Chain profile
The Web3 Foundation published a post-quantum roadmap covering Polkadot and JAM, naming Dilithium for consensus signatures and Falcon for accounts.
No, not today. Polkadot signs with sr25519, a Schnorr construction over the Ristretto compression of Curve25519, and with Ed25519 in places, and Shor's algorithm breaks both. Polkadot's answer is unusually broad in scope because a proof-of-stake network with a shared security model has many different signatures to replace, not just account keys. The Web3 Foundation's published roadmap for Polkadot and JAM sets out replacements across the board: the signatures used in GRANDPA finality, BABE block production and other protocol messages move to CRYSTALS-Dilithium, while user account signatures move to Falcon. As of 2026 none of that is live at protocol level, which places Polkadot alongside Ethereum, Cardano and the other chains with a credible published plan and a classical present.
sr25519 (Schnorr over Ristretto-compressed Curve25519), with Ed25519 in some roles
CRYSTALS-Dilithium for consensus signatures; Falcon for account signatures
FIPS 204 (ML-DSA, standardised Dilithium); Falcon pending final publication
Tier 3: Committed. A funded roadmap with public dates and active research exists, but no post-quantum signature is live on mainnet.
| No. | Dimension | Score | Weight | Contribution |
|---|---|---|---|---|
| 1 | Signature scheme | 0 | 30% | 0.0 |
| 2 | Deployment stage | 5 | 25% | 12.5 |
| 3 | NIST alignment | 8 | 15% | 12.0 |
| 4 | Migration path | 6 | 15% | 9.0 |
| 5 | Exposure | 3 | 10% | 3.0 |
| 6 | Verification | 8 | 5% | 4.0 |
| Hardy Score | 40.5 | |||
Polkadot uses sr25519 for most signing and Ed25519 in places, both elliptic-curve schemes broken by Shor's algorithm. No post-quantum signature is live at protocol level for accounts or consensus. source
Tier 3: Committed. A published Web3 Foundation roadmap covers both Polkadot and JAM, names specific replacement schemes for each signature role, and is backed by a research organisation, with nothing live on mainnet. source
The roadmap names CRYSTALS-Dilithium, standardised as ML-DSA in FIPS 204, for consensus signatures and Falcon for account signatures. One is a final standard and the other is NIST-selected but not yet published, which is why this is not a 9 or 10. source
Polkadot has a genuine advantage in that its runtime is upgradeable on-chain through forkless upgrades and on-chain governance, so enacting a cryptographic change does not require a contentious hard fork. The deduction is for the breadth of the problem: consensus, parachain and account signatures all have to move, and no dated schedule was found. source
Polkadot addresses are SS58 encodings of the public key itself rather than a hash of it, so an account's key is readable from its address without the account ever having signed. Balances are therefore harvestable today. source
The roadmap was published openly on the Polkadot forum by the Web3 Foundation, the cryptography is documented in public research and wiki material, and the implementation is open source and independently audited. source
The deployment dimension is not a separate judgement. It is Tier 3 expressed as a number. See the tier mapping.
The Web3 Foundation publishes a post-quantum cryptography roadmap covering both Polkadot and JAM. source
Research and implementation work toward replacing GRANDPA, BABE and protocol-message signatures with CRYSTALS-Dilithium. source
Falcon account signatures for Polkadot and its app chains. No dated schedule for mainnet deployment was found at the time of writing. source
Exposure measures how much of the chain's value already sits behind a public key that an attacker can record today and break later. This is the part of the threat that a future upgrade cannot undo.
A Polkadot address in SS58 format encodes the account's public key directly, with a network prefix and a checksum, rather than encoding a hash of the key. That means the key can be read straight off the address, and an account does not need to have signed anything for its key to be known. This is the same structural position as Algorand and Solana, and it means every classical DOT balance is available for harvest-now-decrypt-later collection today rather than only after first spend.
What this rating means for you
Polkadot has a funded roadmap but no post-quantum signature protecting funds on mainnet yet. Until it ships, your exposure is the ordinary one, and the steps that reduce it cost nothing.
Editorial guidance from the Hardy Index. Nothing on this profile is sponsored and nothing on it is an affiliate link. The guides carry disclosed affiliate links, which never affect a rating. How we make money.
No. Polkadot signs with sr25519 and Ed25519, both of which are broken by Shor's algorithm on a sufficiently large quantum computer. The Web3 Foundation has published a post-quantum roadmap naming replacement schemes, but nothing post-quantum is live at protocol level.
Two different schemes for two different jobs. Consensus signatures, meaning those used in GRANDPA finality, BABE block production and other protocol messages, move to CRYSTALS-Dilithium. User account signatures, including those of app chains built on Polkadot, move to Falcon.
Probably not, and that is one of its advantages. Polkadot's runtime can be upgraded on-chain through its governance process without requiring node operators to coordinate a hard fork. The difficulty is scope rather than mechanism: consensus, parachain and account signatures all have to change.
Because a Polkadot address is an encoding of the public key itself rather than a hash of it. On Bitcoin or Cardano, a funded address that has never spent keeps its key private. On Polkadot the key is readable from the address, so every classical balance is exposed to collection today.
This is a security-readiness assessment, not investment advice.