Hardy Index Quantum readiness, rated and tracked

Chain profile

Injective

INJ Exposed

Accounts sign with Ethereum-style ECDSA on secp256k1 and validators with Ed25519, and Injective's post-quantum position is a set of posts saying development is in progress, with no scheme, proposal or date.

Is Injective quantum-safe?

No. Injective accounts use the eth_secp256k1 key type, ECDSA on the secp256k1 curve with Ethereum-style addresses, and the same key controls an account's native inj address and its EVM address. Validators sign consensus votes with Ed25519, the only validator key type Injective's live consensus parameters allow. A sufficiently large quantum computer running Shor's algorithm would break both. Injective's official account began saying in October 2026 that quantum resistance is on the way: on 8 October it replied that "Quantum-proof infra is coming to Injective", on 12 October it posted that it had "Just heard from the dev team" and that development is "officially in progress", and on 17 October it listed quantum resistance as "In development". None of these posts names a scheme, links code, a specification or a governance proposal, or gives a date, and the rewritten whitepaper Injective published in October 2026 does not mention post-quantum cryptography. Mainnet runs a Cosmos SDK v0.50 fork, which has no post-quantum key type.

Where we are making a judgement call Three judgement calls carry this profile. The first is the tier. Injective's official account says its development team is building quantum-resistant infrastructure, and the source is the project itself, but the Tier 4 floor asks for a formal improvement proposal or a public research programme, and a post saying work is in progress, with no scheme, design, code or proposal behind it, is neither. A reader who counts an announced in-house development effort as a research programme would place Injective in Tier 4, with a deployment score of 2 and a Hardy Score of 11.0 rather than 8.5. The second is verification. We read "Quantum Resistance: In development" as a statement of intent rather than a claim that INJ is quantum-safe today, so the score stays at 2; a reader who treats that post as marketing a quantum-safety claim with nothing behind it would score verification 1, a Hardy Score of 8.0. The third is migration, which credits the ML-DSA-65 key type in the upstream Cosmos SDK as a mechanism Injective could adopt. Injective runs a private fork of Cosmos SDK v0.50 and has not said it will adopt the upstream work, and scored without that credit migration would be 1, a Hardy Score of 7.0. The same upstream code earns nothing for NIST alignment or verification, because those score what the chain runs or has named, and Injective's own fork of SDK v0.50 has no ML-DSA key type and Injective has named no scheme; migration credits it only as a route Injective could take. A reader who credits the upstream ML-DSA-65 implementation as the Cosmos Hub profile does would score NIST alignment 5 and verification 3, a Hardy Score of 16.5. A related limit on the evidence: Injective's node source has been private since 9 September 2026, so the account scheme is read from the last published release branch, v1.20.x, and the validator scheme from the live network, while mainnet runs v1.20.4.

At a glance

On mainnet today

ECDSA on secp256k1 (eth_secp256k1, Ethereum-style addresses) for accounts and validator operators; Ed25519 for validator consensus keys

Post-quantum scheme

None named. Injective says quantum-resistant infrastructure is in development, without naming a scheme.

NIST standard

None adopted.

Readiness tier

Tier 5: Exposed. The signatures securing funds on mainnet today are quantum-vulnerable, and no public post-quantum plan, proposal or research programme addressing them could be found.

Cryptography in use

  • Account signatures ECDSA on secp256k1 eth_secp256k1 Mainnet, default Read from the release/v1.20.x branch, the last published source. Mainnet runs v1.20.4, whose source has not been published. The ante handler also recognises Cosmos secp256k1, Ed25519 and multisig keys. Source code or release
  • Validator consensus Ed25519 Mainnet, mandatory Mainnet consensus parameters list ed25519 as the only validator key type; every bonded validator's consensus key read on 22 October 2026 was Ed25519. Read on-chain

A role not listed is not evidenced either way. Every scheme, and which other chains share it, is in the cryptography registry.

Score breakdown

Each dimension scored 0 to 10. The weight beside it is its share of the total score.
Signature scheme 0 30% Deployment stage 1 25% NIST alignment 0 15% Migration path 2 15% Exposure 2 10% Verification 2 5%
Show the weighted arithmetic and the sourced note for each dimension
No. Dimension Score Weight Contribution
1 Signature scheme 0 30% 0.0
2 Deployment stage 1 25% 2.5
3 NIST alignment 0 15% 0.0
4 Migration path 2 15% 3.0
5 Exposure 2 10% 2.0
6 Verification 2 5% 1.0
Hardy Score 8.5

1 Signature scheme 0/10, weighted 30%

Band 0: Classical signatures only on mainnet, with nothing post-quantum protecting live funds. Short-lived devnets and one-off benchmarks sit here: they demonstrate research rather than something a user can hold keys on.

Injective's signature-verification gas consumer recognises eth_secp256k1, secp256k1, Ed25519 and multisig keys and rejects any other type, all of them classical, and its mainnet consensus parameters allow Ed25519 validator keys and nothing else. Nothing post-quantum protects INJ or any asset on Injective. source

2 Deployment stage 1/10, weighted 25%

Band 1: Tier 5: Exposed.

