Chain profile
Widely described as quantum-resistant on the strength of a scheme it removed in 2021; IOTA's layer 1 has signed with Ed25519 since Chrysalis and post-quantum support exists only in IOTA Identity.
No, despite a reputation that says otherwise. IOTA originally used Winternitz one-time signatures, a hash-based scheme that is genuinely quantum-resistant, and that is the source of the claim still repeated across the internet today. The Chrysalis upgrade replaced Winternitz with Ed25519, an elliptic-curve scheme that Shor's algorithm breaks, in exchange for reusable addresses and a much better developer experience. IOTA does have real post-quantum cryptography today, but it lives in IOTA Identity, where version 1.7 supports ML-DSA, SLH-DSA and Falcon, plus hybrid combinations with EdDSA, for issuing and verifying verifiable credentials. That protects credentials, not tokens: it is not the signature scheme securing layer-1 transactions. We found no published, dated plan to restore post-quantum signatures at layer 1, which is why IOTA sits in Tier 4 rather than Tier 1.
Where we are making a judgement call IOTA is the clearest case in this index of a reputation outliving the fact. Its quantum-resistance claim was accurate before 2021 and is repeatedly restated in current articles, listicles and AI answers. We rate the signature scheme that protects IOTA tokens on mainnet today, which is Ed25519.
Ed25519 (EdDSA over Curve25519 with SHA-512) for layer-1 transactions
ML-DSA, SLH-DSA and Falcon in IOTA Identity v1.7 for verifiable credentials, including hybrid EdDSA combinations. None at layer 1.
FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) in the identity layer only
Tier 4: Debating. The threat is acknowledged and proposals exist, but there is no consensus and no published timeline.
| No. | Dimension | Score | Weight | Contribution |
|---|---|---|---|---|
| 1 | Signature scheme | 0 | 30% | 0.0 |
| 2 | Deployment stage | 2 | 25% | 5.0 |
| 3 | NIST alignment | 4 | 15% | 6.0 |
| 4 | Migration path | 2 | 15% | 3.0 |
| 5 | Exposure | 4 | 10% | 4.0 |
| 6 | Verification | 6 | 5% | 3.0 |
| Hardy Score | 21.0 | |||
IOTA layer-1 transactions are signed with Ed25519, which replaced the quantum-resistant Winternitz one-time signature scheme in the Chrysalis upgrade. No post-quantum signature protects IOTA tokens on mainnet. source
Tier 4: Debating. IOTA acknowledges the threat and has shipped post-quantum algorithms in its identity layer, but we found no published roadmap with dates for restoring post-quantum signatures at layer 1. source
IOTA Identity v1.7 supports genuinely NIST-standardised schemes: ML-DSA at security levels 44, 65 and 87, SLH-DSA at 128, 192 and 256 bits, and Falcon at 512 and 1024, along with hybrid EdDSA combinations. The algorithm choices are sound; they are deployed in the credential layer rather than in consensus. source
No published layer-1 migration plan or date was found. IOTA has demonstrated it can change its signature scheme network-wide, having done exactly that in Chrysalis, so the capability is proven even though the plan is absent. source
Post-Chrysalis IOTA addresses are derived from a hash of the Ed25519 public key rather than being the key itself, so unspent, never-signed holdings are not yet harvestable. Any address that has signed has published its key. source
IOTA's protocol and identity libraries are open source and the signature change is documented in a public Tangle Improvement Proposal, so the facts are checkable. The deduction is for the gap between the documented reality and the widely circulated claim that IOTA is quantum-resistant, which IOTA has not prominently corrected. source
The deployment dimension is not a separate judgement. It is Tier 4 expressed as a number. See the tier mapping.
IOTA launches using Winternitz one-time signatures over the ternary Kerl hash, a hash-based scheme resistant to Shor's algorithm but limited to one safe signature per address. source
The Chrysalis upgrade replaces Winternitz one-time signatures with Ed25519, adopting reusable addresses and standard tooling and removing IOTA's quantum resistance at layer 1. source
IOTA Identity adds ML-DSA, SLH-DSA and Falcon, plus hybrid EdDSA combinations, for issuing and verifying post-quantum verifiable credentials. source
No published plan or date for restoring post-quantum signatures to IOTA's layer-1 transaction signing was found at the time of writing. source
Exposure measures how much of the chain's value already sits behind a public key that an attacker can record today and break later. This is the part of the threat that a future upgrade cannot undo.
Post-Chrysalis IOTA addresses are Blake2b hashes of Ed25519 public keys, so a funded address that has never signed does not have its key on-chain and is not harvestable today. Once an address signs, the key is published. IOTA's earlier Winternitz addresses had the opposite property in a stricter form: signing even once from a Winternitz address published enough key material that signing a second time was unsafe, which is the usability problem Chrysalis was designed to solve.
What this rating means for you
IOTA has acknowledged the threat without agreeing a plan, so nothing is going to change for holders in the near term. That makes address hygiene the part worth attending to.
Editorial guidance from the Hardy Index. Nothing on this profile is sponsored and nothing on it is an affiliate link. The guides carry disclosed affiliate links, which never affect a rating. How we make money.
No, not since 2021. IOTA's layer-1 transactions are signed with Ed25519, which a sufficiently large quantum computer would break. IOTA was quantum-resistant before the Chrysalis upgrade, when it used Winternitz one-time signatures, and that earlier fact is the source of the claim still widely repeated today.
Usability. Winternitz one-time signatures are safe for exactly one signature per address; from the second signature onward, enough key material has been exposed that the funds on that address are considered insecure. Chrysalis replaced the scheme with Ed25519 to get reusable addresses, standard cryptographic tooling and a conventional developer experience.
Yes, but not where tokens live. IOTA Identity v1.7 supports ML-DSA, SLH-DSA and Falcon, plus hybrid combinations with EdDSA, for issuing and verifying verifiable credentials and presentations. That is a genuine post-quantum capability in the identity layer. It does not protect IOTA balances, which are still secured by Ed25519.
IOTA has stated an intention to adopt future quantum-resistant standards, but at the time of writing we could not find a published roadmap with dates or a named scheme for layer-1 transaction signing. That absence, rather than the absence of intent, is what places IOTA in Tier 4: Debating.
This is a security-readiness assessment, not investment advice.