Chain profile
Accounts, block producers and the Heimdall validator set all sign with ECDSA on secp256k1, and no post-quantum proposal, plan or research programme for Polygon PoS's signatures could be found.
No. Polygon PoS accounts sign transactions with ECDSA on the secp256k1 curve through Bor, its fork of go-ethereum, and the same curve secures the rest of the chain: Bor block producers seal each block with a secp256k1 signature, and the Heimdall validator layer accepts only secp256k1 consensus keys, read directly from the live network's consensus parameters. Validators also sign the checkpoints that Polygon PoS posts to Ethereum. A sufficiently large quantum computer running Shor's algorithm would break every one of these signatures. We found no post-quantum position from Polygon Labs or the Polygon governance process: none of the Polygon Improvement Proposals mentions post-quantum signatures, and no blog post, forum proposal or roadmap addresses them. The one new signature scheme Polygon has added, a P-256 verification precompile for passkey wallets, is another elliptic curve and is no more quantum-resistant than secp256k1.
Where we are making a judgement call One judgement call concerns scope rather than score. Polygon PoS is rated as a layer 1 because it has its own validator set, its own consensus in Heimdall and Bor, and its own state, which the checkpoints it posts to Ethereum record but do not validate. Two features cut the other way, and a reader should weigh them. Validators stake POL in contracts on Ethereum, so the validator set itself is managed through Ethereum, and POL is also an ERC-20 token on Ethereum, where it is protected by Ethereum's signatures rather than Polygon's. A reader who treats Polygon PoS as a network secured partly by Ethereum would leave it out of the index rather than score it differently: every signature this profile scores is Polygon's own, and each is classical. The tier itself is not a judgement call: nothing post-quantum on the chain's signatures was found from Polygon Labs, in the PIPs repository or on the Polygon forum, so no reading of the record lifts Polygon PoS to Tier 4.
ECDSA on secp256k1 for accounts, Bor block seals, Heimdall validator consensus and checkpoint signatures; P-256 verification available to contracts
None. No post-quantum scheme has been proposed, selected or tested for Polygon PoS.
None adopted.
Tier 5: Exposed. The signatures securing funds on mainnet today are quantum-vulnerable, and no public post-quantum plan, proposal or research programme addressing them could be found.
A role not listed is not evidenced either way. Every scheme, and which other chains share it, is in the cryptography registry.
| No. | Dimension | Score | Weight | Contribution |
|---|---|---|---|---|
| 1 | Signature scheme | 0 | 30% | 0.0 |
| 2 | Deployment stage | 1 | 25% | 2.5 |
| 3 | NIST alignment | 0 | 15% | 0.0 |
| 4 | Migration path | 2 | 15% | 3.0 |
| 5 | Exposure | 2 | 10% | 2.0 |
| 6 | Verification | 2 | 5% | 1.0 |
| Hardy Score | 8.5 | |||
Band 0: Classical signatures only on mainnet, with nothing post-quantum protecting live funds. Short-lived devnets and one-off benchmarks sit here: they demonstrate research rather than something a user can hold keys on.
Bor recovers every transaction sender with ECDSA on secp256k1, and Heimdall's consensus parameters on mainnet accept secp256k1 validator keys and nothing else. The P-256 precompile added under PIP-27 verifies another elliptic curve. Nothing post-quantum protects POL or any asset on Polygon PoS. source
Band 1: Tier 5: Exposed.
Tier 5: Exposed. The signatures protecting funds and finalising blocks are quantum-vulnerable, and no Polygon Improvement Proposal, Polygon Labs publication, forum proposal or research programme on post-quantum signatures for Polygon PoS was found. source
Band 0 to 2: No post-quantum scheme named for the chain’s fund-protecting signatures, or a proprietary scheme with no public cryptanalysis.
No post-quantum scheme has been named for Polygon PoS's account, block-producer or validator signatures, so there is nothing to assess against a NIST standard. source
Placement in the band The floor of the band rather than a 1 or a 2: no scheme has been named at all, even as an example, by anyone with authority over the chain, so there is no choice to align with a standard.
Band 0 to 2: No agreed migration path, or the proposals on the table would strand or freeze holder funds.
No migration plan or published position exists. Polygon does have a working route for changing signature verification: PIP-27, a Final core proposal, added a secp256r1 precompile that shipped in the Napoli hard fork under PIP-33, and PIP-31, shipped in the same fork, brought Ethereum's Cancun EVM changes to Bor, which follows go-ethereum by merging upstream changes. Nothing has been proposed to put a post-quantum scheme through that process, and nothing addresses accounts whose keys are already public. source
Placement in the band The top of the band rather than a 0 or a 1: the PIP process has already carried a new signature-verification primitive to mainnet through a hard fork, and Bor's practice of adopting Ethereum's EVM changes gives Polygon a path to reuse Ethereum's work. Not a 3, because Polygon has not acknowledged the quantum problem in public, let alone described a route for holders.
Band 0 to 2: Public keys are exposed for effectively all accounts, or a large, measured share of total supply sits in exposed addresses.
Polygon PoS keeps Ethereum's account model: an address is a hash of the public key, so an account that has never signed keeps its key private. Every account that has sent a transaction has published its key, and because Polygon accepts the same keys and addresses as Ethereum, a key published on any EVM chain exposes the same address here. Validator signer keys are public in Heimdall's validator set by design. source
Placement in the band The top of the band rather than a 1: never-signed addresses keep their keys hidden. Not a 3, because almost all economically active POL sits behind a key that has signed, here or on another EVM chain, and no measurement of the unexposed share has been published.
