--- title: Is Polygon PoS quantum-safe? chain: Polygon PoS ticker: POL hardy_score: 8.5 rank: 69 of 80 tier: "5: Exposed" url: "https://hardyindex.com/chains/polygon-pos" updated: 2026-10-22 reviewed: 2026-11-13 methodology_version: 1.8 --- # Is Polygon PoS quantum-safe? **Hardy Score 8.5 / 100. Rank 69 of 80. Tier 5: Exposed. Last editorial review 22 October 2026; sources checked 13 November 2026.** No. Polygon PoS accounts sign transactions with ECDSA on the secp256k1 curve through Bor, its fork of go-ethereum, and the same curve secures the rest of the chain: Bor block producers seal each block with a secp256k1 signature, and the Heimdall validator layer accepts only secp256k1 consensus keys, read directly from the live network's consensus parameters. Validators also sign the checkpoints that Polygon PoS posts to Ethereum. A sufficiently large quantum computer running Shor's algorithm would break every one of these signatures. We found no post-quantum position from Polygon Labs or the Polygon governance process: none of the Polygon Improvement Proposals mentions post-quantum signatures, and no blog post, forum proposal or roadmap addresses them. The one new signature scheme Polygon has added, a P-256 verification precompile for passkey wallets, is another elliptic curve and is no more quantum-resistant than secp256k1. > This is a security-readiness assessment, not investment advice. ## Summary Accounts, block producers and the Heimdall validator set all sign with ECDSA on secp256k1, and no post-quantum proposal, plan or research programme for Polygon PoS's signatures could be found. ## Where we are making a judgement call One judgement call concerns scope rather than score. Polygon PoS is rated as a layer 1 because it has its own validator set, its own consensus in Heimdall and Bor, and its own state, which the checkpoints it posts to Ethereum record but do not validate. Two features cut the other way, and a reader should weigh them. Validators stake POL in contracts on Ethereum, so the validator set itself is managed through Ethereum, and POL is also an ERC-20 token on Ethereum, where it is protected by Ethereum's signatures rather than Polygon's. A reader who treats Polygon PoS as a network secured partly by Ethereum would leave it out of the index rather than score it differently: every signature this profile scores is Polygon's own, and each is classical. The tier itself is not a judgement call: nothing post-quantum on the chain's signatures was found from Polygon Labs, in the PIPs repository or on the Polygon forum, so no reading of the record lifts Polygon PoS to Tier 4. ## Score breakdown | # | Dimension | Score | Weight | Contribution | |---:|---|---:|---:|---:| | 1 | Signature scheme | 0/10 | 30% | 0.0 | | 2 | Deployment stage | 1/10 | 25% | 2.5 | | 3 | NIST alignment | 0/10 | 15% | 0.0 | | 4 | Migration path | 2/10 | 15% | 3.0 | | 5 | Exposure | 2/10 | 10% | 2.0 | | 6 | Verification | 2/10 | 5% | 1.0 | | | **Hardy Score** | | | **8.5** | ### 1. Signature scheme: 0/10 Anchor band 0: Classical signatures only on mainnet, with nothing post-quantum protecting live funds. Short-lived devnets and one-off benchmarks sit here: they demonstrate research rather than something a user can hold keys on. Bor recovers every transaction sender with ECDSA on secp256k1, and Heimdall's consensus parameters on mainnet accept secp256k1 validator keys and nothing else. The P-256 precompile added under PIP-27 verifies another elliptic curve. Nothing post-quantum protects POL or any asset on Polygon PoS. Source: https://github.com/0xPolygon/bor/blob/develop/core/types/transaction_signing.go ### 2. Deployment stage: 1/10 Anchor band 1: Tier 5: Exposed. Tier 5: Exposed. The signatures protecting funds and finalising blocks are quantum-vulnerable, and no Polygon Improvement Proposal, Polygon Labs publication, forum proposal or research programme on post-quantum signatures for Polygon PoS was found. Source: https://github.com/0xPolygon/Polygon-Improvement-Proposals ### 3. NIST alignment: 0/10 Anchor band 0 to 2: No post-quantum scheme named for the chain’s fund-protecting signatures, or a proprietary scheme with no public cryptanalysis. No post-quantum scheme has been named for Polygon PoS's account, block-producer or validator signatures, so there is nothing to assess against a NIST standard. Placement in the band: The floor of the band rather than a 1 or a 2: no scheme has been named at all, even as an example, by anyone with authority over the chain, so there is no choice to align with a standard. Source: https://github.com/0xPolygon/Polygon-Improvement-Proposals ### 4. Migration