Is Ed25519 Quantum Resistant? What Every Blockchain Developer Needs to Know

TL;DR: Ed25519 is not quantum resistant. It uses Curve25519, an elliptic curve, and its security rests on the hardness of the elliptic curve discrete logarithm problem. Shor's algorithm, running on a fault-tolerant quantum computer with sufficient logical qubits, solves that problem efficiently and derives a private key from any exposed Ed25519 public key. Chains using Ed25519 — including Solana, Cardano, NEAR, Polkadot, and Avalanche — inherit this vulnerability. The quantum-resistant alternative for signatures is ML-DSA (FIPS 204), SLH-DSA (FIPS 205), or a composite of both.

Is Ed25519 Quantum Resistant? The Direct Answer

No. Ed25519 is not quantum resistant. Ed25519 is a variant of the Edwards-curve Digital Signature Algorithm built on Curve25519, an elliptic curve over a prime field. Its security depends entirely on the difficulty of the elliptic curve discrete logarithm problem. Shor's algorithm, published in 1994 and runnable on a fault-tolerant quantum computer, solves the discrete logarithm problem in polynomial time. A quantum computer with approximately 4,000 error-corrected logical qubits could derive any Ed25519 private key from its corresponding public key.

This answer is unambiguous. Ed25519 is an excellent classical signature scheme — fast, compact, well-analyzed, and widely deployed. But "excellent classical security" and "quantum resistance" are different properties. Quantum resistance requires relying on a mathematical problem that quantum computers cannot solve efficiently. Ed25519 does not satisfy that requirement.

The confusion sometimes arises because Ed25519 is described as "more secure than" older ECDSA variants in classical contexts. That is true: Ed25519 avoids several side-channel vulnerabilities that affect secp256k1 ECDSA, it is faster, and its design is cleaner. But these advantages are irrelevant to quantum resistance. Both Ed25519 and secp256k1 ECDSA are broken by Shor's algorithm in polynomial time on a quantum computer with sufficient logical qubits. The difference in their classical security properties does not affect their quantum vulnerability.

How Shor's Algorithm Breaks Ed25519

Shor's algorithm breaks Ed25519 by solving the elliptic curve discrete logarithm problem: given a public key Q = k·G (where G is the curve's base point and k is the private key), find k. Classically, this requires approximately 2^128 operations for Curve25519 — computationally infeasible. On a quantum computer, Shor's algorithm solves this in O((log n)^3) operations, where n is the bit length of the prime field. For Curve25519 with a 255-bit prime, this means the private key is derivable from the public key in polynomial time.

The attack works as follows. The Ed25519 public key is a point on Curve25519. The private key is a 256-bit scalar. Given the public key point and the base point, a quantum computer running Shor's algorithm performs a quantum Fourier transform over the group to find the discrete logarithm — the scalar — in polynomial time. The full circuit requires a fault-tolerant quantum computer with several thousand logical qubits and millions of quantum gate operations.

The critical prerequisite is that the attacker has access to the Ed25519 public key. On a blockchain, this happens every time a wallet signs a transaction. The public key is included in the transaction's signature data, recorded permanently on-chain. Any wallet that has ever sent a transaction has its public key permanently exposed on the blockchain ledger, available to any adversary who wants to record it for a future quantum attack.

Which Blockchains Use Ed25519?

Ed25519 is widely adopted across the blockchain ecosystem, primarily because of its performance advantages over ECDSA. The following major chains use Ed25519 for transaction signing:

• Solana — Ed25519 for all wallet signatures. Every signed transaction exposes the public key on-chain.
• Cardano — Ed25519 for payment credentials. The staking model encourages persistent address use, extending the harvest window.
• NEAR Protocol — Ed25519 as the default signing scheme for accounts.
• Polkadot / Substrate — Sr25519 (Schnorr over Ristretto255) and Ed25519 both supported. Sr25519 shares the same discrete-log vulnerability.
• Avalanche — secp256k1 for C-Chain (Ethereum-compatible), Ed25519 for X-Chain and P-Chain.
• Stellar — Ed25519 exclusively for all account signatures.
• Algorand — Ed25519 for standard accounts.
• Cosmos / Tendermint chains — Ed25519 for validator signatures; secp256k1 also supported for user accounts.

Bitcoin uses secp256k1 ECDSA rather than Ed25519, but secp256k1 is equally vulnerable to Shor's algorithm. The vulnerability class is the same — both rely on the elliptic curve discrete logarithm problem. Ethereum uses secp256k1 for EOA (externally owned account) signatures and BLS12-381 for validator signatures, both vulnerable.

What "Quantum Resistant" Actually Requires for Signatures

A quantum-resistant digital signature scheme must not rely on the integer factorization problem, the discrete logarithm problem over any group (including elliptic curves), or the related Diffie-Hellman assumptions — all of which are efficiently solvable by Shor's algorithm. The NIST-approved quantum-resistant signature schemes are ML-DSA (FIPS 204, based on module lattice problems), SLH-DSA (FIPS 205, based on hash function security), and FALCON (lattice-based, FIPS standardization pending). These rely on mathematical problems for which no efficient quantum algorithm is known.

The National Institute of Standards and Technology finalized FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) in August 2024, closing years of public cryptanalytic review. These are the algorithms that government systems, financial institutions, and critical infrastructure are required or recommended to adopt. For blockchain applications, ML-DSA is the primary candidate for transaction signing due to its balance of signature size and performance. SLH-DSA's larger signatures make it better suited for root identity anchoring rather than per-transaction use.

The Harvest-Now, Decrypt-Later Exposure

The quantum threat to Ed25519 does not require a quantum computer to exist today. Sophisticated adversaries are already collecting blockchain data that will be valuable once quantum hardware scales to the required capability. Every Ed25519 public key from every signed transaction on Solana, Cardano, NEAR, and similar chains is permanently recorded on-chain and archivable at negligible cost.

An adversary who archives Solana's complete transaction history today — approximately 200 terabytes and growing — has collected every Ed25519 public key ever exposed on that network. When quantum hardware capable of running Shor's algorithm at scale becomes available, those public keys become private key oracle lookups. The attack does not need to happen in real time. Patience and storage are the only requirements for the data collection phase.

This is why the relevant question is not "when will quantum computers break Ed25519?" but rather "how long will funded addresses with exposed public keys remain funded?" Any address that has signed a transaction and still holds value when capable quantum hardware arrives is at risk, regardless of how many years pass between the transaction and the attack.

What Developers and Holders Should Do

For developers building new systems: do not use Ed25519 for any application where the data being signed must remain confidential or the keys must remain secure for more than five to ten years. Use ML-DSA-65 or ML-DSA-87 from FIPS 204 for new signature schemes. For existing systems, plan a migration path and design your signing interfaces to be algorithm-agnostic so that swapping Ed25519 for ML-DSA does not require rewriting your entire application.

For holders on Ed25519 chains: the most important variable is whether your address has signed a transaction. If it has, your public key is on-chain and harvestable. If you hold significant value in a Solana, Cardano, or NEAR address that has signed transactions, that address's public key is already in the hands of anyone who wants it. The Vulnerable Wallets guide explains the exposure profile in detail, and the Quantum Threat Calculator helps model the timeline for your specific holdings.

QuanChain's TADEQS architecture eliminates the Ed25519 exposure problem by design. No public key persists on-chain in a funded state between transactions — the SpendAndRotate mechanism atomically retires each child key at spend time, leaving nothing for a quantum adversary to harvest from historical ledger data.