Ethereum’s Post‑Quantum Push Could Supercharge Fees and Strain Network Capacity

Ethereum is moving post-quantum cryptography (PQC) from long-term research to immediate protocol planning. That shift carries a stark trade-off: today’s efficient signatures could be replaced by post-quantum schemes that are roughly 40 times larger, with direct consequences for gas fees, throughput, and consensus design.

The Ethereum Foundation (EF) has elevated PQC to a top strategic priority, forming a dedicated team led by Thomas Coratger and putting up $1 million in prizes to harden hash-based primitives. At the same time, a16z crypto has published a roadmap arguing that quantum threats to blockchains are frequently overstated and that moving too fast could introduce more risk than it removes.

Both positions anchor a rapidly emerging battleground: how to upgrade Ethereum’s cryptographic foundations without breaking its economics or user experience.

Why Ethereum Is Prioritizing Post‑Quantum Cryptography Now

EF’s new PQ initiative is framed as an inflection point rather than an emergency. Multi-client post-quantum consensus devnets are already live, and bi-weekly All Core Devs calls focused specifically on PQ migration are due to begin next month. The stated roadmap target is ambitious: “zero loss of funds and zero downtime” across what EF expects will be a multi-year transition.

Several ecosystem developments give this program more concrete footing than earlier PQ discussions:

• Dedicated governance and engineering cadence: EF is treating PQC as a protocol-wide program, not a side research track. Precompiles, account abstraction paths, and new signature primitives are being coordinated across clients.
• Cross-industry alignment: Coinbase launched an independent quantum advisory board on Jan. 21, which includes Ethereum researcher Justin Drake. That signals major custodians want a credible plan for long-horizon quantum risk, not just ad-hoc mitigations.
• Parallel experiments on other chains: Solana has been running PQ signature tests on testnet under Project Eleven, explicitly branding the work as “proactive.” Polkadot’s JAM proposal contemplates ML-DSA and Falcon signatures alongside SNARK-based migration proofs. Bitcoin’s BIP-360 proposal for pay-to-quantum-resistant-hash is a conservative first step constrained by its governance model.

This does not resemble a scramble to patch an imminent breach. The pattern is closer to an institutional arms race over readiness: which networks can upgrade their cryptography while preserving fee economics, consensus performance, and wallet UX, before external pressure forces rushed coordination?

From EF’s perspective, the urgency does not come from the arrival date of cryptographically relevant quantum computing (CRQC) but from the surface area that a signature migration touches: wallets, account formats, hardware signers, custody setups, mempools, fee markets, consensus messages, and L2 settlement proofs all need to evolve together. That implies years of lead time.

The Harvest Paradox: Real Risk vs. Overstated Quantum Hype

a16z crypto’s recent roadmap sharpens the debate by splitting quantum risk into two categories. Its core argument rests on the difference between harvest-now-decrypt-later (HNDL) attacks and signature forgery threats.

HNDL attacks apply to any system that stores encrypted data today which might be decrypted later once large-scale quantum computers exist. This directly affects TLS, VPNs, and data-at-rest encryption schemes where adversaries can stockpile ciphertext and wait for better tools.

Blockchains are different. Transaction signatures on Ethereum do not conceal encrypted payloads; they authenticate actions in real time. Once a transaction is confirmed, there is no encrypted blob to harvest and later decrypt. The relevant threat is future ability to forge signatures or break key assumptions, not retroactive mass decryption of on-chain data.

Ethereum’s current roadmap implicitly accepts this framing but reaches a different operational conclusion. Even if the HNDL-style urgency is low, Ethereum argues that:

• Changing signature schemes is invasive: it touches protocol internals and almost every user-facing component.
• Failure modes are catastrophic: a buggy migration could mean permanent fund loss or chain-wide liveness issues.
• Migration timelines are long: NIST, EU, and industry efforts provide standards, but integrating those safely at scale is a multi-year exercise.

Key external developments have reduced some uncertainty around which algorithms are likely candidates:

• NIST standards: In 2024, NIST finalized its first PQ standards (FIPS 203, 204, 205) and selected HQC as a backup key encapsulation mechanism, while advancing Falcon and FN-DSA toward draft stages.
• EU roadmap: The EU’s coordinated PQC transition roadmap published in June 2025 gives institutions a structured timetable and approach to migration.
• Risk estimates: Citi’s January 2026 report provides probabilistic ranges for when public-key cryptography might be broadly broken—around 2034 or 2044 in their modeled scenarios—while acknowledging that CRQC in the 2020s is widely seen as highly unlikely. Market data from Kalshi shows around half of respondents expecting the first useful quantum computer before 2035, with a majority expecting some arrival before 2030.

