Chain profile
Post-quantum signatures have been mandatory for every account since the mainnet launched in June 2018, and no elliptic-curve alternative has ever existed on the network.
Yes. The Quantum Resistant Ledger is post-quantum secure at mainnet today. Every QRL account is protected by XMSS, a hash-based signature scheme that is not broken by Shor's algorithm and that NIST approved for use in SP 800-208. There is no quantum-vulnerable elliptic-curve fallback on the network, and there never has been: QRL launched with XMSS in June 2018 rather than retrofitting it later. The trade-offs are real and worth stating plainly: XMSS is a stateful scheme, so reusing a one-time signature key can expose funds and users depend on wallet software to manage that state correctly, and QRL is a very small network by liquidity, developer activity and validator count compared with the chains below it in this index. QRL scores highest here because the index measures quantum readiness, not size, adoption or investment merit.
Where we are making a judgement call QRL ranks first on quantum readiness and nothing else. It is a small network by liquidity, ecosystem and developer activity, and this index does not measure those things. A high Hardy Score is not a statement that a chain is a good asset, a good platform or a good investment.
XMSS (stateful hash-based), mandatory for all accounts
XMSS today; ML-DSA-87 in QRL 2.0 (Project Zond), with SPHINCS+ signalled post-mainnet
NIST SP 800-208 (XMSS) today; FIPS 204 (ML-DSA) in QRL 2.0
Tier 1: Native. Post-quantum secure at mainnet today, with quantum-resistant signatures built in from genesis.
| No. | Dimension | Score | Weight | Contribution |
|---|---|---|---|---|
| 1 | Signature scheme | 10 | 30% | 30.0 |
| 2 | Deployment stage | 10 | 25% | 25.0 |
| 3 | NIST alignment | 9 | 15% | 13.5 |
| 4 | Migration path | 7 | 15% | 10.5 |
| 5 | Exposure | 9 | 10% | 9.0 |
| 6 | Verification | 8 | 5% | 4.0 |
| Hardy Score | 92.0 | |||
Band 10: A post-quantum signature is the mandatory scheme for all accounts on mainnet.
XMSS is the mandatory signature scheme for all accounts on the QRL mainnet that launched in June 2018. There is no elliptic-curve alternative on the network, so no account can opt back into a quantum-vulnerable scheme. source
Band 10: Tier 1: Native.
Tier 1: Native. Post-quantum signatures have protected every unit of supply since genesis, so nothing needs to be migrated to reach quantum safety. source
Band 9 to 10: The scheme in use is covered by a final NIST standard (FIPS 204, FIPS 205, or SP 800-208).
XMSS is approved by NIST in SP 800-208, which supplements FIPS 186 to permit XMSS and LMS. It is a full approval rather than a candidate status, but NIST restricts stateful schemes to controlled applications. QRL 2.0 moves to ML-DSA-87 under FIPS 204. source
Placement in the band Not a 10: SP 800-208 is a full approval rather than candidate status, but NIST restricts stateful hash-based schemes to controlled applications, and a public blockchain is not the controlled setting that approval contemplates.
Band 6 to 8: A credible published plan exists with a mechanism identified, but key parts are unbuilt or undated.
QRL holders have no quantum migration to make, because their keys were never elliptic-curve. The deduction is for the separate QRL 1 to QRL 2.0 chain migration, which remains ahead of the network: Zond has been on testnet since 2024 and its mainnet date is contingent on audit completion. source
Placement in the band A 7 rather than an 8: holders have no quantum migration to make at all, but the QRL 1 to QRL 2.0 chain migration is still ahead of the network, with Zond on testnet since 2024 and its mainnet date contingent on audit completion.
Band 9 to 10: No quantum-vulnerable public keys are exposed on-chain, or the exposed keys protect nothing.
No QRL public key is a quantum liability, because XMSS security does not rest on the discrete logarithm problem. source
Placement in the band Not a 10: signing twice from the same one-time key leaks private key material, so exposure here is a wallet-state problem rather than a cryptographic one, and the dimension cannot be called perfectly clean.
Band 6 to 8: Open source with public review or a named third-party audit of the relevant component.
QRL is open source and has run XMSS in production on a public mainnet for over eight years, which is the strongest form of verification available: the claim is checkable on-chain. QRL 2.0 is undergoing external audits that had not concluded at the time of writing. source
Placement in the band The top of the band: eight years of XMSS running on a public mainnet is the strongest available form of public review, and the claim is checkable on-chain. It stops short of 9 because QRL 2.0's external audits had not concluded at the time of writing.
The deployment dimension is not a separate judgement. It is Tier 1 expressed as a number. See the tier mapping.
