Is TON (The Open Network) Quantum Safe? Ed25519 Wallets and Validator Risk

TON (The Open Network) is a blockchain developed originally by Telegram and later handed to the open-source TON Foundation after Telegram's legal dispute with the SEC in 2020. It has since become one of the most actively developed blockchain ecosystems, driven in large part by deep integration with Telegram, the messaging application with over 900 million users. Telegram's built-in TON wallet, the Fragment marketplace for usernames and phone numbers, and a growing ecosystem of mini-apps have given TON a user acquisition channel unlike any other blockchain: a pre-existing social network of near-global scale.

This consumer scale is what makes TON's quantum security profile uniquely important to analyze. Most blockchain quantum security discussions focus on financial risk: how much value is at risk, how many addresses are exposed. TON introduces a different dimension: how many ordinary, non-crypto-native users would be affected if a quantum attack compromised TON wallet keys at scale? The answer, as TON adoption through Telegram continues to grow, could be hundreds of millions of people who never thought of themselves as cryptocurrency users.

Is TON Quantum Safe?

No. TON uses Ed25519 for wallet key pairs across all major wallet implementations, including Telegram's built-in TON Space wallet. Ed25519 is vulnerable to Shor's algorithm on a fault-tolerant quantum computer. The TON Foundation has not published a post-quantum cryptography roadmap. TON's Telegram integration creates a consumer-scale risk surface that is larger than any other blockchain in the quantum security context.

The cryptographic situation for TON is similar to NEAR Protocol at the signature scheme level: Ed25519 is the dominant signing algorithm, and it is not quantum resistant. What distinguishes TON is the scale of its potential user base and the consumer nature of that user base. A quantum attack on Bitcoin or Ethereum affects cryptocurrency users who, however broadly defined, are still a self-selected population of people who chose to interact with blockchain technology. A quantum attack on TON at scale could affect Telegram users who simply enabled a built-in wallet feature without understanding what "Ed25519" means or that their public key is visible on-chain.

TON Wallet Address Derivation

TON wallet addresses are more complex than most blockchains because TON smart contracts implement wallet logic on-chain. In TON's architecture, a wallet is not simply an address with a public key attached: a wallet is a smart contract deployed on-chain with its own state and code. The wallet contract stores the Ed25519 public key and implements the signature verification logic that authorizes spending.

The address of a TON wallet contract is derived from a hash of the contract's initial state (which includes the public key) and the contract's code. This means TON addresses are hash-derived, similar to Ethereum contract addresses. An uninitiated TON wallet (one that has received funds but whose deploying transaction has not yet been sent) has not revealed its public key on-chain, because the contract has not been deployed yet. The wallet exists only as an address derived from the hash of the prospective initial state.

Once a TON wallet sends its first transaction (which deploys the contract and registers the public key in the contract's on-chain state), the Ed25519 public key becomes visible in the contract state. After first use, all TON wallets have their public keys on-chain. The hash-layer protection is conditional on never having sent a transaction, just as with Ethereum.

There is an additional complexity: different versions of the TON wallet contract (v1, v2, v3, v4, and the newer Highload wallet variants) have slightly different initial state structures, which produce different addresses for the same public key. A user who has used multiple wallet versions with the same seed phrase has multiple addresses, each associated with the same underlying Ed25519 key. Once any version of the wallet has been used (deployed), the public key is visible, and all other wallet versions derived from the same key are equally exposed.

TON's Sharding Architecture and Migration Complexity

TON uses a unique sharding architecture called Infinite Sharding Paradigm, which allows the network to automatically split and merge shards based on load. Each shard processes a subset of accounts and transactions. This is one of TON's key performance advantages: the network can scale horizontally by adding shards rather than being bottlenecked by a single chain.

The sharding architecture adds complexity to a post-quantum migration in several ways. First, wallet contracts exist in specific shards, and migration transactions must be processed in the correct shard. A coordinated migration campaign at scale requires that the migration tooling correctly routes transactions to the appropriate shards, and that all shards are updated simultaneously (or within a short coordinated window) to avoid inconsistent state.

Second, the masterchain (TON's root chain, which coordinates all shards and contains validator records) has its own cryptographic dependencies. Validator signatures on masterchain blocks use Ed25519. Migrating the masterchain consensus layer to post-quantum signatures requires a protocol-level upgrade that propagates across all shards, which is more operationally complex than a single-chain hard fork. The inter-shard messaging protocol also uses Ed25519 for verification, adding another layer to the migration scope.

