Hardy Index Quantum readiness, rated and tracked

Chain profile

dYdX Chain

DYDX Exposed

dYdX Chain runs its own fork of Cosmos SDK v0.50, with secp256k1 accounts and Ed25519 validators, and no post-quantum proposal, plan or research programme from dYdX governance or the dYdX Foundation could be found.

Is dYdX Chain quantum-safe?

No. dYdX Chain is a proof-of-stake chain built on the Cosmos SDK that runs a perpetuals exchange in its own protocol. DYDX accounts sign with ECDSA on secp256k1, and validators sign consensus votes with Ed25519, which the chain's consensus parameters make the one accepted validator key type. A sufficiently large quantum computer running Shor's algorithm breaks both. Mainnet runs protocol v9.8.1 on dYdX's own fork of Cosmos SDK v0.50, whose key types are secp256k1, secp256r1, Ed25519 and multisig. dYdX also has permissioned keys, a smart-account feature that lets an account add further keys with limited rights, but every key it accepts is a secp256k1 key and the account's original key keeps working. The Cosmos SDK added ML-DSA-65 keys for accounts and validators in v0.55, released on 28 July 2026, and dYdX has not moved to that release line. None of the 396 governance proposals the chain returns, through the v9.8 software upgrade that passed on 11 October 2026, mentions post-quantum cryptography, and we found no post-quantum position on the dYdX forum or from the dYdX Foundation. DYDX also exists as an ERC-20 token on Ethereum, protected by Ethereum's signatures; the bridge that carried it to dYdX Chain has been disabled by governance since July 2025.

Where we are making a judgement call Three judgement calls carry this profile. The first two concern the upstream framework. The tier and the NIST and verification scores treat the ML-DSA keys in Cosmos SDK v0.55 as framework work rather than work for dYdX Chain, because dYdX maintains its own fork of Cosmos SDK v0.50 and nobody with authority over dYdX Chain, its governance or the dYdX Foundation, has referred to them. The Cosmos Hub profile credits the same code because Cosmos Labs, which wrote it, says it is bringing the Hub's maintenance in-house; no such tie exists here. A reader who credits the upstream release as dYdX's own would place it in Tier 4, with a deployment score of 2, and might score NIST alignment 5, migration 5 and verification 3 as the Cosmos Hub profile does, which would raise the Hardy Score from 8.5 to 23.5. The migration score of 2 rather than 1 credits that upstream mechanism and dYdX's record of nineteen passed software upgrades; at 1 the Hardy Score would be 7.0. The third is permissioned keys, which we do not credit above 2: they let an account authorise extra keys without moving funds, which is the shape a key migration needs, but they accept secp256k1 keys alone and the account's original key keeps signing whatever is added. A reader who credits them as a key-rotation mechanism, as the Kaia profile credits its account update transaction, would score migration 3 and a Hardy Score of 10.0. Separately, our finding is that we could not locate a post-quantum position from dYdX governance, the dYdX forum or the dYdX Foundation, not that we have confirmed none exists; a single forum reply from a community member mentions quantum computers in passing, and it is not a position of anyone with authority over the chain.

At a glance

On mainnet today

ECDSA on secp256k1 for accounts and permissioned keys; Ed25519 for validator consensus keys

Post-quantum scheme

None selected or proposed. ML-DSA-65 is in Cosmos SDK v0.55, which dYdX's fork does not include.

NIST standard

None named

Readiness tier

Tier 5: Exposed. The signatures securing funds on mainnet today are quantum-vulnerable, and no public post-quantum plan, proposal or research programme addressing them could be found.

Cryptography in use

  • Account signatures ECDSA on secp256k1 Mainnet, default Read from the chain's transaction API on 22 October 2026: all 42 signers in blocks 110,585,000 to 110,585,150 carry a secp256k1 public key, and none carries another key type. dYdX's SDK fork also defines secp256r1, Ed25519 and multisig keys. Read on-chain
  • Account signatures ECDSA on secp256k1 Mainnet, opt-in Permissioned keys (the x/accountplus smart-account module, active on mainnet). The SignatureVerification authenticator accepts a secp256k1 public key and nothing else; 12 of the 646 transactions in the blocks read above selected an authenticator. Source code or release
  • Validator consensus Ed25519 Mainnet, mandatory The consensus parameters accept ed25519 as the one validator key type, and all 21 validators in the latest set use it. Read on-chain

A role not listed is not evidenced either way. Every scheme, and which other chains share it, is in the cryptography registry.