The 9 chains QRL sits among, out of 31 rated. The last column is the gap in Hardy points from QRL.
| Rank | Chain | Tier | Hardy | vs QRL |
|---|---|---|---|---|
| 1 | Quantum Resistant Ledger this chain | 1: Native | 92.0 | |
| 2 | Mochimo | 1: Native | 90.0 | -2.0 |
| 3 | Abelian | 1: Native | 84.5 | -7.5 |
| 4 | NEAR Protocol | 2: Shipping | 81.5 | -10.5 |
| 5 | Algorand | 2: Shipping | 77.5 | -14.5 |
| 6 | Nervos CKB | 2: Shipping | 75.5 | -16.5 |
| 7 | Bitcoin Cash | 2: Shipping | 66.0 | -26.0 |
| 8 | Solana | 2: Shipping | 54.5 | -37.5 |
| 9 | XRP Ledger | 3: Committed | 46.5 | -45.5 |
QRL mainnet launches with XMSS as the mandatory signature scheme for every account. source
QRL 2.0 (Project Zond) beta-testnet launches, moving the chain toward proof of stake and ML-DSA. source
Zond Testnet V1 goes live. source
Zond Testnet V2 launches as the audit-ready public testnet, using NIST-standardised ML-DSA-87. source
QRL 2.0 mainnet launch, explicitly contingent on audit outcomes and network stability rather than a fixed date. source
Exposure measures how much of the chain's value already sits behind a public key that an attacker can record today and break later. This is the part of the threat that a future upgrade cannot undo.
QRL has no harvest-now-decrypt-later exposure in the usual sense. Because XMSS security rests on hash function preimage resistance rather than the discrete logarithm problem, an attacker who records every QRL public key today gains nothing from a future quantum computer. The residual risk is operational: XMSS is stateful and each one-time signature key must be used exactly once, so a wallet that loses or mismanages its signing state can expose a key through reuse rather than through cryptanalysis.
What this rating means for you
QRL already runs post-quantum signatures for every account on mainnet, so there is no migration for you to make here. The habits that still matter are address hygiene and keeping your own keys.
Editorial guidance from the Hardy Index. Nothing on this profile is sponsored and nothing on it is an affiliate link. The guides carry disclosed affiliate links, which never affect a rating. How we make money.
From the newsroom
We will email you the day this rating moves, with the changelog note that explains why. Nothing else, and nothing in between.
Yes, on the measure this index uses. QRL's mainnet has required XMSS hash-based signatures for every account since June 2018, and XMSS is not broken by Shor's algorithm. QRL and Mochimo are the two chains in this index scoring 10 on the signature dimension, the band reserved for a post-quantum scheme that is mandatory for every account on mainnet, so neither has a quantum-vulnerable signature scheme available at all.
XMSS is the eXtended Merkle Signature Scheme, a hash-based signature system specified in RFC 8391 and approved by NIST in SP 800-208. Its security rests on the difficulty of finding hash preimages rather than on the elliptic-curve discrete logarithm problem, and Shor's algorithm only breaks the latter. Grover's algorithm weakens hash functions, but only quadratically, which the parameter sets already account for.
XMSS is stateful. Each signing key may be used exactly once, and the wallet must reliably track which keys have been consumed. If the same one-time key signs twice, an attacker can recover private key material without any quantum computer at all. NIST flags this in SP 800-208, which is why it restricts stateful hash-based schemes to applications where key use can be carefully controlled.
No. QRL 2.0, also called Project Zond, is on a public testnet. Testnet V2 launched in Q1 2026 as the audit-ready release, using NIST-standardised ML-DSA-87. QRL has not published a fixed mainnet date and states that launch depends on audit outcomes and network stability. The original XMSS mainnet continues to run.
No. The Hardy Score measures quantum readiness only. It says nothing about liquidity, adoption, developer activity, security outside the quantum question, or price. QRL scores highest in this index because it deployed post-quantum signatures first and made them mandatory, which is exactly the one thing this benchmark measures.
A rating is only true as of the day it was reviewed, so both forms below carry the review date and the methodology version. If you are quoting the score, quote those too.
The Hardy Index (2026). Quantum Resistant Ledger: quantum readiness assessment. Hardy Score 92.0 of 100, Tier 1: Native. Methodology v1.4. Reviewed 2 October 2026. https://hardyindex.com/chains/qrl
@misc{hardyindex_qrl_2026,
author = {{The Hardy Index}},
title = {Quantum Resistant Ledger: quantum readiness assessment},
year = {2026},
howpublished = {\url{https://hardyindex.com/chains/qrl}},
note = {Hardy Score 92.0 of 100, Tier 1: Native. Methodology v1.4},
urldate = {2026-10-02}
} The whole dataset is reusable under the terms on the about page. A machine-readable version of this page is at /chains/qrl.md.
This is a security-readiness assessment, not investment advice.