--- title: Is IOTA quantum-safe? chain: IOTA ticker: IOTA hardy_score: 21 rank: 16 of 23 tier: "4: Debating" url: "https://hardyindex.com/chains/iota" updated: 2026-08-11 methodology_version: 1.1 --- # Is IOTA quantum-safe? **Hardy Score 21.0 / 100. Rank 16 of 23. Tier 4: Debating. As of 11 August 2026.** No, despite a reputation that says otherwise. IOTA originally used Winternitz one-time signatures, a hash-based scheme that is genuinely quantum-resistant, and that is the source of the claim still repeated across the internet today. The Chrysalis upgrade replaced Winternitz with Ed25519, an elliptic-curve scheme that Shor's algorithm breaks, in exchange for reusable addresses and a much better developer experience. IOTA does have real post-quantum cryptography today, but it lives in IOTA Identity, where version 1.7 supports ML-DSA, SLH-DSA and Falcon, plus hybrid combinations with EdDSA, for issuing and verifying verifiable credentials. That protects credentials, not tokens: it is not the signature scheme securing layer-1 transactions. We found no published, dated plan to restore post-quantum signatures at layer 1, which is why IOTA sits in Tier 4 rather than Tier 1. > This is a security-readiness assessment, not investment advice. ## Summary Widely described as quantum-resistant on the strength of a scheme it removed in 2021; IOTA's layer 1 has signed with Ed25519 since Chrysalis and post-quantum support exists only in IOTA Identity. ## Where we are making a judgement call IOTA is the clearest case in this index of a reputation outliving the fact. Its quantum-resistance claim was accurate before 2021 and is repeatedly restated in current articles, listicles and AI answers. We rate the signature scheme that protects IOTA tokens on mainnet today, which is Ed25519. ## Score breakdown | # | Dimension | Score | Weight | Contribution | |---:|---|---:|---:|---:| | 1 | Signature scheme | 0/10 | 30% | 0.0 | | 2 | Deployment stage | 2/10 | 25% | 5.0 | | 3 | NIST alignment | 4/10 | 15% | 6.0 | | 4 | Migration path | 2/10 | 15% | 3.0 | | 5 | Exposure | 4/10 | 10% | 4.0 | | 6 | Verification | 6/10 | 5% | 3.0 | | | **Hardy Score** | | | **21.0** | ### 1. Signature scheme: 0/10 IOTA layer-1 transactions are signed with Ed25519, which replaced the quantum-resistant Winternitz one-time signature scheme in the Chrysalis upgrade. No post-quantum signature protects IOTA tokens on mainnet. Source: https://github.com/iotaledger/tips/blob/1d82efcd67895097ffabdb3f4fcb00f1646859f7/text/0009-ed25519-signature-scheme/0009-ed25519-signature-scheme.md ### 2. Deployment stage: 2/10 Tier 4: Debating. IOTA acknowledges the threat and has shipped post-quantum algorithms in its identity layer, but we found no published roadmap with dates for restoring post-quantum signatures at layer 1. Source: https://docs.iota.org/developer/iota-identity/how-tos/post-quantum ### 3. NIST alignment: 4/10 IOTA Identity v1.7 supports genuinely NIST-standardised schemes: ML-DSA at security levels 44, 65 and 87, SLH-DSA at 128, 192 and 256 bits, and Falcon at 512 and 1024, along with hybrid EdDSA combinations. The algorithm choices are sound; they are deployed in the credential layer rather than in consensus. Source: https://docs.iota.org/developer/iota-identity/how-tos/post-quantum ### 4. Migration path: 2/10 No published layer-1 migration plan or date was found. IOTA has demonstrated it can change its signature scheme network-wide, having done exactly that in Chrysalis, so the capability is proven even though the plan is absent. Source: https://docs.iota.org/developer/iota-identity/how-tos/post-quantum ### 5. Exposure: 4/10 Post-Chrysalis IOTA addresses are derived from a hash of the Ed25519 public key rather than being the key itself, so unspent, never-signed holdings are not yet harvestable. Any address that has signed has published its key. Source: https://github.com/iotaledger/tips/blob/1d82efcd67895097ffabdb3f4fcb00f1646859f7/text/0009-ed25519-signature-scheme/0009-ed25519-signature-scheme.md ### 6. Verification: 6/10 IOTA's protocol and identity libraries are open source and the signature change is documented in a public Tangle Improvement Proposal, so the facts are checkable. The deduction is for the gap between the documented reality and the widely circulated claim that IOTA is quantum-resistant, which IOTA has not prominently corrected. Source: https://github.com/iotaledger/tips/blob/1d82efcd67895097ffabdb3f4fcb00f1646859f7/text/0009-ed25519-signature-scheme/0009-ed25519-signature-scheme.md ## Signature scheme - **On mainnet today:** Ed25519 (EdDSA over Curve25519 with SHA-512) for layer-1 transactions - **Post-quantum scheme:** ML-DSA, SLH-DSA and Falcon in IOTA Identity v1.7 for verifiable credentials, including hybrid EdDSA combinations. None at layer 1. - **NIST standard:** FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) in the identity layer only - **Readiness tier:** Tier 4: Debating. The threat is acknowledged and proposals exist, but there is no consensus and no published timeline. ## Roadmap - **2017** (shipped): IOTA launches using Winternitz one-time signatures over the ternary Kerl hash, a hash-based scheme resistant to Shor's algorithm but limited to one safe signature per address. Source: