--- title: Is Monad quantum-safe? chain: Monad ticker: MON hardy_score: 20 rank: 29 of 80 tier: "4: Debating" url: "https://hardyindex.com/chains/monad" updated: 2026-10-22 reviewed: 2026-11-13 methodology_version: 1.8 --- # Is Monad quantum-safe? **Hardy Score 20.0 / 100. Rank 29 of 80. Tier 4: Debating. Last editorial review 22 October 2026; sources checked 13 November 2026.** No. Monad accounts are secured by ECDSA on the secp256k1 curve, inherited from the EVM, and validators sign with secp256k1 and BLS12-381. A sufficiently large quantum computer would break all of them. Monad's work so far is design and direction rather than code. In August 2026 Kushal Babel and Jan Camenisch of Category Labs, the company that builds Monad, posted a Draft proposal, Flexible and Upgradeable Account Authentication, which separates an account's address from the keys that control it so a holder could add a post-quantum key and retire the old one in place. It lists ML-DSA as one of its initial schemes but defers the concrete specification. On 28 September 2026 the Monad Foundation published a post-quantum roadmap that puts wallet authentication ahead of consensus, staking and the EVM, and says post-quantum consensus work has started. Neither document selects a scheme for mainnet or publishes a date, which is why Monad sits in Tier 4 rather than Tier 3. > This is a security-readiness assessment, not investment advice. ## Summary Mainnet signs with ECDSA on secp256k1, and the Monad Foundation has published a post-quantum roadmap that starts with a Draft account-authentication design but names no scheme and no date. ## Where we are making a judgement call The tier is a judgement call. The Monad Foundation has published a post-quantum roadmap, and Category Labs, which builds Monad, has a Draft proposal that names ML-DSA. A reader who combines the two, treating the roadmap as the plan and the draft as its named scheme, would place Monad in Tier 3, raising the deployment score from 2 to 5 and the Hardy Score by 7.5 points. We read them separately, because the roadmap itself names no scheme, and a draft that lists ML-DSA among possible schemes without a parameter set is not a plan to adopt it. ## Score breakdown | # | Dimension | Score | Weight | Contribution | |---:|---|---:|---:|---:| | 1 | Signature scheme | 0/10 | 30% | 0.0 | | 2 | Deployment stage | 2/10 | 25% | 5.0 | | 3 | NIST alignment | 4/10 | 15% | 6.0 | | 4 | Migration path | 4/10 | 15% | 6.0 | | 5 | Exposure | 2/10 | 10% | 2.0 | | 6 | Verification | 2/10 | 5% | 1.0 | | | **Hardy Score** | | | **20.0** | ### 1. Signature scheme: 0/10 Anchor band 0: Classical signatures only on mainnet, with nothing post-quantum protecting live funds. Short-lived devnets and one-off benchmarks sit here: they demonstrate research rather than something a user can hold keys on. Monad recovers transaction senders with ECDSA on secp256k1, and nothing post-quantum protects MON on mainnet. The P-256 precompile lets smart accounts verify passkeys, but P-256 is also an elliptic curve broken by Shor's algorithm, and no post-quantum scheme runs on any Monad network. Source: https://github.com/category-labs/monad/blob/main/category/execution/ethereum/core/ecrecover/impl.cpp ### 2. Deployment stage: 2/10 Anchor band 2: Tier 4: Debating. Tier 4: Debating. The account-authentication design is a formal Draft proposal by Category Labs researchers in Monad's improvement-proposal forum, and the Monad Foundation's roadmap sets out a public post-quantum programme. It is not Tier 3 because the roadmap names no post-quantum scheme and no funded programme to select one, and the proposal that does name ML-DSA is a Draft. Source: https://monad.xyz/blog/post-quantum-roadmap ### 3. NIST alignment: 4/10 Anchor band 3 to 5: NIST schemes are referenced as candidates without a committed selection, or the work is bespoke research. The Draft authentication proposal lists ML-DSA, from the final FIPS 204, among its initial scheme identifiers. It names no parameter set, and the Monad Foundation's roadmap names no scheme at all for accounts or validators. Placement in the band: A 4 rather than a 5: ML-DSA appears as one entry in a list of schemes the design could carry, with no parameter set and the concrete specification deferred, so it is a reference, not a selection. Not a 3, because the scheme named for Monad's own accounts is a final NIST standard. Source: https://forum.monad.xyz/t/flexible-and-upgradeable-account-authentication/526 ### 4. Migration path: 4/10 Anchor band 3 to 5: Migration is acknowledged as a problem with no agreed mechanism, or the mechanism is