These inputs do not clarify exactly when the threat will materialize, but they do change the nature of planning. The lack of a precise quantum timeline arguably increases the need for crypto agility: waiting until signals are unambiguous risks compressing coordination into a rushed, high-stakes window.

a16z counters that rushing now carries its own systemic risks: immature cryptographic libraries, shifting standards post-deployment, and bugs in new implementations could all produce more near-term harm than the distant quantum threat they aim to avoid.

Signature Bloat: How 40x Larger Signatures Hit Fees and Throughput

The most immediate and measurable impact of PQ migration is signature size. Ethereum today relies primarily on ECDSA signatures over secp256k1 for accounts, with BLS signatures for consensus aggregation.

On Ethereum, ECDSA signatures consume roughly 65 bytes. Under the current calldata pricing (16 gas per non-zero byte), that’s about 1,040 gas per signature. This cost is significant but manageable within the existing fee and throughput assumptions of the protocol.

By contrast, leading post-quantum signature candidates in the ML-DSA family produce signatures in the multi-kilobyte range. Values cited in EF research highlight the scale of the jump:

• ML-DSA‑44: ~2,420 bytes → ~38,720 gas
• ML-DSA‑65: ~3,309 bytes → ~52,944 gas
• ML-DSA‑87: ~4,627 bytes → ~74,032 gas

Even at the low end, that implies a delta of roughly +37,680 gas per signature versus ECDSA purely from calldata footprint. In aggregate, that translates into:

• Higher per-transaction fees: Simple transfers and contract interactions would carry materially higher base costs, before accounting for any additional verification work.
• Reduced effective throughput: Block gas limits being constant, larger signatures mean fewer transactions per block, unless offset by compression or protocol-level changes.
• Increased L1 scaling pressure: For the largest ML-DSA variants, the gas costs become so heavy that aggregation mechanisms stop being optional and become mandatory.

Ethereum’s strategic answer is to lean into hash-based cryptography and zk-powered aggregation. Hash-based schemes naturally avoid the algebraic structure that quantum algorithms such as Shor’s exploit, and they integrate well with zero-knowledge systems. The EF’s $1 million Poseidon Prize is an explicit attempt to harden the hash functions underpinning this path.

The target vision is that if Ethereum can make STARK-based signature aggregation practical at the protocol layer, it can:

• Preserve fee economics close to current levels despite larger underlying signatures.
• Maintain consensus efficiency by compressing many signatures into succinct proofs.
• Anchor security in simpler, “lean” cryptographic assumptions.

The challenge is that today, there is no practical post-quantum analogue to BLS aggregation. zk-based aggregation works in principle but introduces non-trivial proving and verification overhead. Ethereum’s consensus layer currently relies heavily on BLS aggregation to combine thousands of validator signatures into compact proofs for attestations and sync committees. Losing that without an alternative would force fundamental changes to validator participation economics or to liveness guarantees.

EF’s emphasis on “lean” cryptographic foundations and coordinated PQ devnets indicates a clear internal view: aggregation is the hidden cliff. Signature bloat is not only a gas price problem; it is a potential restructuring of how consensus and fee markets function.

Wallet UX and Account Migration: The Human Bottleneck

Even if Ethereum ships a robust PQ signature scheme and efficient aggregation, the protocol layer alone cannot complete the transition. The true complexity lies in how millions of users, wallets, and custodians migrate live keys and accounts.

Under Ethereum’s current model, externally owned accounts (EOAs) do not have a clean, protocol-native way to rotate keys across fundamentally different schemes. For PQ migration to be safe and effective, the ecosystem will need:

• One-click migration flows: Non-technical users must be able to upgrade without understanding PQC details, quantum timelines, or signature formats.
• Hardware support: Hardware wallet vendors need to ship firmware updates that support new algorithms, handle dual-signature periods, and avoid confusing UX that could lead to user error.
• Custodial tooling: Exchanges and institutional custodians require bulk-migration tools that let them move large numbers of accounts and keys while maintaining auditability and regulatory compliance.

Ethereum researchers have explored mechanisms such as key-recovery-friendly proof systems and seed-based migration approaches. The goal is to reduce coordination risk—making it possible to move the long tail of EOAs into PQ-safe formats without bespoke interventions or high-friction steps that many users will simply ignore.

a16z cautions that moving quickly on this front can be counterproductive. Its roadmap highlights several forms of fragility that may arise from premature deployment:

• Implementations based on algorithms or parameters that later change as standards mature.
• Bugs in novel cryptographic libraries or tooling that have not been hardened by years of production use.
• UX missteps that expose users to phishing, key loss, or mistaken migrations.

