana Use?
Solana uses Ed25519, an Edwards-curve variant of the Elliptic Curve Digital Signature Algorithm. Ed25519 offers excellent classical security — roughly 128-bit equivalent — and is one of the fastest signature schemes available on conventional hardware. These properties made it an excellent choice when Solana was designed.
The problem is that "excellent classical security" is not the same as quantum security. Ed25519 relies on the hardness of the discrete logarithm problem on an elliptic curve. Shor's algorithm, running on a fault-tolerant quantum computer, can solve that problem in polynomial time. A quantum computer with enough logical qubits could compute a Solana private key from any exposed public key.
Every time a Solana account sends a transaction, its public key appears in the transaction signature, permanently recorded on-chain. There is no mechanism in Solana's current design to rotate keys or limit how long a public key remains associated with a funded account. An address that signed its first transaction in 2021 has had its public key on-chain ever since.
How Many Qubits Would It Take to Break Solana?
Breaking Ed25519 requires running Shor's algorithm on a quantum computer with sufficient error-corrected logical qubits. Current academic estimates suggest that attacking a 256-bit elliptic curve key — the size Ed25519 uses — would require on the order of 2,330 noisy physical qubits in an idealized model, or several million physical qubits with realistic error rates and current qubit fidelity levels.
Today's best quantum processors operate with hundreds of physical qubits. Google's Willow chip (2024) demonstrated 105 qubits with improved error correction. IBM's roadmap targets thousands of qubits by the late 2020s. No public machine approaches the scale needed to break Ed25519 today.
The critical variable is not whether the hardware will exist, but when. The academic consensus in 2025-2026 points to a "cryptographically relevant" machine arriving somewhere in the 2030-2040 window, with significant uncertainty on both sides. Some researchers place the upper bound earlier. The Quantum Threat Calculator models how hardware cost trends and qubit scaling affect exposure timelines for specific wallet types.
The Harvest-Now, Decrypt-Later Problem
A quantum computer powerful enough to break Solana in real time does not exist yet. But that does not mean the threat begins only when that machine exists. Sophisticated adversaries are already executing a strategy called harvest now, decrypt later: recording encrypted or signature-protected on-chain data now, with the intention of decrypting it once capable quantum hardware becomes available.
For Solana, this means the public keys from every historical transaction are already being recorded by anyone who wants them. The Solana ledger is public and fully archivable. An attacker who collects Solana public keys today and stores them can run the attack the moment hardware scales to the required threshold.
This changes the risk calculus meaningfully. The threat does not begin when quantum computers break Ed25519 in a lab. It begins now, for any account whose public key is already on-chain — because that data is already in adversarial hands.
Does Solana Have a Post-Quantum Migration Plan?
As of mid-2026, Solana has no published post-quantum signature migration roadmap. The Solana Foundation has not announced a target signature scheme, a timeline for deprecating Ed25519, or a mechanism for migrating existing accounts to post-quantum keys.
This is not unique to Solana. Ethereum, Bitcoin, and most other major chains face the same absence of concrete migration plans. The NIST post-quantum cryptography standards (FIPS 204, FIPS 205, FIPS 206) were finalized in August 2024, giving chains a clear algorithm target for the first time. Integration work has not publicly begun on Solana.
When a migration does happen, it will require a hard fork: changing the signature scheme that validators accept is a consensus-critical change. Every account will need to re-sign its balance under the new scheme. Wallets that have lost their seeds, hardware wallets without firmware support for the new scheme, and any account whose owner is unreachable will not survive the migration. The Solana ecosystem is large enough that coordinating this kind of migration is a significant operational challenge.
What About Solana's Speed Advantage?
Solana's throughput advantage is real and not disputed here. For applications that need classical performance today and are not holding long-dated digital assets, quantum risk is a lower-priority concern.
The calculus shifts for two categories of Solana users:
- Long-term SOL holders who intend to hold positions for ten or more years are accumulating exposure with every year hardware advances. An account that signed its first transaction five years ago already has its public key harvested. Holding that account for another decade increases the window during which a capable quantum computer could attack it.
- Developers building financial infrastructure on Solana that is intended to operate at scale for a decade or more need to account for the cryptographic assumptions that infrastructure depends on. A smart contract or DeFi protocol that holds significant value in 2035 will be running on a chain with a classical signature scheme unless Solana executes a successful migration in the interim.
How Does This Compare to QuanChain?
QuanChain is built specifically for this threat. It uses ML-DSA-87 (CRYSTALS-Dilithium, NIST FIPS 204) combined with SLH-DSA-SHA2-256f (SPHINCS+, NIST FIPS 205) as a composite signature scheme. Both algorithms are quantum-resistant under current academic understanding.
More importantly, QuanChain's TADEQS key architecture means public keys never persist on-chain between transactions. Every spend rotates the key material atomically — a mechanism called SpendAndRotate. An adversary who archives the QuanChain ledger does not accumulate harvestable public keys, because each key appears only inside the spend block where it was consumed and is immediately retired.
The comparison to Solana is not about throughput. Both chains can process transactions at high speed. The difference is what those transactions expose to a future quantum adversary, and whether the chain will require a disruptive hard fork to survive one. For the full QuanChain vs Solana comparison, including consensus, latency, and developer ecosystem, that dedicated page covers the detail.
What Should Solana Holders Do Now?
There is no urgent action required today for most SOL holders. The threat is real and advancing, but the timeline for a practically capable attack is measured in years, not months. Panic-selling based on a future risk is not a rational response to that timeline.
What is rational is understanding your exposure profile:
- Any Solana address that has ever sent a transaction has its public key on-chain. That key is already harvestable.
- Addresses that have only ever received funds (never signed a send transaction) have not exposed their public key yet — Ed25519 exposes the public key at signing time, not at the point of receiving funds.
- The longer you hold in an address with an exposed public key, the longer the window a future quantum computer has to work with.
Use the Vulnerable Wallets guide to understand how different wallet types and address formats map to quantum exposure. The Wallet Q-Hacking Report covers the specific attack mechanics in detail.
The Honest Answer
Solana is not quantum safe. It uses a classical elliptic-curve signature scheme that Shor's algorithm can break on a sufficiently powerful quantum computer. Every account that has signed a transaction has permanently exposed its public key. There is no current migration plan.
That does not make Solana uniquely dangerous relative to other major chains — Bitcoin, Ethereum, and most others face identical exposure. What it means is that anyone building or holding value on Solana for the long term needs to include quantum migration risk in their planning, because that migration will be a hard fork, and hard forks at the scale Solana would require are operationally difficult.