contested. The Draft proposal would let a holder keep an address and change what authorises it: add a post-quantum authenticator, then retire the ECDSA key, through a precompile with a delay before changes take effect. Existing accounts would keep working as single-key ECDSA accounts until they upgrade. Placement in the band: Not a 5: the proposal is a version-one architecture with its implementation specification deferred, nothing runs on any network, and neither it nor the roadmap says what happens to accounts that never upgrade. Not a 3, because a specific in-place mechanism has been designed for the chain's own accounts. Source: https://forum.monad.xyz/t/flexible-and-upgradeable-account-authentication/526 ### 5. Exposure: 2/10 Anchor band 0 to 2: Public keys are exposed for effectively all accounts, or a large, measured share of total supply sits in exposed addresses. A Monad address is the Keccak hash of the public key, as on Ethereum, so an account that has never signed keeps its key private. Accounts in use have signed and published their keys, and because Monad uses Ethereum's key and address format, a key published on any EVM chain exposes the same address on Monad. Placement in the band: At the top of the band rather than a 0 or a 1: never-signed accounts are genuinely protected by the hashed address, though key reuse across EVM chains means an address can be exposed on Monad without having signed there. Source: https://github.com/category-labs/monad/blob/main/category/execution/ethereum/core/ecrecover/impl.cpp ### 6. Verification: 2/10 Anchor band 0 to 2: No post-quantum component exists, or the claims rest on marketing. No post-quantum component exists to verify. The authentication design is a forum Draft with no implementation, and no post-quantum code was found in Category Labs' public repositories. The forum thread has drawn outside comment on the design, but under v1.8 review of a proposal is not review of a component. Placement in the band: The top of the band rather than a 0 or a 1: there is nothing to verify, but Monad does not market itself as quantum-safe, and its roadmap says plainly that users would have to migrate to gain protection. Source: https://forum.monad.xyz/t/flexible-and-upgradeable-account-authentication/526 ## Nearest chains in the ranking The chains Monad sits among, out of 80 rated. The last column is the gap in Hardy points from Monad. | Rank | Chain | Tier | Hardy | vs MON | |---:|---|---|---:|---:| | 25 | [Sei](https://hardyindex.com/chains/sei) | 4: Debating | 24.5 | +4.5 | | 26 | [Cosmos Hub](https://hardyindex.com/chains/cosmos-hub) | 4: Debating | 23.5 | +3.5 | | 27 | [Kaspa](https://hardyindex.com/chains/kaspa) | 4: Debating | 20.5 | +0.5 | | 28 | [BNB Chain](https://hardyindex.com/chains/bnb-chain) | 4: Debating | 20.0 | level | | 29 | **Monad** | 4: Debating | 20.0 | this chain | | 30 | [XDC Network](https://hardyindex.com/chains/xdc-network) | 4: Debating | 20.0 | level | | 31 | [Bittensor](https://hardyindex.com/chains/bittensor) | 4: Debating | 19.0 | -1.0 | | 32 | [Monero](https://hardyindex.com/chains/monero) | 4: Debating | 17.5 | -2.5 | | 33 | [Neo](https://hardyindex.com/chains/neo) | 4: Debating | 17.0 | -3.0 | ## Signature scheme - **On mainnet today:** ECDSA on secp256k1 for accounts; secp256k1 and BLS12-381 for validators; P-256 verification available to contracts - **Post-quantum scheme:** ML-DSA listed as an initial scheme in a Draft account-authentication proposal; no parameter set, implementation or mainnet plan. Post-quantum consensus work started, scheme unnamed. - **NIST standard:** FIPS 204 (ML-DSA), finalised August 2024 - **Readiness tier:** Tier 4: Debating. Post-quantum work on the chain’s own signatures is documented by people with authority over it, in a formal improvement proposal or a public research programme, but no scheme is agreed and no timeline is published. ## Cryptography in use - **Account signatures:** [ECDSA on secp256k1](https://hardyindex.com/algorithms/ecdsa-secp256k1.md). Mainnet, default. Source (source code or release): https://github.com/category-labs/monad/blob/main/category/execution/ethereum/core/ecrecover/impl.cpp - **Validator consensus:** [BLS signatures on BLS12-381](https://hardyindex.com/algorithms/bls12-381.md). Mainnet, mandatory. Votes and timeouts, aggregated into certificates. Source (specification or proposal): https://docs.monad.xyz/monad-arch/consensus/authentication - **Validator consensus:** [ECDSA on secp256k1](https://hardyindex.com/algorithms/ecdsa-secp256k1.md). Mainnet, mandatory. The node's signature type is monad_secp::SecpSignature, ECDSA