Third, the fact that wallets are contracts rather than simple address-key pairs means that a post-quantum migration requires deploying new wallet contract versions that support post-quantum key types, rather than simply updating a signing library. Every TON wallet holder would need to interact with a new wallet contract version, adding a user-facing migration step that is more complex than a simple key rotation.

The Telegram Integration Risk

TON's deep integration with Telegram creates a risk profile that goes beyond any individual blockchain's financial exposure. Telegram's built-in wallet features have made TON accessible to a population that includes many people with limited blockchain security literacy. These users may not understand that their "Telegram wallet" involves a public key that is visible on-chain after their first transaction, that their seed phrase is the root of their cryptographic security, or that a quantum attack on Ed25519 would compromise their wallet without any warning.

The user experience of TON through Telegram obscures the cryptographic reality in the interest of ease of use, which is appropriate for consumer adoption but creates an information asymmetry in the quantum security context. A sophisticated Bitcoin holder who reads about post-quantum risks can choose to move funds to a more secure address structure or migrate to a quantum-resistant chain. A casual Telegram user who received some TON tokens through a mini-app campaign may not have the background to understand the risk or take protective action.

If Telegram's trust in its built-in financial features were undermined by a successful quantum attack on TON wallets, the reputational damage would extend far beyond the blockchain ecosystem. Telegram's commercial model increasingly depends on monetization through its crypto integrations: the Fragment marketplace, the Stars payment system, and the broader Telegram economy. A quantum compromise of TON would be a trust incident for Telegram as a company, not just for TON as a blockchain. This is a unique systemic risk factor that does not apply to most other blockchains.

The harvest now, decrypt later attack pattern is also particularly concerning in the TON context. Because TON wallet public keys are visible on-chain after first use, a sophisticated adversary can today collect the public keys of all active TON wallets and prepare for future decryption once quantum hardware is available. The growing TON user base means this data collection problem grows every day that post-quantum migration is deferred.

TON Foundation's Quantum Security Position

The TON Foundation has not published a post-quantum cryptography roadmap as of mid-2026. The TON Improvement Proposal (TIP) process is the standard mechanism for protocol changes, and no TIP addressing quantum-resistant signatures has entered the public review process. The Foundation's public communications have focused on ecosystem growth, mini-app developer tooling, and the Telegram integration expansion.

The TON core developer community has extensive cryptographic expertise, given the protocol's complexity and its Telegram engineering heritage. But acknowledging the theoretical quantum vulnerability and publishing a concrete migration timeline are different things. The absence of a roadmap does not imply that work is not happening privately, but publicly verifiable commitment to post-quantum migration planning would meaningfully reduce the systemic risk outlined above.

For comparison, most blockchain networks with even marginal post-quantum awareness have at least produced academic discussions or informal roadmap notes in their developer communities. The Ethereum post-quantum roadmap provides a reference for what more advanced planning looks like, even if Ethereum's timeline and commitments also have significant gaps.

Signature Scheme Comparison

What a Protocol-Level Migration Would Require for TON

A complete post-quantum migration for TON is one of the most complex in the blockchain space, given the combination of its sharding architecture, contract-wallet model, and consumer user base. At the protocol level, the migration would require: defining post-quantum key types acceptable for wallet contract authorization, updating the masterchain and shard validation logic to accept post-quantum signatures, coordinating validator key migrations across all validators and across all shards simultaneously, and updating the TVM (TON Virtual Machine) to handle new signature verification opcodes.

At the wallet layer, new contract versions would be needed for every major wallet type (TON Space, Tonkeeper, MyTonWallet, and others). Users would need to interact with a migration transaction that deploys a new wallet contract version with a post-quantum key, transfers authorization from the old Ed25519 key to the new key, and migrates all Jetton balances to the new wallet. This is a multi-step user flow that is significantly more complex than a simple key rotation, and it must be executed by users across a wide range of technical sophistication levels.

The Telegram integration also means that the TON Foundation cannot rely solely on the crypto-native communication channels (Twitter/X, Discord, developer forums) that work for other blockchain communities. A migration campaign that reaches Telegram users who have never thought of themselves as blockchain users requires Telegram's active cooperation and in-app notification systems. This is a unique coordination dependency that no other blockchain faces at comparable scale.

Given this complexity, the lead time for a TON post-quantum migration, from the decision point to completed migration, is likely longer than for simpler chains. Beginning planning now, while quantum timelines are still uncertain, is more important for TON than for almost any other chain. The combination of a massive potential user base, a complex migration path, and the reputational dependency on Telegram's trust makes TON's quantum security planning a strategic priority that its current public posture does not reflect. For more on quantum computing timelines and the urgency of migration planning, see our quantum computing blockchain timeline guide.