Tier 5: Exposed. The signatures protecting funds and finalising blocks are quantum-vulnerable, and Injective's published position is a series of social posts saying quantum-resistant infrastructure is in development, which is neither a formal improvement proposal nor a public research programme. See the caveat on why this is a judgement call. source

3 NIST alignment 0/10, weighted 15%

Band 0 to 2: No post-quantum scheme named for the chain’s fund-protecting signatures, or a proprietary scheme with no public cryptanalysis.

Injective has not named a post-quantum scheme for its account or validator signatures, as a selection or as an example, so there is nothing to assess against a NIST standard. source

Placement in the band The floor of the band rather than a 1 or a 2: the posts promise quantum resistance without saying what it would be built on, so there is no named scheme, even a candidate, to align with a standard.

4 Migration path 2/10, weighted 15%

Band 0 to 2: No agreed migration path, or the proposals on the table would strand or freeze holder funds.

No migration plan exists. Injective changes its chain through governance-approved software upgrades, and the Cosmos SDK it forks now ships ML-DSA-65 keys for accounts and validators in v0.55, a mechanism Injective could adopt. Mainnet runs a fork of Cosmos SDK v0.50, and nothing Injective has said addresses how holders would move to post-quantum keys. source

Placement in the band The top of the band rather than a 1: Injective has acknowledged the quantum problem in public, and a working post-quantum key type exists upstream in the framework it runs on. Not a 3, because the acknowledgement is a promise of infrastructure, not a recognition of the migration problem, and no mechanism for Injective holders has been described.

5 Exposure 2/10, weighted 10%

Band 0 to 2: Public keys are exposed for effectively all accounts, or a large, measured share of total supply sits in exposed addresses.

An Injective address is derived as on Ethereum, from the Keccak hash of the eth_secp256k1 public key, so an account that has never signed keeps its key private. Every account that has transacted or staked has published its key, and a key that has signed on any EVM chain exposes the same address on Injective. Validator consensus keys are public by design. source

Placement in the band The top of the band rather than a 1: never-signed addresses keep their keys hidden. Not a 3, because staking INJ needs a signed delegation, so almost all actively held INJ sits behind a revealed key, and no measurement of the unexposed share has been published.

6 Verification 2/10, weighted 5%

Band 0 to 2: No post-quantum component exists, or the claims rest on marketing.

No post-quantum component exists to verify: no code, specification, proposal or testnet was found, and the posts saying development is in progress link to none. Injective's node source has also been private since 9 September 2026, so any future component could not be checked from the public repository as it stands. source

Placement in the band The top of the band rather than a 0 or a 1: there is nothing to verify, but Injective does not claim to be quantum-safe today; its posts describe quantum resistance as coming, not as delivered.

The deployment dimension is not a separate judgement. It is Tier 5 expressed as a number. See the tier mapping.

How it compares

All 80 rated chains on the 0 to 100 scale. Injective is marked. Select any point to open that profile.
Injective 8.5

Nearest chains in the ranking

The 9 chains Injective sits among, out of 80 rated. The last column is the gap in Hardy points from Injective.

Rank Chain Tier Hardy vs INJ
60 eCash 5: Exposed 8.5 level
61 Filecoin 5: Exposed 8.5 level
62 GateChain 5: Exposed 8.5 level
63 Gnosis Chain 5: Exposed 8.5 level
64 Injective this chain 5: Exposed 8.5
65 KCC (KuCoin Community Chain) 5: Exposed 8.5 level
66 Kite 5: Exposed 8.5 level
67 Mina Protocol 5: Exposed 8.5 level
68 MultiversX 5: Exposed 8.5 level

Roadmap

  1. October 2026 shipped

    Injective publishes its rewritten whitepaper, describing accounts controlled by secp256k1 keys with native and Ethereum-style addresses. It does not mention post-quantum cryptography. source

  2. 8 October 2026 shipped

    Injective's official account replies to another user, verbatim apart from a closing hourglass emoji: "Quantum-proof infra is coming to Injective". source

  3. 12 October 2026 shipped

    Injective's official account posts, verbatim apart from a closing hourglass emoji: "Just heard from the dev team. Quantum-resistant infrastructure is coming to $INJ Development is officially in progress". It names no scheme, code, proposal or date. source

  4. 17 October 2026 shipped

    Injective's official account posts a list of what Injective is built for, ending "Privacy: In development" and "Quantum Resistance: In development", each followed by an hourglass emoji. source

  5. No date published proposed

    A named post-quantum scheme, specification, governance proposal, testnet or delivery date for Injective's signatures. None has been published; the last hundred governance proposals, back to December 2025, include none on the subject. source

If holders never migrate

No stated policy

Injective's posts say quantum-resistant infrastructure is in development but say nothing about how existing accounts would move to it or what happens to accounts that never do.

As of 22 October 2026. source Published beside the score, not in it. Every chain's stance is compared on the commitments page.

Exposure

Exposure measures how much of the chain's value already sits behind a public key that an attacker can record today and break later. This is the part of the threat that a future upgrade cannot undo.