path: 2/10 Anchor band 0 to 2: No agreed migration path, or the proposals on the table would strand or freeze holder funds. No migration plan or published position exists. Polygon does have a working route for changing signature verification: PIP-27, a Final core proposal, added a secp256r1 precompile that shipped in the Napoli hard fork under PIP-33, and PIP-31, shipped in the same fork, brought Ethereum's Cancun EVM changes to Bor, which follows go-ethereum by merging upstream changes. Nothing has been proposed to put a post-quantum scheme through that process, and nothing addresses accounts whose keys are already public. Placement in the band: The top of the band rather than a 0 or a 1: the PIP process has already carried a new signature-verification primitive to mainnet through a hard fork, and Bor's practice of adopting Ethereum's EVM changes gives Polygon a path to reuse Ethereum's work. Not a 3, because Polygon has not acknowledged the quantum problem in public, let alone described a route for holders. Source: https://github.com/0xPolygon/Polygon-Improvement-Proposals/blob/main/PIPs/PIP-33.md ### 5. Exposure: 2/10 Anchor band 0 to 2: Public keys are exposed for effectively all accounts, or a large, measured share of total supply sits in exposed addresses. Polygon PoS keeps Ethereum's account model: an address is a hash of the public key, so an account that has never signed keeps its key private. Every account that has sent a transaction has published its key, and because Polygon accepts the same keys and addresses as Ethereum, a key published on any EVM chain exposes the same address here. Validator signer keys are public in Heimdall's validator set by design. Placement in the band: The top of the band rather than a 1: never-signed addresses keep their keys hidden. Not a 3, because almost all economically active POL sits behind a key that has signed, here or on another EVM chain, and no measurement of the unexposed share has been published. Source: https://github.com/0xPolygon/bor/blob/develop/core/types/transaction_signing.go ### 6. Verification: 2/10 Anchor band 0 to 2: No post-quantum component exists, or the claims rest on marketing. No post-quantum component exists for Polygon PoS: no code, specification or testnet implementation was found in Bor, Heimdall or the PIPs repository. Bor and Heimdall are open source, but under v1.8 the openness of classical code earns nothing on this dimension. Placement in the band: The top of the band rather than a 0 or a 1: there is nothing post-quantum to verify, but nothing about Polygon PoS is marketed as quantum-safe, so its position does not rest on marketing. Source: https://github.com/0xPolygon/bor ## Nearest chains in the ranking The chains Polygon sits among, out of 80 rated. The last column is the gap in Hardy points from Polygon. | Rank | Chain | Tier | Hardy | vs POL | |---:|---|---|---:|---:| | 65 | [KCC (KuCoin Community Chain)](https://hardyindex.com/chains/kcc) | 5: Exposed | 8.5 | level | | 66 | [Kite](https://hardyindex.com/chains/kite) | 5: Exposed | 8.5 | level | | 67 | [Mina Protocol](https://hardyindex.com/chains/mina) | 5: Exposed | 8.5 | level | | 68 | [MultiversX](https://hardyindex.com/chains/multiversx) | 5: Exposed | 8.5 | level | | 69 | **Polygon PoS** | 5: Exposed | 8.5 | this chain | | 70 | [Provenance Blockchain](https://hardyindex.com/chains/provenance) | 5: Exposed | 8.5 | level | | 71 | [Theta Network](https://hardyindex.com/chains/theta) | 5: Exposed | 8.5 | level | | 72 | [THORChain](https://hardyindex.com/chains/thorchain) | 5: Exposed | 8.5 | level | | 73 | [VeChain](https://hardyindex.com/chains/vechain) | 5: Exposed | 8.5 | level | ## Signature scheme - **On mainnet today:** ECDSA on secp256k1 for accounts, Bor block seals, Heimdall validator consensus and checkpoint signatures; P-256 verification available to contracts - **Post-quantum scheme:** None. No post-quantum scheme has been proposed, selected or tested for Polygon PoS. - **NIST standard:** None adopted. - **Readiness tier:** Tier 5: Exposed. The signatures securing funds on mainnet today are quantum-vulnerable, and no public post-quantum plan, proposal or research programme addressing them could be found. ## Cryptography in use - **Account signatures:** [ECDSA on secp256k1](https://hardyindex.com/algorithms/ecdsa-secp256k1.md). Mainnet, default. Sender recovery through crypto.Ecrecover in Bor, the go-ethereum fork that executes Polygon PoS transactions. Source (source code or release): https://github.com/0xPolygon/bor/blob/develop/core/types/transaction_signing.go - **Validator consensus:** [ECDSA on