--- title: Is Injective quantum-safe? chain: Injective ticker: INJ hardy_score: 8.5 rank: 64 of 80 tier: "5: Exposed" url: "https://hardyindex.com/chains/injective" updated: 2026-10-22 reviewed: 2026-11-13 methodology_version: 1.8 --- # Is Injective quantum-safe? **Hardy Score 8.5 / 100. Rank 64 of 80. Tier 5: Exposed. Last editorial review 22 October 2026; sources checked 13 November 2026.** No. Injective accounts use the eth_secp256k1 key type, ECDSA on the secp256k1 curve with Ethereum-style addresses, and the same key controls an account's native inj address and its EVM address. Validators sign consensus votes with Ed25519, the only validator key type Injective's live consensus parameters allow. A sufficiently large quantum computer running Shor's algorithm would break both. Injective's official account began saying in October 2026 that quantum resistance is on the way: on 8 October it replied that "Quantum-proof infra is coming to Injective", on 12 October it posted that it had "Just heard from the dev team" and that development is "officially in progress", and on 17 October it listed quantum resistance as "In development". None of these posts names a scheme, links code, a specification or a governance proposal, or gives a date, and the rewritten whitepaper Injective published in October 2026 does not mention post-quantum cryptography. Mainnet runs a Cosmos SDK v0.50 fork, which has no post-quantum key type. > This is a security-readiness assessment, not investment advice. ## Summary Accounts sign with Ethereum-style ECDSA on secp256k1 and validators with Ed25519, and Injective's post-quantum position is a set of posts saying development is in progress, with no scheme, proposal or date. ## Where we are making a judgement call Three judgement calls carry this profile. The first is the tier. Injective's official account says its development team is building quantum-resistant infrastructure, and the source is the project itself, but the Tier 4 floor asks for a formal improvement proposal or a public research programme, and a post saying work is in progress, with no scheme, design, code or proposal behind it, is neither. A reader who counts an announced in-house development effort as a research programme would place Injective in Tier 4, with a deployment score of 2 and a Hardy Score of 11.0 rather than 8.5. The second is verification. We read "Quantum Resistance: In development" as a statement of intent rather than a claim that INJ is quantum-safe today, so the score stays at 2; a reader who treats that post as marketing a quantum-safety claim with nothing behind it would score verification 1, a Hardy Score of 8.0. The third is migration, which credits the ML-DSA-65 key type in the upstream Cosmos SDK as a mechanism Injective could adopt. Injective runs a private fork of Cosmos SDK v0.50 and has not said it will adopt the upstream work, and scored without that credit migration would be 1, a Hardy Score of 7.0. The same upstream code earns nothing for NIST alignment or verification, because those score what the chain runs or has named, and Injective's own fork of SDK v0.50 has no ML-DSA key type and Injective has named no scheme; migration credits it only as a route Injective could take. A reader who credits the upstream ML-DSA-65 implementation as the Cosmos Hub profile does would score NIST alignment 5 and verification 3, a Hardy Score of 16.5. A related limit on the evidence: Injective's node source has been private since 9 September 2026, so the account scheme is read from the last published release branch, v1.20.x, and the validator scheme from the live network, while mainnet runs v1.20.4. ## Score breakdown | # | Dimension | Score | Weight | Contribution | |---:|---|---:|---:|---:| | 1 | Signature scheme | 0/10 | 30% | 0.0 | | 2 | Deployment stage | 1/10 | 25% | 2.5 | | 3 | NIST alignment | 0/10 | 15% | 0.0 | | 4 | Migration path | 2/10 | 15% | 3.0 | | 5 | Exposure | 2/10 | 10% | 2.0 | | 6 | Verification | 2/10 | 5% | 1.0 | | | **Hardy Score** | | | **8.5** | ### 1. Signature scheme: 0/10 Anchor band 0: Classical signatures only on mainnet, with nothing post-quantum protecting live funds. Short-lived devnets and one-off benchmarks sit here: they demonstrate research rather than something a user can hold keys on. Injective's signature-verification gas consumer recognises eth_secp256k1, secp256k1, Ed25519 and multisig keys and rejects any other type, all of them classical, and its mainnet consensus parameters allow Ed25519 validator keys and nothing else. Nothing post-quantum protects INJ or any asset on Injective. Source: https://github.com/InjectiveFoundation/injective-core/blob/release/v1.20.x/injective-chain/app/ante/ante.go ### 2. Deployment stage: 1/10 Anchor band 1: Tier 5: Exposed. Tier 5: Exposed. The signatures protecting funds and finalising blocks are quantum-vulnerable, and Injective's published position is a series of social posts saying quantum-resistant