Hardy Index Quantum readiness, rated and tracked

Chain profile

VeChain

VET Exposed

Signs transactions, fee-delegation co-signatures and block headers with ECDSA on secp256k1, and no post-quantum proposal, roadmap or research programme from VeChain was found.

Is VeChain quantum-safe?

No. VeChainThor transactions are signed with ECDSA on the secp256k1 curve, through go-ethereum's signature recovery, and the address is derived from the recovered public key as on Ethereum. A transaction that uses fee delegation under VIP-191 carries a second secp256k1 signature from the gas payer. Block producers sign every block header with their secp256k1 key, and the same key produces the ECVRF proof that VIP-214 uses for the random beacon. A sufficiently large quantum computer running Shor's algorithm would break all of these. We searched VeChain's improvement proposals, the thor node repository, VeChain's 2026 roadmap and its official blog, and found no post-quantum proposal, named scheme, research programme or test implementation. Some third-party articles describe VeChain as having a quantum-resistant signature algorithm; none cites a VeChain source, and nothing in VeChain's own code or publications supports them.

Where we are making a judgement call Two judgement calls carry this profile. The first is migration, scored 2 on the strength of VeChain's upgrade record: nine named protocol upgrades on mainnet, including the start of a change of consensus, and a signature field that VIP-191 already widened to carry two signatures. A reader who credits only work aimed at the quantum problem would score migration 0, lowering the Hardy Score by 3 points. The second is verification. Third-party articles, including one from August 2023, describe a quantum-resistant VeChain signature algorithm without naming a scheme or citing any VeChain source, and we found nothing in VeChain's code, improvement proposals or publications to support them. We do not treat those articles as VeChain's own marketing, so verification stays at 2. A reader who held the circulating claim against the chain would score it 0, lowering the Hardy Score by 1 point. Tier 5 itself is not a close call: we found no post-quantum item of any kind from VeChain. That is a finding about what VeChain has published, not a claim that no internal work exists, and a primary source is the fastest way to move this row.

At a glance

On mainnet today

ECDSA on secp256k1 for transactions and VIP-191 gas-payer co-signatures; secp256k1 block-header signatures with an ECVRF proof for the VIP-214 random beacon

Post-quantum scheme

None selected. No post-quantum scheme was found in VeChain's improvement proposals, code or publications.

NIST standard

None adopted

Readiness tier

Tier 5: Exposed. The signatures securing funds on mainnet today are quantum-vulnerable, and no public post-quantum plan, proposal or research programme addressing them could be found.

Cryptography in use

  • Account signatures ECDSA on secp256k1 Mainnet, mandatory Origin recovered with go-ethereum crypto.SigToPub; a delegated transaction carries a second 65-byte signature from the gas payer (VIP-191). Source code or release
  • Validator consensus ECDSA on secp256k1 Mainnet, mandatory The block signer is recovered from the header signature with crypto.SigToPub. Source code or release
  • Randomness ECVRF secp256k1, SHA-256 Mainnet, mandatory VIP-214 random beacon; the proof sits in the header's signature field and is verified against the block signer's key. Source code or release

A role not listed is not evidenced either way. Every scheme, and which other chains share it, is in the cryptography registry.

Score breakdown

Each dimension scored 0 to 10. The weight beside it is its share of the total score.
Signature scheme 0 30% Deployment stage 1 25% NIST alignment 0 15% Migration path 2 15% Exposure 2 10% Verification 2 5%
Show the weighted arithmetic and the sourced note for each dimension
No. Dimension Score Weight Contribution
1 Signature scheme 0 30% 0.0
2 Deployment stage 1 25% 2.5
3 NIST alignment 0 15% 0.0
4 Migration path 2 15% 3.0
5 Exposure 2 10% 2.0
6 Verification 2 5% 1.0
Hardy Score 8.5

1 Signature scheme 0/10, weighted 30%

Band 0: Classical signatures only on mainnet, with nothing post-quantum protecting live funds. Short-lived devnets and one-off benchmarks sit here: they demonstrate research rather than something a user can hold keys on.

The thor node recovers a transaction's origin with go-ethereum's crypto.SigToPub over a 65-byte secp256k1 signature, and a delegated transaction's gas payer from a second 65-byte secp256k1 signature. Nothing post-quantum protects VET, VTHO or any asset on VeChainThor today. source

2 Deployment stage 1/10, weighted 25%

Band 1: Tier 5: Exposed.