Band 0 to 2: No post-quantum component exists, or the claims rest on marketing.
No post-quantum component exists for Polygon PoS: no code, specification or testnet implementation was found in Bor, Heimdall or the PIPs repository. Bor and Heimdall are open source, but under v1.8 the openness of classical code earns nothing on this dimension. source
Placement in the band The top of the band rather than a 0 or a 1: there is nothing post-quantum to verify, but nothing about Polygon PoS is marketed as quantum-safe, so its position does not rest on marketing.
The deployment dimension is not a separate judgement. It is Tier 5 expressed as a number. See the tier mapping.
The 9 chains Polygon sits among, out of 80 rated. The last column is the gap in Hardy points from Polygon.
| Rank | Chain | Tier | Hardy | vs POL |
|---|---|---|---|---|
| 65 | KCC (KuCoin Community Chain) | 5: Exposed | 8.5 | level |
| 66 | Kite | 5: Exposed | 8.5 | level |
| 67 | Mina Protocol | 5: Exposed | 8.5 | level |
| 68 | MultiversX | 5: Exposed | 8.5 | level |
| 69 | Polygon PoS this chain | 5: Exposed | 8.5 | |
| 70 | Provenance Blockchain | 5: Exposed | 8.5 | level |
| 71 | Theta Network | 5: Exposed | 8.5 | level |
| 72 | THORChain | 5: Exposed | 8.5 | level |
| 73 | VeChain | 5: Exposed | 8.5 | level |
No post-quantum improvement proposal, roadmap, research programme or testnet implementation for Polygon PoS's signatures was found from Polygon Labs or in the Polygon governance process at the time of writing. source
No stated policy
Neither Polygon Labs nor the Polygon governance process has said anything about post-quantum migration, so nothing has been said about accounts that never move to post-quantum keys.
As of 22 October 2026. Published beside the score, not in it. Every chain's stance is compared on the commitments page.
Exposure measures how much of the chain's value already sits behind a public key that an attacker can record today and break later. This is the part of the threat that a future upgrade cannot undo.
Polygon PoS uses Ethereum's address model: an address is the last twenty bytes of the Keccak hash of the public key, so an account that has received POL but never sent a transaction has not published its key. The first signature publishes it permanently, and almost every account of consequence has signed. Because Polygon PoS accepts the same keys and addresses as Ethereum, a holder who has signed with the same key on Ethereum or any other EVM chain has a published key on Polygon too, even if the Polygon account has never sent a transaction. Validator signer keys are listed in Heimdall's validator set, and the checkpoints they sign are what the PoS bridge on Ethereum relies on, so a forged validator signature would threaten bridged funds as well as the chain. POL that sits on Ethereum as an ERC-20 is protected by Ethereum's signatures, not by Polygon PoS's, and its exposure belongs to Ethereum's profile.
What this rating means for you
Polygon runs quantum-vulnerable signatures with no published post-quantum plan that we could find. Nothing here is urgent today, and there is also nothing scheduled to change it.
Editorial guidance from the Hardy Index.
We will email you the day this rating moves, with the changelog note that explains why. Nothing else, and nothing in between.
No. Polygon PoS accounts sign with ECDSA on secp256k1, Bor block producers seal blocks with secp256k1, and Heimdall validators use secp256k1 consensus keys. A sufficiently large quantum computer would break all of them, and no post-quantum plan for the chain has been published.
No. PIP-27 added verification of secp256r1 signatures so smart accounts can use passkeys, which helps usability, but secp256r1 is an elliptic curve and Shor's algorithm breaks it just as it breaks secp256k1. It does show that Polygon can add a signature primitive through a PIP and a hard fork, which is the route a post-quantum scheme would also need.
For almost all POL in use, yes. A Polygon address is a hash of the key and hides it until the account signs, but active accounts have signed, and a key that has signed on Ethereum or any other EVM chain is equally visible for the same address on Polygon. Those keys can be recorded now and attacked later.
Because the checkpoints record Polygon's state on Ethereum without validating it. Polygon PoS has its own validators and consensus, and those are the signatures scored here. Validator stake is held in Ethereum contracts and POL also exists as an ERC-20 on Ethereum, and the profile's caveat sets out how those features bear on the rating.
A Polygon Improvement Proposal or a public research programme on post-quantum signatures for the chain's accounts or validators would meet the Tier 4 floor. A plan from Polygon Labs or an adopted PIP naming the scheme to be used would meet Tier 3.
A rating is only true as of the day an editor last reviewed it, so both forms below carry that date and the methodology version, with the date its cited sources were last checked. If you are quoting the score, quote those too.
The Hardy Index (2026). Polygon PoS: quantum readiness assessment. Hardy Score 8.5 of 100, Tier 5: Exposed. Methodology v1.8. Last reviewed 22 October 2026; sources checked 13 November 2026. https://hardyindex.com/chains/polygon-pos
@misc{hardyindex_polygon_pos_2026,
author = {{The Hardy Index}},
title = {Polygon PoS: quantum readiness assessment},
year = {2026},
howpublished = {\url{https://hardyindex.com/chains/polygon-pos}},
note = {Hardy Score 8.5 of 100, Tier 5: Exposed. Methodology v1.8},
urldate = {2026-11-13}
} The whole dataset is reusable under the terms on the about page. A machine-readable version of this page is at /chains/polygon-pos.md.
This is a security-readiness assessment, not investment advice.