secp256k1](https://hardyindex.com/algorithms/ecdsa-secp256k1.md). Mainnet, mandatory. Heimdall mainnet consensus parameters list secp256k1 as the only validator key type. Validators sign the checkpoints posted to Ethereum with the same keys. Source (read on-chain): https://heimdall-api.polygon.technology/cosmos/consensus/v1/params - **Validator consensus:** [ECDSA on secp256k1](https://hardyindex.com/algorithms/ecdsa-secp256k1.md). Mainnet, mandatory. Bor block producers seal each block header with a secp256k1 signature, recovered with crypto.Ecrecover. Source (source code or release): https://github.com/0xPolygon/bor/blob/develop/consensus/bor/bor.go - **Contract level:** [ECDSA on secp256r1](https://hardyindex.com/algorithms/ecdsa-secp256r1.md). Mainnet, opt-in. P-256 verification precompile following RIP-7212, used by smart accounts for passkeys. Final, shipped in the Napoli hard fork. Source (specification or proposal): https://github.com/0xPolygon/Polygon-Improvement-Proposals/blob/main/PIPs/PIP-27.md A role not listed here is not evidenced either way. See https://hardyindex.com/algorithms.md. ## Roadmap - **No published position** (proposed): No post-quantum improvement proposal, roadmap, research programme or testnet implementation for Polygon PoS's signatures was found from Polygon Labs or in the Polygon governance process at the time of writing. Source: https://github.com/0xPolygon/Polygon-Improvement-Proposals ## If holders never migrate **No stated policy.** Neither Polygon Labs nor the Polygon governance process has said anything about post-quantum migration, so nothing has been said about accounts that never move to post-quantum keys. As of 22 October 2026. ## Exposure Polygon PoS uses Ethereum's address model: an address is the last twenty bytes of the Keccak hash of the public key, so an account that has received POL but never sent a transaction has not published its key. The first signature publishes it permanently, and almost every account of consequence has signed. Because Polygon PoS accepts the same keys and addresses as Ethereum, a holder who has signed with the same key on Ethereum or any other EVM chain has a published key on Polygon too, even if the Polygon account has never sent a transaction. Validator signer keys are listed in Heimdall's validator set, and the checkpoints they sign are what the PoS bridge on Ethereum relies on, so a forged validator signature would threaten bridged funds as well as the chain. POL that sits on Ethereum as an ERC-20 is protected by Ethereum's signatures, not by Polygon PoS's, and its exposure belongs to Ethereum's profile. ## Frequently asked questions ### Is Polygon PoS quantum-safe? No. Polygon PoS accounts sign transactions with ECDSA on the secp256k1 curve through Bor, its fork of go-ethereum, and the same curve secures the rest of the chain: Bor block producers seal each block with a secp256k1 signature, and the Heimdall validator layer accepts only secp256k1 consensus keys, read directly from the live network's consensus parameters. Validators also sign the checkpoints that Polygon PoS posts to Ethereum. A sufficiently large quantum computer running Shor's algorithm would break every one of these signatures. We found no post-quantum position from Polygon Labs or the Polygon governance process: none of the Polygon Improvement Proposals mentions post-quantum signatures, and no blog post, forum proposal or roadmap addresses them. The one new signature scheme Polygon has added, a P-256 verification precompile for passkey wallets, is another elliptic curve and is no more quantum-resistant than secp256k1. ### Is Polygon PoS quantum-safe? No. Polygon PoS accounts sign with ECDSA on secp256k1, Bor block producers seal blocks with secp256k1, and Heimdall validators use secp256k1 consensus keys. A sufficiently large quantum computer would break all of them, and no post-quantum plan for the chain has been published. ### Does Polygon's P-256 passkey precompile help against quantum computers? No. PIP-27 added verification of secp256r1 signatures so smart accounts can use passkeys, which helps usability, but secp256r1 is an elliptic curve and Shor's algorithm breaks it just as it breaks secp256k1. It does show that Polygon can add a signature primitive through a PIP and a hard fork, which is the route a post-quantum scheme would also need. ### Are POL holders' public keys already exposed? For almost all POL in use, yes. A Polygon address is a hash of the key and hides it until the account signs, but active accounts have signed, and a key that has signed on Ethereum or any other EVM chain is equally visible for the same address on