on secp256k1, used for message integrity and authenticity on consensus messages that are not aggregated; the documentation says ECDSA without naming the curve. Source (source code or release): https://github.com/category-labs/monad-bft/blob/master/monad-node-config/src/lib.rs - **Contract level:** [ECDSA on secp256r1](https://hardyindex.com/algorithms/ecdsa-secp256r1.md). Mainnet, opt-in. P-256 precompile at 0x0100 (EIP-7951), used by smart accounts for passkeys. Source (specification or proposal): https://docs.monad.xyz/developer-essentials/precompiles - **Account signatures:** [ML-DSA](https://hardyindex.com/algorithms/ml-dsa.md). Proposed. Listed as an initial scheme identifier in a Draft proposal; no parameter set named. Source (specification or proposal): https://forum.monad.xyz/t/flexible-and-upgradeable-account-authentication/526 A role not listed here is not evidenced either way. See https://hardyindex.com/algorithms.md. ## Roadmap - **November 2025** (shipped): Monad public mainnet goes live as an EVM-compatible chain, reported in press coverage as launching on 24 November 2025. Monad's documentation lists it as chain ID 143, with accounts signed by ECDSA on secp256k1. Source: https://docs.monad.xyz/developer-essentials/network-information.md - **21 August 2026** (shipped): Kushal Babel and Jan Camenisch of Category Labs post Flexible and Upgradeable Account Authentication to the Monad forum as a Draft: addresses fixed at creation, authenticators that can be added, rotated and retired, and ML-DSA among the initial schemes. Source: https://forum.monad.xyz/t/flexible-and-upgradeable-account-authentication/526 - **28 September 2026** (shipped): The Monad Foundation publishes Monad's post-quantum roadmap, ordering the work from wallet authentication and consensus through staking, the EVM, proof infrastructure and the encrypted mempool. It names no scheme and no Monad date. Source: https://monad.xyz/blog/post-quantum-roadmap - **Ongoing** (in-progress): Work on a post-quantum version of Cadence, part of Monad's consensus layer, runs in parallel with the account work. No scheme has been published for it. Source: https://monad.xyz/blog/post-quantum-roadmap - **No date published** (proposed): A concrete implementation specification for account authentication, a selected post-quantum scheme, and any testnet or mainnet deployment. None has been published. Source: https://monad.xyz/blog/post-quantum-roadmap ## If holders never migrate **No stated policy.** Neither the Draft authentication proposal nor the Monad Foundation's post-quantum roadmap says what happens to accounts that never add a post-quantum key. The proposal leaves existing accounts working as single-key ECDSA accounts, with no sunset. As of 22 October 2026. Source: https://monad.xyz/blog/post-quantum-roadmap ## Exposure Monad keeps Ethereum's address model: an address is the last twenty bytes of the Keccak hash of the public key, so an account that has never signed has not published its key. That protection ends when the account signs, and accounts in active use have. Monad adds a wrinkle of its own: because it accepts the same keys and addresses as Ethereum, a holder who reuses a key that has already signed on Ethereum or another EVM chain has a published key on Monad too, even if the Monad account has never sent a transaction. The Draft authentication proposal would keep addresses fixed, so it would not change which keys are public, but it would let an exposed account stop accepting its classical key. ## Frequently asked questions ### Is Monad quantum-safe? No. Monad accounts are secured by ECDSA on the secp256k1 curve, inherited from the EVM, and validators sign with secp256k1 and BLS12-381. A sufficiently large quantum computer would break all of them. Monad's work so far is design and direction rather than code. In August 2026 Kushal Babel and Jan Camenisch of Category Labs, the company that builds Monad, posted a Draft proposal, Flexible and Upgradeable Account Authentication, which separates an account's address from the keys that control it so a holder could add a post-quantum key and retire the old one in place. It lists ML-DSA as one of its initial schemes but defers the concrete specification. On 28 September 2026 the Monad Foundation published a post-quantum roadmap that puts wallet authentication ahead of consensus, staking and the EVM, and says post-quantum consensus work has started. Neither document selects a scheme for mainnet or publishes a date, which is why Monad sits in Tier 4 rather than Tier 3. ### Is Monad quantum-safe? No. Monad accounts sign with ECDSA on