infrastructure is in development, which is neither a formal improvement proposal nor a public research programme. See the caveat on why this is a judgement call. Source: https://x.com/injective/status/2109620612054253814 ### 3. NIST alignment: 0/10 Anchor band 0 to 2: No post-quantum scheme named for the chain’s fund-protecting signatures, or a proprietary scheme with no public cryptanalysis. Injective has not named a post-quantum scheme for its account or validator signatures, as a selection or as an example, so there is nothing to assess against a NIST standard. Placement in the band: The floor of the band rather than a 1 or a 2: the posts promise quantum resistance without saying what it would be built on, so there is no named scheme, even a candidate, to align with a standard. Source: https://x.com/injective/status/2109620612054253814 ### 4. Migration path: 2/10 Anchor band 0 to 2: No agreed migration path, or the proposals on the table would strand or freeze holder funds. No migration plan exists. Injective changes its chain through governance-approved software upgrades, and the Cosmos SDK it forks now ships ML-DSA-65 keys for accounts and validators in v0.55, a mechanism Injective could adopt. Mainnet runs a fork of Cosmos SDK v0.50, and nothing Injective has said addresses how holders would move to post-quantum keys. Placement in the band: The top of the band rather than a 1: Injective has acknowledged the quantum problem in public, and a working post-quantum key type exists upstream in the framework it runs on. Not a 3, because the acknowledgement is a promise of infrastructure, not a recognition of the migration problem, and no mechanism for Injective holders has been described. Source: https://sentry.lcd.injective.network/cosmos/base/tendermint/v1beta1/node_info ### 5. Exposure: 2/10 Anchor band 0 to 2: Public keys are exposed for effectively all accounts, or a large, measured share of total supply sits in exposed addresses. An Injective address is derived as on Ethereum, from the Keccak hash of the eth_secp256k1 public key, so an account that has never signed keeps its key private. Every account that has transacted or staked has published its key, and a key that has signed on any EVM chain exposes the same address on Injective. Validator consensus keys are public by design. Placement in the band: The top of the band rather than a 1: never-signed addresses keep their keys hidden. Not a 3, because staking INJ needs a signed delegation, so almost all actively held INJ sits behind a revealed key, and no measurement of the unexposed share has been published. Source: https://github.com/InjectiveFoundation/injective-core/blob/release/v1.20.x/injective-chain/crypto/ethsecp256k1/ethsecp256k1.go ### 6. Verification: 2/10 Anchor band 0 to 2: No post-quantum component exists, or the claims rest on marketing. No post-quantum component exists to verify: no code, specification, proposal or testnet was found, and the posts saying development is in progress link to none. Injective's node source has also been private since 9 September 2026, so any future component could not be checked from the public repository as it stands. Placement in the band: The top of the band rather than a 0 or a 1: there is nothing to verify, but Injective does not claim to be quantum-safe today; its posts describe quantum resistance as coming, not as delivered. Source: https://github.com/InjectiveFoundation/injective-core ## Nearest chains in the ranking The chains Injective sits among, out of 80 rated. The last column is the gap in Hardy points from Injective. | Rank | Chain | Tier | Hardy | vs INJ | |---:|---|---|---:|---:| | 60 | [eCash](https://hardyindex.com/chains/ecash) | 5: Exposed | 8.5 | level | | 61 | [Filecoin](https://hardyindex.com/chains/filecoin) | 5: Exposed | 8.5 | level | | 62 | [GateChain](https://hardyindex.com/chains/gatechain) | 5: Exposed | 8.5 | level | | 63 | [Gnosis Chain](https://hardyindex.com/chains/gnosis) | 5: Exposed | 8.5 | level | | 64 | **Injective** | 5: Exposed | 8.5 | this chain | | 65 | [KCC (KuCoin Community Chain)](https://hardyindex.com/chains/kcc) | 5: Exposed | 8.5 | level | | 66 | [Kite](https://hardyindex.com/chains/kite) | 5: Exposed | 8.5 | level | | 67 | [Mina Protocol](https://hardyindex.com/chains/mina) | 5: Exposed | 8.5 | level | | 68 | [MultiversX](https://hardyindex.com/chains/multiversx) | 5: Exposed | 8.5 | level | ## Signature scheme - **On mainnet today:** ECDSA on secp256k1 (eth_secp256k1, Ethereum-style addresses) for accounts and validator operators; Ed25519 for validator consensus keys - **Post-quantum scheme:** None named. Injective says quantum-resistant infrastructure is in development, without naming a scheme. - **NIST standard:** None adopted. - **Readiness tier:** Tier 5: Exposed. The signatures securing funds on mainnet today are quantum-vulnerable, and no public post-quantum plan, proposal or research programme addressing them could be