Tier 5: Exposed. The signatures securing VeChainThor are quantum-vulnerable, and no improvement proposal in the VIPs repository, roadmap item or research programme addresses them. The VIPs run from VIP-180 to VIP-255 and none concerns post-quantum signatures. source

3 NIST alignment 0/10, weighted 15%

Band 0 to 2: No post-quantum scheme named for the chain’s fund-protecting signatures, or a proprietary scheme with no public cryptanalysis.

No post-quantum scheme has been named for VeChainThor's transaction or block signatures in any VIP, roadmap or VeChain publication, so there is nothing to align with a NIST standard. source

Placement in the band The floor of the band rather than a 1 or a 2: no scheme has been named at all, and the third-party articles that describe a lattice-based VeChain algorithm name no scheme either and cite no VeChain source.

4 Migration path 2/10, weighted 15%

Band 0 to 2: No agreed migration path, or the proposals on the table would strand or freeze holder funds.

No migration plan exists. VeChainThor has activated nine named protocol upgrades on mainnet, from VIP-191 at block 3,337,300 to Interstellar at block 25,902,540, including Hayabusa, which begins the move from proof of authority to delegated proof of stake. source

Placement in the band A 2 rather than a 0 or a 1: the upgrade record shows VeChain can coordinate a change to consensus and to the transaction format, and VIP-191 already made the signature field carry more than one signature. It cannot reach a 3, because VeChain has not acknowledged the quantum problem in anything we found.

5 Exposure 2/10, weighted 10%

Band 0 to 2: Public keys are exposed for effectively all accounts, or a large, measured share of total supply sits in exposed addresses.

A VeChainThor address is go-ethereum's PubkeyToAddress of the signer's key, the Keccak hash used on Ethereum, so an account that has never signed keeps its key private. Every account that has sent a transaction or paid gas for one has published its key. source

Placement in the band The top of the band rather than a 0 or a 1: the hashed-address model protects never-signed accounts. Not a 3, because the active accounts that hold economically meaningful VET have signed, and no measured share of exposed supply has been published.

6 Verification 2/10, weighted 5%

Band 0 to 2: No post-quantum component exists, or the claims rest on marketing.

No post-quantum component exists for VeChainThor: no code, VIP or testnet implementation was found. The thor node is open source, but under v1.8 the openness of the classical code earns nothing here, because what this dimension verifies is the post-quantum component that protects funds. source

Placement in the band The top of the band rather than a 0 or a 1: there is nothing to verify, but VeChain itself does not market the chain as quantum-safe. The quantum-resistance claims in circulation come from third-party articles with no VeChain source, and they are not held against the chain.

The deployment dimension is not a separate judgement. It is Tier 5 expressed as a number. See the tier mapping.

How it compares

All 80 rated chains on the 0 to 100 scale. VeChain is marked. Select any point to open that profile.
VeChain 8.5

Nearest chains in the ranking

The 9 chains VeChain sits among, out of 80 rated. The last column is the gap in Hardy points from VeChain.

Rank Chain Tier Hardy vs VET
69 Polygon PoS 5: Exposed 8.5 level
70 Provenance Blockchain 5: Exposed 8.5 level
71 Theta Network 5: Exposed 8.5 level
72 THORChain 5: Exposed 8.5 level
73 VeChain this chain 5: Exposed 8.5
74 WEMIX 5: Exposed 8.5 level
75 Whitechain 5: Exposed 8.5 level
76 Beldex 5: Exposed 7.5 -1.0
77 Ozone Chain 5: Exposed 7.5 -1.0

Roadmap

  1. 16 February 2019 shipped

    VIP-191, Designated Gas Payer, is created. It extends the transaction signature field to carry a second secp256k1 signature from a gas payer, and is now Final and active on mainnet. source

  2. 20 October 2021 shipped

    VIP-214 introduces a per-epoch random beacon built on an ECVRF over secp256k1, produced with the block signer's key. It is Final and active on mainnet. source

  3. No date published proposed

    No post-quantum improvement proposal, scheme selection, research programme, implementation or timeline for VeChainThor was found. source

If holders never migrate

No stated policy

VeChain has published no post-quantum migration plan, and so no policy on accounts that never move to post-quantum keys.

As of 22 October 2026. source Published beside the score, not in it. Every chain's stance is compared on the commitments page.

Exposure

Exposure measures how much of the chain's value already sits behind a public key that an attacker can record today and break later. This is the part of the threat that a future upgrade cannot undo.