Polygon. Those keys can be recorded now and attacked later. ### Why is Polygon PoS rated as a layer 1 when it checkpoints to Ethereum? Because the checkpoints record Polygon's state on Ethereum without validating it. Polygon PoS has its own validators and consensus, and those are the signatures scored here. Validator stake is held in Ethereum contracts and POL also exists as an ERC-20 on Ethereum, and the profile's caveat sets out how those features bear on the rating. ### What would move Polygon PoS up the index? A Polygon Improvement Proposal or a public research programme on post-quantum signatures for the chain's accounts or validators would meet the Tier 4 floor. A plan from Polygon Labs or an adopted PIP naming the scheme to be used would meet Tier 3. ## What this rating means if you hold Polygon Plain-language guidance from the same publication, with no product recommendation attached. - [Is my crypto safe from quantum computers?](https://hardyindex.com/guides/is-my-crypto-safe-from-quantum-computers.md) - [How to protect your crypto from quantum computers](https://hardyindex.com/guides/how-to-protect-crypto-from-quantum-computers.md) - [All guides](https://hardyindex.com/guides.md) ## Sources 1. [Bor transaction signing (core/types/transaction_signing.go)](https://github.com/0xPolygon/bor/blob/develop/core/types/transaction_signing.go): Polygon (GitHub) (primary, checked 22 October 2026) 2. [Bor block seal recovery (consensus/bor/bor.go)](https://github.com/0xPolygon/bor/blob/develop/consensus/bor/bor.go): Polygon (GitHub) (primary, checked 22 October 2026) 3. [Bor node client](https://github.com/0xPolygon/bor): Polygon (GitHub) (primary, checked 22 October 2026) 4. [Heimdall mainnet consensus parameters](https://heimdall-api.polygon.technology/cosmos/consensus/v1/params): Polygon (Heimdall API) (primary, checked 22 October 2026) 5. [Heimdall-v2 staking message server (x/stake/keeper/msg_server.go)](https://github.com/0xPolygon/heimdall-v2/blob/develop/x/stake/keeper/msg_server.go): Polygon (GitHub) (primary, checked 22 October 2026) 6. [Polygon Improvement Proposals](https://github.com/0xPolygon/Polygon-Improvement-Proposals): Polygon (GitHub) (primary, checked 22 October 2026) 7. [Polygon Community Forum](https://forum.polygon.technology/): Polygon (primary, checked 22 October 2026) 8. [PIP-27: Precompiled for secp256r1 Curve Support](https://github.com/0xPolygon/Polygon-Improvement-Proposals/blob/main/PIPs/PIP-27.md): Polygon (GitHub) (primary, checked 22 October 2026) 9. [PIP-33: Napoli hard fork](https://github.com/0xPolygon/Polygon-Improvement-Proposals/blob/main/PIPs/PIP-33.md): Polygon (GitHub) (primary, checked 22 October 2026) 10. [PIP-31: Cancun EIPs](https://github.com/0xPolygon/Polygon-Improvement-Proposals/blob/main/PIPs/PIP-31.md): Polygon (GitHub) (primary, checked 22 October 2026) 11. [PIP-17: Polygon Ecosystem Token (POL)](https://github.com/0xPolygon/Polygon-Improvement-Proposals/blob/main/PIPs/PIP-17.md): Polygon (GitHub) (primary, checked 22 October 2026) 12. [Architecture overview](https://docs.polygon.technology/pos/architecture/overview): Polygon documentation (primary, checked 22 October 2026) 13. [Checkpoints (Heimdall-v2)](https://docs.polygon.technology/pos/architecture/heimdall_v2/checkpoints): Polygon documentation (primary, checked 22 October 2026) 14. [POL](https://docs.polygon.technology/pos/concepts/tokens/pol): Polygon documentation (primary, checked 22 October 2026) 15. [Polygon Ecosystem Token contracts](https://github.com/0xPolygon/pol-token): Polygon (GitHub) (primary, checked 22 October 2026) 16. [FIPS 204: Module-Lattice-Based Digital Signature Standard (ML-DSA)](https://csrc.nist.gov/pubs/fips/204/final): NIST (primary, checked 22 October 2026) ## How to cite this rating A rating is only true as of the day it was reviewed, so both forms carry the review date and the methodology version. If you are quoting the score, quote those too. The Hardy Index (2026). Polygon PoS: quantum readiness assessment. Hardy Score 8.5 of 100, Tier 5: Exposed. Methodology v1.8. Last reviewed 22 October 2026; sources checked 13 November 2026. https://hardyindex.com/chains/polygon-pos ```bibtex @misc{hardyindex_polygon_pos_2026, author = {{The Hardy Index}}, title = {Polygon PoS: quantum readiness assessment}, year = {2026}, howpublished = {\url{https://hardyindex.com/chains/polygon-pos}}, note = {Hardy Score 8.5 of 100, Tier 5: Exposed. Methodology v1.8}, urldate = {2026-11-13} } ``` --- Methodology: https://hardyindex.com/methodology (v1.8). Cite as: The Hardy Index, "Polygon PoS", https://hardyindex.com/chains/polygon-pos, as of 13 November 2026.