Ethereum's Post-Quantum Roadmap: Where It Stands in 2026

TL;DR: Ethereum uses secp256k1 ECDSA for externally owned account (EOA) signatures and BLS12-381 for validator attestations — both are vulnerable to Shor's algorithm on a fault-tolerant quantum computer. Ethereum's post-quantum roadmap, part of "The Splurge" phase, involves migrating EOAs to smart contract accounts via EIP-7702 and ERC-4337, then deploying post-quantum signature verification as EVM precompiles or STARK-based proof systems. A realistic mainnet deployment of post-quantum signatures is 2028-2030 at the earliest, with full migration of existing EOA balances taking years beyond that.

Ethereum's Quantum Vulnerability: The Current State

Ethereum's externally owned accounts (EOAs) — including every MetaMask, Coinbase Wallet, and Ledger account — use secp256k1 ECDSA for transaction signing. Validator attestations use BLS12-381 signatures for their aggregation efficiency. Both secp256k1 and BLS12-381 rely on the elliptic curve discrete logarithm problem, which Shor's algorithm solves efficiently. Any ETH held in an EOA that has signed a transaction has exposed its public key on-chain. Approximately 99% of ETH supply sits in addresses that have signed at least one transaction.

This is a significant exposure. Ethereum's ledger records the public key of every EOA that has ever sent a transaction — those public keys are harvestable today by any adversary building a database for future quantum attacks. The harvest-now, decrypt-later threat is particularly acute for Ethereum because DeFi participation requires regular transaction signing, meaning virtually all active ETH holders have exposed public keys on-chain.

The second vulnerability is the validator layer. Ethereum's Beacon Chain uses BLS12-381 aggregated signatures for validator attestations — the mechanism that achieves the 900,000+ validators Ethereum currently has without individual signature verification overhead. BLS12-381 is an elliptic curve and shares the same vulnerability to Shor's algorithm as secp256k1. A quantum adversary who compromises validator private keys could disrupt Ethereum's consensus mechanism, not just steal individual account balances.

What Is EIP-7702 and How Does It Help?

EIP-7702 (included in Pectra, Ethereum's 2025 upgrade) allows EOAs to set code — temporarily delegating account behavior to a smart contract for the duration of a transaction. This is a building block for account abstraction: it allows EOAs to use custom signature verification logic, including post-quantum signature schemes, without requiring users to move funds to a new address. EIP-7702 does not itself add post-quantum signatures, but it enables the smart contract architecture that post-quantum signature verification would run on.

Before EIP-7702, there were two signature schemes available for Ethereum transactions: secp256k1 ECDSA for EOAs and contract-defined verification for smart contract accounts. EIP-7702 blurs this boundary by letting an EOA temporarily adopt smart contract code, enabling batching, gas sponsorship, and custom signature verification that the EOA protocol never supported natively.

The post-quantum migration path that most Ethereum researchers discuss involves EIP-7702 or its successors enabling EOAs to adopt smart contract-based signature verification — including ML-DSA or STARK-based proofs of ML-DSA validity. A user would "upgrade" their EOA by setting a contract that verifies their new post-quantum public key, migrate their balance under the new key, and then retire the old secp256k1 key. This is opt-in, not automatic — it requires every user to take action.

ERC-4337 Account Abstraction and Post-Quantum Wallets

ERC-4337 implements account abstraction on Ethereum's current architecture without a protocol change, using a separate mempool (the "bundler" network) and an EntryPoint contract. ERC-4337 wallets can use any signature verification logic, including ML-DSA. Several teams have built prototype ERC-4337 wallets using post-quantum signatures. However, ERC-4337 accounts are new smart contract accounts — they do not migrate existing EOA balances, and using one requires holding ETH in the new account rather than in the existing EOA.

The practical limitation of ERC-4337 for post-quantum migration is that it creates parallel accounts rather than upgrading existing ones. If a user has 10 ETH in an EOA with an exposed secp256k1 public key, creating an ERC-4337 account with ML-DSA does not protect the original 10 ETH — the user must transfer the funds to the new account, which requires a secp256k1 ECDSA transaction that exposes the private key window during confirmation. This is manageable when quantum hardware cannot run Shor's algorithm in seconds, but becomes a critical problem when the attack capability reaches mempool-monitoring speeds.

The Splurge: Ethereum's Long-Term Post-Quantum Phase

Ethereum's roadmap is organized into named phases: The Merge (complete), The Surge (scaling/rollups), The Scourge (MEV/protocol), The Verge (Verkle trees/statelessness), The Purge (history expiry/technical debt), and The Splurge (miscellaneous improvements including post-quantum cryptography). The Splurge is explicitly where post-quantum signature migration lives on Ethereum's roadmap — it is the last and least-defined phase, with no committed timeline. Vitalik Buterin has discussed STARK-based post-quantum signatures as the likely mechanism, deployed as EVM precompiles.

The STARK-based approach that Ethereum researchers favor would work as follows: instead of deploying ML-DSA verification natively in the EVM (which is computationally expensive), users would prove validity of their ML-DSA signatures using STARK proofs. A STARK proof that an ML-DSA signature is valid can be verified cheaply on-chain even though ML-DSA verification itself is expensive. This approach has the advantage of being upgradeable — if a better post-quantum signature scheme becomes available, the proof system can be updated without changing the on-chain verification primitive.

Realistic Timeline for Ethereum Post-Quantum Migration

Based on Ethereum's historical upgrade cadence and the engineering complexity of post-quantum signature migration, a realistic timeline is:

• 2025-2026: EIP-7702 (Pectra) deployed. Account abstraction infrastructure matures. First production ERC-4337 wallets with post-quantum signatures available.
• 2026-2027: Research on STARK-based ML-DSA verification reaches EIP proposal stage. EVM precompile specifications drafted.
• 2028-2029: Post-quantum EVM precompiles deployed to Ethereum mainnet after testing on testnets. Native ML-DSA transaction type potentially available.
• 2029-2030: Wallet software updates to support post-quantum signatures. Large holders and institutions begin migrating EOA balances.
• 2030+: Retail migration begins, with wallet UX improvements making migration accessible. Majority of ETH supply still in secp256k1 addresses for years beyond initial deployment.

This timeline is optimistic — it assumes continued developer focus on post-quantum migration and no major competing priorities that delay The Splurge work. It also assumes no major cryptographic surprises (a new attack on ML-DSA or a faster-than-expected quantum computing advance) that would require course corrections.

What Ethereum Holders Should Know Now

Ethereum does not have post-quantum signatures in production today, and the earliest plausible deployment is 2028. For holders with significant ETH balances in EOAs that have signed transactions, the harvest-now, decrypt-later exposure is real and growing. The practical steps available today are:

• Move funds to hardware wallet addresses that have not yet signed transactions, keeping those public keys unexposed until post-quantum migration is available.
• Monitor the EIP process for post-quantum proposals and engage early with the migration mechanism when it is available.
• Consider the availability of QuanChain's native post-quantum architecture as a venue for assets requiring quantum-secure guarantees today rather than 2028.

The QuanChain vs Ethereum comparison covers the architectural differences in detail. The Quantum Threat Calculator models exposure timelines for specific ETH holdings under different quantum hardware advancement scenarios.