Is IOTA Quantum Resistant? The Tangle's Post-Quantum History Explained

TL;DR: IOTA is no longer quantum resistant. IOTA 1.x used Winternitz One-Time Signatures (W-OTS), a hash-based scheme that was quantum resistant — but each key could only be used once. IOTA 2.0 (Stardust, 2023) migrated to Ed25519, an elliptic-curve signature scheme that is vulnerable to Shor's algorithm. The Tangle's DAG structure has no inherent quantum resistance properties — that was always the signature scheme, not the data structure. Any IOTA address that has signed a transaction under IOTA 2.0 is now quantum vulnerable.

Was IOTA Ever Quantum Resistant?

Yes. IOTA 1.x (Chrysalis and earlier) used Winternitz One-Time Signatures (W-OTS), a hash-based post-quantum signature scheme. W-OTS security depends only on the collision resistance of the underlying hash function, making it secure against Shor's algorithm. In this period, IOTA had a legitimate claim to quantum resistance for its signature scheme — though the one-time-use constraint created significant usability challenges that led to the eventual migration away from W-OTS.

IOTA's original design in 2016-2017 incorporated W-OTS specifically to address the quantum computing threat. The IOTA Foundation marketed this as a core feature, and in the blockchain community at the time, IOTA was one of the only distributed ledger projects seriously engaging with post-quantum cryptography at the signature level. The one-time-use property of W-OTS meant that after signing one transaction, a key had to be permanently retired — but the underlying hash-based security was genuinely quantum resistant.

The transition from W-OTS to Ed25519 in IOTA 2.0 (the Stardust upgrade in 2023) was driven by practical concerns. One-time signatures require careful key management: if a user accidentally signs two transactions with the same W-OTS key, the security collapses and the private key is compromised. IOTA users, particularly those using early software versions, were exposed to key reuse vulnerabilities that led to fund losses. The migration to Ed25519 solved the usability and key-reuse problems — but at the cost of quantum resistance.

Is IOTA Quantum Resistant Now (Post-Stardust)?

No. IOTA 2.0 (Stardust, 2023) uses Ed25519 for all wallet signatures, replacing the earlier W-OTS scheme. Ed25519 is an elliptic-curve signature scheme that relies on the elliptic curve discrete logarithm problem — which Shor's algorithm solves efficiently on a fault-tolerant quantum computer. Any IOTA address that has signed a transaction under IOTA 2.0 has its Ed25519 public key permanently on-chain, making it vulnerable to a future quantum attack that derives the private key from the public key.

This is a common misconception in discussions of IOTA's quantum properties. People who learned about IOTA during the W-OTS era sometimes still describe IOTA as quantum resistant. Technical documentation from before 2023 described IOTA's signature scheme as post-quantum. Some secondary sources describing "IOTA's quantum resistance" predate the migration and have not been updated. It is important to check the date of any source discussing IOTA's cryptographic properties, because the relevant facts changed with the Stardust upgrade.

Does the Tangle Have Inherent Quantum Resistance?

No. The Tangle — IOTA's Directed Acyclic Graph (DAG) data structure — has no inherent quantum resistance. The Tangle is an approach to consensus and data structure organization, not a cryptographic construction. Quantum resistance in a distributed ledger comes from the signature scheme used to authorize transactions, not from the topology of the ledger's data structure. A DAG using Ed25519 signatures is no more quantum resistant than a chain using Ed25519 signatures.

This misconception sometimes appears because IOTA was simultaneously novel in its DAG-based "Tangle" structure and in its original choice of W-OTS signatures. Early marketing materials often emphasized both together, leading some users to associate the Tangle topology with quantum resistance. They are independent properties. The Tangle could in principle be combined with any signature scheme — post-quantum or not. IOTA 2.0's Tangle uses Ed25519 and is therefore quantum vulnerable.

What Happened to W-OTS Users During the Migration?

The migration from W-OTS to Ed25519 was managed through IOTA's Chrysalis upgrade (2021) and Stardust upgrade (2023). Users were required to migrate their funds from old W-OTS addresses to new Ed25519 addresses before the W-OTS address support was retired. The migration process involved signing a migration transaction with the old W-OTS key to claim a new Ed25519 address — a one-time operation that retired the old key and established the new one.

Users who did not migrate their W-OTS funds before the cutoff had their tokens locked in legacy addresses. IOTA has mechanisms for extended migration periods, but the practical result is that some amount of IOTA tokens may be permanently inaccessible in old W-OTS addresses whose holders did not complete the migration.

Ironically, funds still held in unmigrated W-OTS addresses — though inaccessible — are technically quantum resistant, because W-OTS is a hash-based scheme. The accessible, usable IOTA tokens in post-Stardust Ed25519 addresses are the ones that are quantum vulnerable.

IOTA's Post-Quantum Future

The IOTA Foundation has acknowledged the quantum computing threat and has discussed post-quantum cryptography in research contexts. However, as of mid-2026, IOTA does not have a concrete post-quantum migration timeline for its mainnet Ed25519 addresses. The IOTA ecosystem is currently focused on IOTA 2.0's full decentralization and smart contract layer deployment.

Migrating from Ed25519 to a post-quantum signature scheme on IOTA would require a similar effort to the Chrysalis/Stardust migration — developing new address formats, deploying new signing infrastructure, coordinating wallet and exchange support, and running a migration period for user funds. The engineering work is understood but has not been scheduled.

Comparing IOTA, QRL, and QuanChain on Quantum Safety

Property	IOTA (legacy W-OTS)	IOTA 2.0 (Stardust)	QuanChain
Signature scheme	W-OTS (hash-based)	Ed25519 (elliptic curve)	ML-DSA-87 + SLH-DSA
Quantum resistant	Yes	No	Yes
Key reuse allowed	No (one-time only)	Yes	Yes (ML-DSA is stateless)
Harvest-now risk	None	Yes — for signed addresses	None (SpendAndRotate)
Status	Retired (unmigrated funds locked)	Active	Active (testnet)

For users choosing a distributed ledger with long-term quantum security requirements, the distinction between IOTA's legacy W-OTS version and its current Ed25519-based Stardust version is critical. QuanChain's TADEQS architecture addresses both the quantum resistance requirement and the key-reuse usability problem that drove IOTA's migration away from W-OTS in the first place. The QuanChain vs IOTA comparison covers the full technical analysis.