Injective's eth_secp256k1 key type derives an address the way Ethereum does, from the Keccak hash of the public key, and shows it both as a native inj Bech32 address and as an Ethereum-style hex address. An account that has received INJ but never signed has not published its key. That protection ends with the first transaction, and because staking INJ needs a signed delegation, almost every holder of consequence has signed. Keys are also shared with Ethereum's format, so a key that has signed on Ethereum or any other EVM chain is published for the same address on Injective. Validator consensus keys are Ed25519 keys published in the validator set by design.

What this rating means for you

If you hold Injective

Injective runs quantum-vulnerable signatures with no published post-quantum plan that we could find. Nothing here is urgent today, and there is also nothing scheduled to change it.

Editorial guidance from the Hardy Index.

Embed this rating

Paste this anywhere to show Injective's current rating. It renders live from the index, so it updates when the rating does, and the review date is written into the image. There is nothing to sign up for and nothing to pay. 

<a href="https://hardyindex.com/chains/injective"><img src="https://hardyindex.com/badge/injective.svg" width="260" height="76" alt="Quantum readiness rated by the Hardy Index"></a>

The image is /badge/injective.svg. It is a plain SVG with no script and no tracking, it sets no cookie, and it records nothing about whoever loads it.

Questions

Is Injective quantum-safe?

No. Injective accounts sign with ECDSA on secp256k1 using Ethereum-style keys, and validators sign consensus votes with Ed25519. A sufficiently large quantum computer would break both. Injective says quantum-resistant infrastructure is in development, but nothing post-quantum runs on mainnet or on a test network.

What has Injective said about quantum resistance?

In October 2026 its official account posted that quantum-proof infrastructure is coming, that the development team had confirmed development is officially in progress, and that quantum resistance is in development alongside privacy. No scheme, specification, code, governance proposal or date accompanies any of it.

Can Injective use the Cosmos SDK's post-quantum keys?

Not as it stands. ML-DSA-65 keys for accounts and validators arrived in Cosmos SDK v0.55, and Injective's mainnet runs its own fork of Cosmos SDK v0.50. Adopting them would take a governance-approved software upgrade that brings the work into Injective's fork, and none has been proposed.

Are INJ holders' public keys already exposed?

For almost all INJ in use, yes. An Injective address is a hash of the key and hides it until the account signs, but staking needs a signed delegation and active accounts have transacted. A key that has signed on Ethereum or another EVM chain is also visible for the same address on Injective.

What would move Injective up the index?

A governance proposal or a published research programme on post-quantum signatures for Injective's accounts or validators would meet the Tier 4 floor. A plan from Injective naming the scheme it will adopt would meet Tier 3, and published code or a testnet would lift the NIST alignment and verification scores.

Sources

  1. Injective accounts Injective documentation · primary · checked 22 October 2026
  2. Injective ante handler (injective-chain/app/ante/ante.go, release/v1.20.x) Injective Foundation (GitHub) · primary · checked 22 October 2026
  3. eth_secp256k1 key type (injective-chain/crypto/ethsecp256k1/ethsecp256k1.go, release/v1.20.x) Injective Foundation (GitHub) · primary · checked 22 October 2026
  4. injective-core repository Injective Foundation (GitHub) · primary · checked 22 October 2026
  5. Injective mainnet consensus parameters Injective (public LCD endpoint) · primary · checked 22 October 2026
  6. Injective mainnet node information Injective (public LCD endpoint) · primary · checked 22 October 2026
  7. Injective: A Finance-Native Layer 1 Blockchain (whitepaper, October 2026) Injective · primary · checked 22 October 2026
  8. Quantum-resistant infrastructure is coming to $INJ (12 October 2026) Injective (X) · primary · checked 22 October 2026
  9. Quantum-proof infra is coming to Injective (8 October 2026) Injective (X) · primary · checked 22 October 2026
  10. Injective is built for (17 October 2026) Injective (X) · primary · checked 22 October 2026
  11. Injective governance proposals Injective Hub · primary · checked 22 October 2026
  12. Post-quantum keys Cosmos SDK documentation (Cosmos Labs) · primary · checked 22 October 2026
  13. Cosmos SDK v0.55.0 release Cosmos SDK (GitHub) · primary · checked 22 October 2026
Cite this rating

A rating is only true as of the day an editor last reviewed it, so both forms below carry that date and the methodology version, with the date its cited sources were last checked. If you are quoting the score, quote those too.

Plain text

The Hardy Index (2026). Injective: quantum readiness assessment. Hardy Score 8.5 of 100, Tier 5: Exposed. Methodology v1.8. Last reviewed 22 October 2026; sources checked 13 November 2026. https://hardyindex.com/chains/injective

BibTeX 
@misc{hardyindex_injective_2026,
  author       = {{The Hardy Index}},
  title        = {Injective: quantum readiness assessment},
  year         = {2026},
  howpublished = {\url{https://hardyindex.com/chains/injective}},
  note         = {Hardy Score 8.5 of 100, Tier 5: Exposed. Methodology v1.8},
  urldate      = {2026-11-13}
}

The whole dataset is reusable under the terms on the about page. A machine-readable version of this page is at /chains/injective.md.

This is a security-readiness assessment, not investment advice.