https://github.com/iotaledger/tips/blob/1d82efcd67895097ffabdb3f4fcb00f1646859f7/text/0009-ed25519-signature-scheme/0009-ed25519-signature-scheme.md - **2021** (shipped): The Chrysalis upgrade replaces Winternitz one-time signatures with Ed25519, adopting reusable addresses and standard tooling and removing IOTA's quantum resistance at layer 1. Source: https://github.com/iotaledger/tips/blob/1d82efcd67895097ffabdb3f4fcb00f1646859f7/text/0009-ed25519-signature-scheme/0009-ed25519-signature-scheme.md - **IOTA Identity v1.7** (shipped): IOTA Identity adds ML-DSA, SLH-DSA and Falcon, plus hybrid EdDSA combinations, for issuing and verifying post-quantum verifiable credentials. Source: https://docs.iota.org/developer/iota-identity/how-tos/post-quantum - **No date published** (proposed): No published plan or date for restoring post-quantum signatures to IOTA's layer-1 transaction signing was found at the time of writing. Source: https://docs.iota.org/developer/iota-identity/how-tos/post-quantum ## Exposure Post-Chrysalis IOTA addresses are Blake2b hashes of Ed25519 public keys, so a funded address that has never signed does not have its key on-chain and is not harvestable today. Once an address signs, the key is published. IOTA's earlier Winternitz addresses had the opposite property in a stricter form: signing even once from a Winternitz address published enough key material that signing a second time was unsafe, which is the usability problem Chrysalis was designed to solve. ## Frequently asked questions ### Is IOTA quantum-safe? No, despite a reputation that says otherwise. IOTA originally used Winternitz one-time signatures, a hash-based scheme that is genuinely quantum-resistant, and that is the source of the claim still repeated across the internet today. The Chrysalis upgrade replaced Winternitz with Ed25519, an elliptic-curve scheme that Shor's algorithm breaks, in exchange for reusable addresses and a much better developer experience. IOTA does have real post-quantum cryptography today, but it lives in IOTA Identity, where version 1.7 supports ML-DSA, SLH-DSA and Falcon, plus hybrid combinations with EdDSA, for issuing and verifying verifiable credentials. That protects credentials, not tokens: it is not the signature scheme securing layer-1 transactions. We found no published, dated plan to restore post-quantum signatures at layer 1, which is why IOTA sits in Tier 4 rather than Tier 1. ### Is IOTA quantum-safe? No, not since 2021. IOTA's layer-1 transactions are signed with Ed25519, which a sufficiently large quantum computer would break. IOTA was quantum-resistant before the Chrysalis upgrade, when it used Winternitz one-time signatures, and that earlier fact is the source of the claim still widely repeated today. ### Why did IOTA give up its quantum-resistant signatures? Usability. Winternitz one-time signatures are safe for exactly one signature per address; from the second signature onward, enough key material has been exposed that the funds on that address are considered insecure. Chrysalis replaced the scheme with Ed25519 to get reusable addresses, standard cryptographic tooling and a conventional developer experience. ### Does IOTA have any post-quantum cryptography today? Yes, but not where tokens live. IOTA Identity v1.7 supports ML-DSA, SLH-DSA and Falcon, plus hybrid combinations with EdDSA, for issuing and verifying verifiable credentials and presentations. That is a genuine post-quantum capability in the identity layer. It does not protect IOTA balances, which are still secured by Ed25519. ### Is IOTA planning to bring back post-quantum signatures at layer 1? IOTA has stated an intention to adopt future quantum-resistant standards, but at the time of writing we could not find a published roadmap with dates or a named scheme for layer-1 transaction signing. That absence, rather than the absence of intent, is what places IOTA in Tier 4: Debating. ## What this rating means if you hold IOTA Plain-language guidance from the same publication, with no product recommendation attached. - [Is my crypto safe from quantum computers?](https://hardyindex.com/guides/is-my-crypto-safe-from-quantum-computers.md) - [How to protect your crypto from quantum computers](https://hardyindex.com/guides/how-to-protect-crypto-from-quantum-computers.md) - [All guides](https://hardyindex.com/guides.md) Nothing on this profile is sponsored and nothing on it is an affiliate link. See https://hardyindex.com/how-we-make-money.md. ## Sources 1. [TIP-0009: Ed25519 Signature Scheme](https://github.com/iotaledger/tips/blob/1d82efcd67895097ffabdb3f4fcb00f1646859f7/text/0009-ed25519-signature-scheme/0009-ed25519-signature-scheme.md): IOTA Foundation (Tangle Improvement Proposals) (primary, checked 11 August 2026) 2. [Post-Quantum Cryptography: IOTA Identity](https://docs.iota.org/developer/iota-identity/how-tos/post-quantum): IOTA Foundation (primary, checked 11 August 2026) 3. [FIPS 205: Stateless Hash-Based Digital Signature Standard (SLH-DSA)](https://csrc.nist.gov/pubs/fips/205/final): NIST (primary, checked 11 August 2026) --- Methodology: https://hardyindex.com/methodology (v1.1). Cite as: The Hardy Index, "IOTA", https://hardyindex.com/chains/iota, as of 11 August 2026.