found. ## Cryptography in use - **Account signatures:** [ECDSA on secp256k1](https://hardyindex.com/algorithms/ecdsa-secp256k1.md) (eth_secp256k1). Mainnet, default. Read from the release/v1.20.x branch, the last published source. Mainnet runs v1.20.4, whose source has not been published. The ante handler also recognises Cosmos secp256k1, Ed25519 and multisig keys. Source (source code or release): https://github.com/InjectiveFoundation/injective-core/blob/release/v1.20.x/injective-chain/crypto/ethsecp256k1/ethsecp256k1.go - **Validator consensus:** [Ed25519](https://hardyindex.com/algorithms/ed25519.md). Mainnet, mandatory. Mainnet consensus parameters list ed25519 as the only validator key type; every bonded validator's consensus key read on 22 October 2026 was Ed25519. Source (read on-chain): https://sentry.lcd.injective.network/cosmos/consensus/v1/params A role not listed here is not evidenced either way. See https://hardyindex.com/algorithms.md. ## Roadmap - **October 2026** (shipped): Injective publishes its rewritten whitepaper, describing accounts controlled by secp256k1 keys with native and Ethereum-style addresses. It does not mention post-quantum cryptography. Source: https://injective.com/Injective-A-Finance-Native-Layer-1-Blockchain.pdf - **8 October 2026** (shipped): Injective's official account replies to another user, verbatim apart from a closing hourglass emoji: "Quantum-proof infra is coming to Injective". Source: https://x.com/injective/status/2107989312520536513 - **12 October 2026** (shipped): Injective's official account posts, verbatim apart from a closing hourglass emoji: "Just heard from the dev team. Quantum-resistant infrastructure is coming to $INJ Development is officially in progress". It names no scheme, code, proposal or date. Source: https://x.com/injective/status/2109620612054253814 - **17 October 2026** (shipped): Injective's official account posts a list of what Injective is built for, ending "Privacy: In development" and "Quantum Resistance: In development", each followed by an hourglass emoji. Source: https://x.com/injective/status/2111287433673515371 - **No date published** (proposed): A named post-quantum scheme, specification, governance proposal, testnet or delivery date for Injective's signatures. None has been published; the last hundred governance proposals, back to December 2025, include none on the subject. Source: https://injhub.com/proposals/ ## If holders never migrate **No stated policy.** Injective's posts say quantum-resistant infrastructure is in development but say nothing about how existing accounts would move to it or what happens to accounts that never do. As of 22 October 2026. Source: https://x.com/injective/status/2109620612054253814 ## Exposure Injective's eth_secp256k1 key type derives an address the way Ethereum does, from the Keccak hash of the public key, and shows it both as a native inj Bech32 address and as an Ethereum-style hex address. An account that has received INJ but never signed has not published its key. That protection ends with the first transaction, and because staking INJ needs a signed delegation, almost every holder of consequence has signed. Keys are also shared with Ethereum's format, so a key that has signed on Ethereum or any other EVM chain is published for the same address on Injective. Validator consensus keys are Ed25519 keys published in the validator set by design. ## Frequently asked questions ### Is Injective quantum-safe? No. Injective accounts use the eth_secp256k1 key type, ECDSA on the secp256k1 curve with Ethereum-style addresses, and the same key controls an account's native inj address and its EVM address. Validators sign consensus votes with Ed25519, the only validator key type Injective's live consensus parameters allow. A sufficiently large quantum computer running Shor's algorithm would break both. Injective's official account began saying in October 2026 that quantum resistance is on the way: on 8 October it replied that "Quantum-proof infra is coming to Injective", on 12 October it posted that it had "Just heard from the dev team" and that development is "officially in progress", and on 17 October it listed quantum resistance as "In development". None of these posts names a scheme, links code, a specification or a governance proposal, or gives a date, and the rewritten whitepaper Injective published in October 2026 does not mention post-quantum cryptography. Mainnet runs a Cosmos SDK v0.50 fork, which has no post-quantum key type. ### Is Injective quantum-safe? No. Injective accounts sign with ECDSA on secp256k1 using Ethereum-style keys, and validators sign consensus votes with Ed25519. A sufficiently large quantum computer would break both. Injective says quantum-resistant infrastructure is in development, but nothing post-quantum runs on mainnet or on a test network. ### What has Injective said about quantum resistance? In October 2026 its official account posted that