Score breakdown

Each dimension scored 0 to 10. The weight beside it is its share of the total score.
Signature scheme 0 30% Deployment stage 1 25% NIST alignment 0 15% Migration path 2 15% Exposure 2 10% Verification 2 5%
Show the weighted arithmetic and the sourced note for each dimension
No. Dimension Score Weight Contribution
1 Signature scheme 0 30% 0.0
2 Deployment stage 1 25% 2.5
3 NIST alignment 0 15% 0.0
4 Migration path 2 15% 3.0
5 Exposure 2 10% 2.0
6 Verification 2 5% 1.0
Hardy Score 8.5

1 Signature scheme 0/10, weighted 30%

Band 0: Classical signatures only on mainnet, with nothing post-quantum protecting live funds. Short-lived devnets and one-off benchmarks sit here: they demonstrate research rather than something a user can hold keys on.

DYDX accounts sign with ECDSA on secp256k1: all 42 transaction signers in mainnet blocks 110,585,000 to 110,585,150, read from the chain on 22 October 2026, carry secp256k1 keys. Validators sign with Ed25519. dYdX's SDK fork adds no post-quantum key type, so nothing post-quantum protects DYDX on mainnet. source

2 Deployment stage 1/10, weighted 25%

Band 1: Tier 5: Exposed.

Tier 5: Exposed. The signatures securing DYDX are quantum-vulnerable, and we found no post-quantum plan, proposal or research programme from anyone with authority over dYdX Chain: none among the 396 governance proposals, none on the dYdX forum and none from the dYdX Foundation. The ML-DSA work in Cosmos SDK v0.55 belongs to the upstream framework, whose maintainers have no authority over dYdX's fork. source

3 NIST alignment 0/10, weighted 15%

Band 0 to 2: No post-quantum scheme named for the chain’s fund-protecting signatures, or a proprietary scheme with no public cryptanalysis.

No post-quantum scheme has been named for dYdX's accounts or validators. ML-DSA-65, from the final FIPS 204, exists in Cosmos SDK v0.55, but dYdX pins its own fork of v0.50, and nobody with authority over dYdX Chain has referred to it. source

Placement in the band The floor of the band rather than a 1 or a 2: dYdX governance and the dYdX Foundation have named no scheme at any point. Crediting the upstream ML-DSA option would score a framework dYdX has not adopted rather than the chain.

4 Migration path 2/10, weighted 15%

Band 0 to 2: No agreed migration path, or the proposals on the table would strand or freeze holder funds.

No post-quantum migration plan has been published. A route exists upstream: under Cosmos SDK v0.55 a holder creates a new ML-DSA account and transfers funds to it, and a validator rotates its consensus key in place. None of it applies until dYdX carries its fork onto that release line, and its governance ships software upgrades routinely: nineteen software-upgrade proposals have passed since January 2024, the latest bringing v9.8 in October 2026. dYdX's permissioned keys add keys to an account but accept secp256k1 alone and never retire the original key, so they are not a route off it. source

Placement in the band The top of the band rather than a 1: a working mechanism exists in the framework dYdX is built on, and its governance has a long record of coordinated software upgrades. It cannot reach 3, because nobody with authority over dYdX Chain has acknowledged quantum migration as a problem anywhere we could find.

5 Exposure 2/10, weighted 10%

Band 0 to 2: Public keys are exposed for effectively all accounts, or a large, measured share of total supply sits in exposed addresses.

A Cosmos SDK account address is a hash of the secp256k1 public key, so an account that has never signed keeps its key off the chain. The key is recorded with the account's opening transaction, and staking DYDX, depositing collateral or trading all need signed transactions, so actively held DYDX sits behind a revealed key. Validator consensus keys are published by design. No measurement of the exposed share has been published. source

Placement in the band The top of the band rather than a 3: the address structure is the same as on other Cosmos SDK key-hash chains, where any send, delegation or order reveals the key. It is not a 0 or a 1 because never-used addresses do keep their keys hidden.

6 Verification 2/10, weighted 5%

Band 0 to 2: No post-quantum component exists, or the claims rest on marketing.

No post-quantum component protects dYdX Chain, so there is nothing to verify. Its SDK fork carries secp256k1, secp256r1, Ed25519 and multisig keys and no ML-DSA, and the permissioned-key authenticator verifies secp256k1 signatures alone. Under v1.8 the openness of the classical code earns nothing here. source

Placement in the band The top of the band rather than a 0 or a 1: there is no post-quantum component to verify, but nothing about the chain is marketed as quantum-safe, so its position does not rest on marketing.

The deployment dimension is not a separate judgement. It is Tier 5 expressed as a number. See the tier mapping.