From a16z’s vantage point, the more pressing risks for most chains are still governance failures, software bugs, and economic design flaws, not CRQC. The organization’s “don’t panic” stance does not reject PQ preparation; it argues against pushing the average user onto immature systems before the ecosystem has robust libraries, hardware support, and well-tested migration paths.

The contrast with EF’s approach is instructive rather than contradictory. EF is optimizing against the failure mode of being forced into a rushed, emergency migration. a16z is optimizing against the failure mode of self-inflicted losses from hasty deployment. The likely winners will be those that quietly build migration infrastructure early while resisting the urge to force user-level cutovers before the stack is ready.

Three Quantum Timelines, Three Different Winners

Much of the debate is driven by uncertainty over when, or even if, CRQC will arrive within the economic lifetime of today’s chains. The original analysis outlines three broad scenarios, each favoring different strategies.

1. Slow-burn scenario (CRQC in the 2040s or later)

In a world where practical quantum attacks do not emerge until well into the 2040s, PQ migration is likely to track regulatory and standards timelines. Safety and interoperability dominate over speed. Chains that have already invested in crypto agility—support for dual-signature periods, hybrid schemes, and “break-glass” emergency playbooks—can adapt gracefully without major disruption.

2. Base-case scenario (material threats in the mid‑2030s)

This is the scenario EF appears to be optimizing for. If the ecosystem wants smooth transitions by around 2035, that implies:

• Wallets and custodians need PQ tooling and UX ready years in advance.
• Signature aggregation research must mature from theory and devnet experiments into production-grade systems.
• Standards and implementations must be stable enough that chains can commit without expecting major reversals.

In this timeline, the work Ethereum is doing now—PQ-focused devnets, dedicated team structure, incentive programs like the Poseidon Prize—becomes decisive in whether the transition can be achieved without large-scale disruption to fees, throughput, or user safety.

3. Fast-shock scenario (credible quantum risk before 2030)

a16z views this as a low-probability tail risk, but not one that can be ignored entirely. In a fast-shock world, the main differentiator is reaction capacity: how quickly can a chain freeze exposure, migrate accounts, adjust consensus, and still maintain liveness?

Signals to watch in any of these scenarios include:

• Credible demonstrations of error-corrected quantum scaling and stable logical qubits.
• Sustained high-fidelity gate operations that move beyond lab prototypes.
• Government or NIST-driven acceleration of migration timelines.
• Major custodians shipping PQ-capable signing into production systems.

None of these triggers appear imminent, but any of them would compress the decision window. The practical takeaway is that networks need enough groundwork laid that they can accelerate into a migration path when signals warrant, rather than starting from scratch under stress.

The Emerging PQ Status Game Across Chains

Beyond concrete technical milestones, PQ readiness is turning into a signaling game—similar to how L2 maturity became a benchmark in previous cycles. Institutional investors and large custodians increasingly ask not only about throughput or fees, but also about long-term settlement assurances in a post-quantum world.

That logic helps explain why multiple major ecosystems are investing in PQ workstreams even in the absence of a near-term “Q‑day” consensus:

• Ethereum: Betting on hash-based foundations, zk aggregation, and coordinated governance through a dedicated PQ team and devnets.
• Solana: Running proactive PQ experiments on testnet, where its high-throughput design makes signature overhead especially painful and pushes innovation on compression.
• Polkadot: Exploring ML-DSA and Falcon alongside SNARK-based migration proofs, leveraging its heterogeneous sharding to allow per-chain experimentation.
• Bitcoin: Pursuing incremental proposals like BIP‑360 for pay-to-quantum-resistant-hash, reflecting both conservative governance and the reality of a long tail of legacy outputs that cannot be upgraded without owner action.

In this context, a chain that lacks a credible PQ roadmap risks being perceived as short-sighted, even if the true threat horizon is decades away. However, the race is not to be “first to flip” to PQ signatures. It is to:

• Ship a migration path that typical users actually follow.
• Preserve throughput and fee levels in the face of multi‑KB signature candidates.
• Replace current aggregation assumptions without sacrificing consensus liveness or validator sustainability.

For Ethereum, that means the real battlegrounds are no longer just base-layer throughput or rollup strategies. They are the planning layer (crypto agility and governance), the wallet UX layer (frictionless account migration), and the aggregation layer (economically viable signature compression under PQ assumptions). The network has started its transition years before most users feel any direct impact—and well before the quantum timeline is settled.