VeChainThor follows Ethereum's address model: an address is derived from the Keccak hash of the public key, and the key is recovered from each signature, so an account that has received VET but never signed has not revealed its key. The protection ends at the account's first signature, and it also ends for a gas payer the moment it co-signs a delegated transaction, because fee delegation under VIP-191 is built into the protocol. How often it is used has not been measured. Accounts in active use have signed, so economically meaningful VET sits behind keys that can be collected today against a future quantum computer. Because VeChainThor uses the same key and address format as Ethereum, a key reused from an EVM chain where it has already signed is exposed on VeChainThor too. No measurement of the exposed share has been published, and VeChainThor has its own genesis, so no inherited measurement applies.

What this rating means for you

If you hold VeChain

VeChain runs quantum-vulnerable signatures with no published post-quantum plan that we could find. Nothing here is urgent today, and there is also nothing scheduled to change it.

Editorial guidance from the Hardy Index.

Embed this rating

Paste this anywhere to show VeChain's current rating. It renders live from the index, so it updates when the rating does, and the review date is written into the image. There is nothing to sign up for and nothing to pay. 

<a href="https://hardyindex.com/chains/vechain"><img src="https://hardyindex.com/badge/vechain.svg" width="260" height="76" alt="Quantum readiness rated by the Hardy Index"></a>

The image is /badge/vechain.svg. It is a plain SVG with no script and no tracking, it sets no cookie, and it records nothing about whoever loads it.

Questions

Is VeChain quantum-safe?

No. VeChainThor transactions, fee-delegation co-signatures and block headers are all signed with ECDSA on secp256k1, and the random beacon uses an ECVRF on the same curve. A sufficiently large quantum computer would break all of them, and VeChain has published no post-quantum proposal or plan.

Does VeChain have a quantum-proof signature algorithm?

Not that we could verify. Some third-party articles say VeChain has built a lattice-based, quantum-resistant signature algorithm, but they name no scheme, cite no VeChain source and link no code. VeChain's improvement proposals, its thor node code and its 2026 roadmap contain nothing post-quantum. If VeChain publishes such work, the primary source is what this profile needs.

Does fee delegation change VeChain's quantum exposure?

It adds a second key to the picture. Under VIP-191 a gas payer co-signs the transaction with its own secp256k1 key, which publishes that key just as sending a transaction does. Sponsor accounts that pay gas for many users have therefore revealed their keys, whatever their own transaction history.

What would move VeChain up the index?

A VIP or a public research programme from VeChain on post-quantum signatures for its own transactions and blocks would meet the Tier 4 floor. A plan from the VeChain Foundation naming the scheme it will adopt would meet Tier 3. Code on a persistent testnet would also lift the signature, NIST alignment and verification scores.

Sources

  1. VeChainThor node client VeChain (GitHub) · primary · checked 22 October 2026
  2. Transaction signing and recovery (tx/transaction.go) VeChain (GitHub) · primary · checked 22 October 2026
  3. Block header signer recovery (block/header.go) VeChain (GitHub) · primary · checked 22 October 2026
  4. ECVRF over secp256k1 (vrf/vrf.go) VeChain (GitHub) · primary · checked 22 October 2026
  5. Mainnet fork configuration (thor/fork_config.go) VeChain (GitHub) · primary · checked 22 October 2026
  6. VeChain Improvement Proposals VeChain (GitHub) · primary · checked 22 October 2026
  7. VIP-191: Designated Gas Payer VeChain (GitHub) · primary · checked 22 October 2026
  8. VIP-214: Per Epoch VRF-based Random Beacon Generation VeChain (GitHub) · primary · checked 22 October 2026
  9. VeChain Roadmap 2026: Agentic Foundations for Tomorrow and Beyond VeChain · primary · checked 22 October 2026
  10. Technical Examination of VeChain's Quantum-Proof Signature Algorithm Charlotte Stories · secondary · checked 22 October 2026
Cite this rating

A rating is only true as of the day an editor last reviewed it, so both forms below carry that date and the methodology version, with the date its cited sources were last checked. If you are quoting the score, quote those too.

Plain text

The Hardy Index (2026). VeChain: quantum readiness assessment. Hardy Score 8.5 of 100, Tier 5: Exposed. Methodology v1.8. Last reviewed 22 October 2026; sources checked 13 November 2026. https://hardyindex.com/chains/vechain

BibTeX 
@misc{hardyindex_vechain_2026,
  author       = {{The Hardy Index}},
  title        = {VeChain: quantum readiness assessment},
  year         = {2026},
  howpublished = {\url{https://hardyindex.com/chains/vechain}},
  note         = {Hardy Score 8.5 of 100, Tier 5: Exposed. Methodology v1.8},
  urldate      = {2026-11-13}
}

The whole dataset is reusable under the terms on the about page. A machine-readable version of this page is at /chains/vechain.md.

This is a security-readiness assessment, not investment advice.