How it compares

All 80 rated chains on the 0 to 100 scale. dYdX Chain is marked. Select any point to open that profile.
dYdX 8.5

Nearest chains in the ranking

The 9 chains dYdX sits among, out of 80 rated. The last column is the gap in Hardy points from dYdX.

Rank Chain Tier Hardy vs DYDX
55 Bitcoin SV 5: Exposed 8.5 level
56 Celestia 5: Exposed 8.5 level
57 Chiliz Chain 5: Exposed 8.5 level
58 Conflux 5: Exposed 8.5 level
59 dYdX Chain this chain 5: Exposed 8.5
60 eCash 5: Exposed 8.5 level
61 Filecoin 5: Exposed 8.5 level
62 GateChain 5: Exposed 8.5 level
63 Gnosis Chain 5: Exposed 8.5 level

Roadmap

  1. 11 July 2025 shipped

    Governance proposal 259 passes and disables the wethDYDX bridge that carried DYDX from Ethereum to dYdX Chain. A proposal to re-enable it for twelve months, proposal 302, was rejected in November 2025. source

  2. 28 July 2026 shipped

    Cosmos SDK v0.55.0 is released upstream with ML-DSA-65 keys for accounts and validators. It is a framework release; dYdX's fork remains on the v0.50 line. source

  3. 11 October 2026 shipped

    Governance proposal 398, the dYdX Chain v9.8 software upgrade, passes. Mainnet now runs protocol v9.8.1 on dYdX's fork of Cosmos SDK v0.50. It changes no signature scheme. source

  4. No plan published proposed

    A post-quantum plan for dYdX accounts or validators, including any move of its SDK fork to a release with ML-DSA keys. None was found in governance, on the dYdX forum or from the dYdX Foundation. source

If holders never migrate

No stated policy

Neither dYdX governance nor the dYdX Foundation has said anything about post-quantum migration, so nothing has been said about accounts that never move to post-quantum keys.

As of 22 October 2026. Published beside the score, not in it. Every chain's stance is compared on the commitments page.

Exposure

Exposure measures how much of the chain's value already sits behind a public key that an attacker can record today and break later. This is the part of the threat that a future upgrade cannot undo.

dYdX Chain uses the Cosmos SDK account model. An address is a hash of the account's secp256k1 public key, so a never-used address has not published its key, but the key goes on-chain with the account's opening transaction and stays there. Staking DYDX needs a signed delegation and trading needs signed deposits and orders, so the DYDX that is actively held, staked or traded with sits behind revealed keys. Permissioned keys added to an account are stored with it as secp256k1 public keys. Validator consensus keys are Ed25519 keys published by design, and the chain's API listed 21 validators in the latest set on 22 October 2026, after governance proposal 396 cut the active set to 21 in September 2026. DYDX that remains on Ethereum as the ethDYDX ERC-20 is protected by Ethereum's signatures, not dYdX Chain's, and its exposure belongs to Ethereum's profile. No measurement of the exposed share of supply has been published, so the score rests on the address model.

What this rating means for you

If you hold dYdX

dYdX runs quantum-vulnerable signatures with no published post-quantum plan that we could find. Nothing here is urgent today, and there is also nothing scheduled to change it.

Editorial guidance from the Hardy Index.

Embed this rating

Paste this anywhere to show dYdX Chain's current rating. It renders live from the index, so it updates when the rating does, and the review date is written into the image. There is nothing to sign up for and nothing to pay. 

<a href="https://hardyindex.com/chains/dydx"><img src="https://hardyindex.com/badge/dydx.svg" width="260" height="76" alt="Quantum readiness rated by the Hardy Index"></a>

The image is /badge/dydx.svg. It is a plain SVG with no script and no tracking, it sets no cookie, and it records nothing about whoever loads it.

Questions

Is dYdX Chain quantum-safe?

No. DYDX accounts sign with ECDSA on secp256k1 and validators sign with Ed25519, both of which a large enough quantum computer would break. dYdX has published no plan to change either.

Does the Cosmos SDK's post-quantum release protect DYDX?

No. ML-DSA-65 keys arrived in Cosmos SDK v0.55. dYdX Chain runs its own fork of Cosmos SDK v0.50, which does not include them, so no DYDX holder or dYdX validator can use an ML-DSA key until dYdX moves its fork to that release and passes a software upgrade, and neither has been proposed.

Do dYdX permissioned keys help with a post-quantum migration?

Not as built. Permissioned keys let an account add further keys, each with limits on what it can sign, without moving funds. Every key they accept is a secp256k1 key, and the account's original key still works whatever is added, so they cannot move an account off a quantum-vulnerable key.