the secp256k1 curve and validators sign with secp256k1 and BLS12-381, and a sufficiently large quantum computer would break all of them. Monad has a published post-quantum roadmap and a Draft account proposal, but nothing post-quantum protects MON on mainnet or on a test network. ### Does Monad's P-256 passkey support make accounts quantum-resistant? No. The P-256 precompile lets smart accounts check passkey signatures, which helps with wallet usability, but P-256 is an elliptic curve and Shor's algorithm breaks it just as it breaks secp256k1. It is relevant to the post-quantum story in a different way: the account-authentication proposal would let one account carry several kinds of key, which is the same machinery a post-quantum key would need. ### What is Flexible and Upgradeable Account Authentication? A Draft proposal posted to the Monad forum on 21 August 2026 by Kushal Babel and Jan Camenisch of Category Labs. It separates an account's address from the credentials that control it, so keys can be added, rotated or retired without moving funds, and lists ML-DSA among its initial schemes. Its concrete implementation specification is deferred, and nothing has been deployed. ### What does Monad's post-quantum roadmap commit to? An order of work rather than a schedule. The roadmap, published by the Monad Foundation on 28 September 2026, puts wallet authentication and consensus at the front, followed by staking, the EVM's cryptographic precompiles, proof infrastructure and the encrypted mempool. It names no post-quantum scheme and gives no date for Monad. ## What this rating means if you hold Monad Plain-language guidance from the same publication, with no product recommendation attached. - [Is my crypto safe from quantum computers?](https://hardyindex.com/guides/is-my-crypto-safe-from-quantum-computers.md) - [How to protect your crypto from quantum computers](https://hardyindex.com/guides/how-to-protect-crypto-from-quantum-computers.md) - [All guides](https://hardyindex.com/guides.md) ## Sources 1. [Flexible and Upgradeable Account Authentication](https://forum.monad.xyz/t/flexible-and-upgradeable-account-authentication/526): Monad forum (primary, checked 22 October 2026) 2. [Monad's post-quantum roadmap](https://monad.xyz/blog/post-quantum-roadmap): Monad Foundation (primary, checked 22 October 2026) 3. [Monad Ecosystem Highlights: August 2026](https://monad.xyz/blog/monad-ecosystem-highlights-august-2026): Monad Foundation (primary, checked 22 October 2026) 4. [ecrecover implementation, Monad execution client](https://github.com/category-labs/monad/blob/main/category/execution/ethereum/core/ecrecover/impl.cpp): Category Labs (GitHub) (primary, checked 22 October 2026) 5. [Consensus authentication](https://docs.monad.xyz/monad-arch/consensus/authentication): Monad documentation (primary, checked 22 October 2026) 6. [monad-node-config signature types, Monad consensus client](https://github.com/category-labs/monad-bft/blob/master/monad-node-config/src/lib.rs): Category Labs (GitHub) (primary, checked 22 October 2026) 7. [Precompiles](https://docs.monad.xyz/developer-essentials/precompiles): Monad documentation (primary, checked 22 October 2026) 8. [Network information](https://docs.monad.xyz/developer-essentials/network-information): Monad documentation (primary, checked 22 October 2026) 9. [Jan Camenisch](https://www.category.xyz/team/jan-camenisch): Category Labs (primary, checked 22 October 2026) 10. [FIPS 204: Module-Lattice-Based Digital Signature Standard (ML-DSA)](https://csrc.nist.gov/pubs/fips/204/final): NIST (primary, checked 22 October 2026) 11. [Network Information: Mainnet](https://docs.monad.xyz/developer-essentials/network-information.md): Monad Documentation (primary, checked 22 October 2026) ## How to cite this rating A rating is only true as of the day it was reviewed, so both forms carry the review date and the methodology version. If you are quoting the score, quote those too. The Hardy Index (2026). Monad: quantum readiness assessment. Hardy Score 20.0 of 100, Tier 4: Debating. Methodology v1.8. Last reviewed 22 October 2026; sources checked 13 November 2026. https://hardyindex.com/chains/monad ```bibtex @misc{hardyindex_monad_2026, author = {{The Hardy Index}}, title = {Monad: quantum readiness assessment}, year = {2026}, howpublished = {\url{https://hardyindex.com/chains/monad}}, note = {Hardy Score 20.0 of 100, Tier 4: Debating. Methodology v1.8}, urldate = {2026-11-13} } ``` --- Methodology: https://hardyindex.com/methodology (v1.8). Cite as: The Hardy Index, "Monad", https://hardyindex.com/chains/monad, as of 13 November 2026.