quantum-proof infrastructure is coming, that the development team had confirmed development is officially in progress, and that quantum resistance is in development alongside privacy. No scheme, specification, code, governance proposal or date accompanies any of it. ### Can Injective use the Cosmos SDK's post-quantum keys? Not as it stands. ML-DSA-65 keys for accounts and validators arrived in Cosmos SDK v0.55, and Injective's mainnet runs its own fork of Cosmos SDK v0.50. Adopting them would take a governance-approved software upgrade that brings the work into Injective's fork, and none has been proposed. ### Are INJ holders' public keys already exposed? For almost all INJ in use, yes. An Injective address is a hash of the key and hides it until the account signs, but staking needs a signed delegation and active accounts have transacted. A key that has signed on Ethereum or another EVM chain is also visible for the same address on Injective. ### What would move Injective up the index? A governance proposal or a published research programme on post-quantum signatures for Injective's accounts or validators would meet the Tier 4 floor. A plan from Injective naming the scheme it will adopt would meet Tier 3, and published code or a testnet would lift the NIST alignment and verification scores. ## What this rating means if you hold Injective Plain-language guidance from the same publication, with no product recommendation attached. - [Is my crypto safe from quantum computers?](https://hardyindex.com/guides/is-my-crypto-safe-from-quantum-computers.md) - [How to protect your crypto from quantum computers](https://hardyindex.com/guides/how-to-protect-crypto-from-quantum-computers.md) - [All guides](https://hardyindex.com/guides.md) ## Sources 1. [Injective accounts](https://docs.injective.network/defi/wallet/accounts): Injective documentation (primary, checked 22 October 2026) 2. [Injective ante handler (injective-chain/app/ante/ante.go, release/v1.20.x)](https://github.com/InjectiveFoundation/injective-core/blob/release/v1.20.x/injective-chain/app/ante/ante.go): Injective Foundation (GitHub) (primary, checked 22 October 2026) 3. [eth_secp256k1 key type (injective-chain/crypto/ethsecp256k1/ethsecp256k1.go, release/v1.20.x)](https://github.com/InjectiveFoundation/injective-core/blob/release/v1.20.x/injective-chain/crypto/ethsecp256k1/ethsecp256k1.go): Injective Foundation (GitHub) (primary, checked 22 October 2026) 4. [injective-core repository](https://github.com/InjectiveFoundation/injective-core): Injective Foundation (GitHub) (primary, checked 22 October 2026) 5. [Injective mainnet consensus parameters](https://sentry.lcd.injective.network/cosmos/consensus/v1/params): Injective (public LCD endpoint) (primary, checked 22 October 2026) 6. [Injective mainnet node information](https://sentry.lcd.injective.network/cosmos/base/tendermint/v1beta1/node_info): Injective (public LCD endpoint) (primary, checked 22 October 2026) 7. [Injective: A Finance-Native Layer 1 Blockchain (whitepaper, October 2026)](https://injective.com/Injective-A-Finance-Native-Layer-1-Blockchain.pdf): Injective (primary, checked 22 October 2026) 8. [Quantum-resistant infrastructure is coming to $INJ (12 October 2026)](https://x.com/injective/status/2109620612054253814): Injective (X) (primary, checked 22 October 2026) 9. [Quantum-proof infra is coming to Injective (8 October 2026)](https://x.com/injective/status/2107989312520536513): Injective (X) (primary, checked 22 October 2026) 10. [Injective is built for (17 October 2026)](https://x.com/injective/status/2111287433673515371): Injective (X) (primary, checked 22 October 2026) 11. [Injective governance proposals](https://injhub.com/proposals/): Injective Hub (primary, checked 22 October 2026) 12. [Post-quantum keys](https://docs.cosmos.network/sdk/latest/keys/post-quantum-keys): Cosmos SDK documentation (Cosmos Labs) (primary, checked 22 October 2026) 13. [Cosmos SDK v0.55.0 release](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.55.0): Cosmos SDK (GitHub) (primary, checked 22 October 2026) ## How to cite this rating A rating is only true as of the day it was reviewed, so both forms carry the review date and the methodology version. If you are quoting the score, quote those too. The Hardy Index (2026). Injective: quantum readiness assessment. Hardy Score 8.5 of 100, Tier 5: Exposed. Methodology v1.8. Last reviewed 22 October 2026; sources checked 13 November 2026. https://hardyindex.com/chains/injective ```bibtex @misc{hardyindex_injective_2026, author = {{The Hardy Index}}, title = {Injective: quantum readiness assessment}, year = {2026}, howpublished = {\url{https://hardyindex.com/chains/injective}}, note = {Hardy Score 8.5 of 100, Tier 5: Exposed. Methodology v1.8}, urldate = {2026-11-13} } ``` --- Methodology: https://hardyindex.com/methodology (v1.8). Cite as: The Hardy Index, "Injective", https://hardyindex.com/chains/injective, as of 13 November 2026.