What about DYDX on Ethereum?

DYDX also exists as the ethDYDX ERC-20 token on Ethereum, where it is protected by Ethereum's signatures and falls under Ethereum's profile. The wethDYDX bridge to dYdX Chain has been disabled by governance since July 2025, and a proposal to reopen it was rejected in November 2025.

Are DYDX public keys already exposed?

For actively held DYDX, yes. An address is a hash of the key and hides it until the account signs, but staking, depositing and trading all reveal it. Those keys could be recorded now and attacked later by a quantum computer.

Sources

  1. dYdX Chain repository (v4-chain) dYdX Protocol (GitHub) · primary · checked 22 October 2026
  2. dYdX protocol go.mod at protocol/v9.8.1 dYdX Protocol (GitHub) · primary · checked 22 October 2026
  3. dYdX Cosmos SDK fork: crypto/keys dYdX Protocol (GitHub) · primary · checked 22 October 2026
  4. SignatureVerification authenticator (x/accountplus, protocol/v9.8.1) dYdX Protocol (GitHub) · primary · checked 22 October 2026
  5. Authenticator routing (x/accountplus/ante/circuit_breaker.go, protocol/v9.8.1) dYdX Protocol (GitHub) · primary · checked 22 October 2026
  6. Permissioned Keys dYdX documentation · primary · checked 22 October 2026
  7. dYdX mainnet node information dYdX mainnet API (PublicNode endpoint) · primary · checked 22 October 2026
  8. dYdX mainnet consensus parameters dYdX mainnet API (PublicNode endpoint) · primary · checked 22 October 2026
  9. dYdX latest validator set dYdX mainnet API (PublicNode endpoint) · primary · checked 22 October 2026
  10. dYdX mainnet transactions in block 110,585,002 dYdX mainnet API (PublicNode endpoint) · primary · checked 22 October 2026
  11. dYdX smart account parameters dYdX mainnet API (PublicNode endpoint) · primary · checked 22 October 2026
  12. dYdX governance proposals dYdX mainnet API (PublicNode endpoint) · primary · checked 22 October 2026
  13. dYdX governance proposal 398: dYdX Chain Software Upgrade v9.8 dYdX mainnet API (PublicNode endpoint) · primary · checked 22 October 2026
  14. dYdX governance proposal 396: Reduce the active validator set to 21 dYdX mainnet API (PublicNode endpoint) · primary · checked 22 October 2026
  15. dYdX governance proposal 259: Final Cessation of Support for the wethDYDX Smart Contract (the Bridge) dYdX mainnet API (PublicNode endpoint) · primary · checked 22 October 2026
  16. dYdX governance proposal 302: Re-enable Support for the wethDYDX Smart Contract dYdX mainnet API (PublicNode endpoint) · primary · checked 22 October 2026
  17. dYdX bridge safety parameters dYdX mainnet API (PublicNode endpoint) · primary · checked 22 October 2026
  18. [DRC] Re-enable support for the wethDYDX Smart Contract (i.e., the Bridge) on the dYdX Chain side for 12 months dYdX Forum · primary · checked 22 October 2026
  19. Accounts (Cosmos SDK v0.53) Cosmos SDK documentation (Cosmos Labs) · primary · checked 22 October 2026
  20. Post-quantum keys Cosmos SDK documentation (Cosmos Labs) · primary · checked 22 October 2026
  21. Cosmos SDK v0.55.0 release Cosmos SDK (GitHub) · primary · checked 22 October 2026
Cite this rating

A rating is only true as of the day an editor last reviewed it, so both forms below carry that date and the methodology version, with the date its cited sources were last checked. If you are quoting the score, quote those too.

Plain text

The Hardy Index (2026). dYdX Chain: quantum readiness assessment. Hardy Score 8.5 of 100, Tier 5: Exposed. Methodology v1.8. Last reviewed 22 October 2026; sources checked 13 November 2026. https://hardyindex.com/chains/dydx

BibTeX 
@misc{hardyindex_dydx_2026,
  author       = {{The Hardy Index}},
  title        = {dYdX Chain: quantum readiness assessment},
  year         = {2026},
  howpublished = {\url{https://hardyindex.com/chains/dydx}},
  note         = {Hardy Score 8.5 of 100, Tier 5: Exposed. Methodology v1.8},
  urldate      = {2026-11-13}
}

The whole dataset is reusable under the terms on the about page. A machine-readable version of this page is at /chains/dydx.md.

This is a security-readiness assessment, not investment advice.