Foundation publishes a complete public inventory across the Yellow Paper, consensus-specs, the EIP repository and pq.ethereum.org. Inventory is complete and primitive-specific.

Zero PQ-safe asymmetric primitives in active mainnet use.

Zero PQC family deployed on mainnet. All primitives are classically-hard and quantum-vulnerable. Cryptographic-Diversity Cap not yet applicable.

ECDSA secp256k1: 128-bit classical, 0-bit post-quantum; BLS12-381: about 120 to 128-bit classical, 0-bit post-quantum; KZG/BN254 pairings: 0-bit post-quantum; Keccak-256: 256 to 128-bit Grover-weakened preimage. No NIST PQC category 1 to 5 primitive in mainnet.

ECDSA and BLS12-381 implementations are exercised across at least five execution clients (Geth, Nethermind, Besu, Erigon, Reth) and six consensus clients (Prysm, Lighthouse, Teku, Nimbus, Lodestar, Grandine); blst (BLS12-381) carries a 2021 NCC Group audit. Machine-checked proofs exist for XMSS per RFC 8391 and SPHINCS+, the ancestors of leanXMSS and SLH-DSA; leanXMSS has a paper proof (IACR ePrint 2025/055) and a formal-verification track reported at 40% on the lean roadmap. The leanSig Rust reference implementation describes itself as prototypical, unaudited and not for production. No PQ primitive is in mainnet client code. Tier 1 to 2 maturity; no tier-3 or tier-4 PQ primitive deployed.

Every EOA reveals its full secp256k1 public key on its first outbound transaction, and the validator deposit contract reveals a 48-byte BLS12-381 G1 public key for every validator (about 901,000 active at the finalized epoch on 2026-08-19, about 42.3M ETH of active balance). Both surfaces are forge-vulnerable post-Shor. Value on the ledger at scan date (the fraction sitting behind revealed keys is unmeasured): ETH market capitalization about 232 billion dollars, about 147 billion dollars of stablecoins issued on Ethereum and about 42 billion dollars of DeFi TVL (public aggregator reads, 2026-08-19). No independently verified on-chain measurement of the exposed-key share of ETH supply is published; we score no estimate.

About 133 months of mainnet history (genesis 2015-07-30); large unmoved EOA balances with revealed public keys exist. The protocol accepts only ECDSA secp256k1 for EOA spends, so every cold key, institutional or retail, is a secp256k1 key. We found no custodian-published PQ migration path for cold storage.

Every historical ECDSA secp256k1 signature and every historical BLS12-381 attestation archived on-chain or in beacon archives is forgeable post-Shor; KZG commitments retained in beacon blocks lose binding once the structured-reference-string secret is recoverable by discrete log (blob data itself is served for only 4,096 epochs, about 18 days). Archive nodes retain all execution-layer signatures; beacon archive nodes retain attestations.

Consensus-layer p2p per consensus-specs: QUIC primary transport secured with TLS 1.3 per the libp2p TLS spec (mandated 2026-07-06), Noise XX with 25519 Diffie-Hellman (protocol name Noise_XX_25519_ChaChaPoly_SHA256 per libp2p-noise) on the TCP fallback, secp256k1 node identities in both; no hybrid KEM specified. Execution-layer devp2p RLPx: ECIES over secp256k1 (ECDH, NIST SP 800-56 concatenation KDF, AES-128-CTR, HMAC-SHA-256, Keccak-256 MAC). RPC TLS edges probed with a TLS 1.3 handshake on 2026-08-19: QuickNode's public documentation endpoint negotiates hybrid X25519MLKEM768, as do four public gateway endpoints we tested; Alchemy negotiates classical X25519 and returns a handshake-failure alert when offered X25519MLKEM768 alone; Infura's mainnet endpoint negotiates TLS 1.2 ECDHE-RSA. The HNDL surface for node-to-node traffic is fully open; for RPC traffic it is partially closed at some providers' TLS edges, which is a property of the provider's CDN, not of any Ethereum specification.

Fully transparent ledger; every transaction, contract call and value transfer is publicly readable. Default-path transactions broadcast to a public mempool observable by all network participants before block inclusion; the foundation's own MEV documentation describes bots that watch the mempool to copy profitable transactions.

The three commercial RPC providers we assessed are Infura (Consensys), Alchemy and QuickNode; no public measurement of their individual or combined share of RPC traffic exists, so sub-criterion (i) is scored on the absence of a measurement, not on an estimate and not on a ranking of providers. The base-layer mempool is public; transactions can bypass it only through opt-in private channels (Flashbots and MEV-Boost builder flows, per the foundation's MEV documentation). Validator metadata retention is undeclared at protocol level.

Extensive bridge surface: LayerZero, Wormhole, Circle CCTP and the canonical L2 bridges (Optimism, Arbitrum, Base, ZKsync) all enable address-to-address correlation across chains via passive observation of public transactions.

Privacy applications on Ethereum build on pairing-based proof systems over BN254 verified through the EIP-196/197 precompiles: Tornado Cash and Railgun (Groth16 via circom/snarkjs), Semaphore (Groth16 via snarkjs), Aztec (PLONK/Honk-family proofs from the Barretenberg bn128 library). All are Shor-breakable via pairings; post-Shor, the soundness of historical proofs fails and shielded sets can be retroactively de-anonymized to the extent their on-chain data permits.

No protocol-level mixnet. Application-layer mixers (Tornado Cash historically) operate on Ethereum but are not part of the consensus protocol.

EIP-7702 (Set Code for EOAs) is Final and activated in the Pectra hard fork on 2025-05-07 at epoch 364,032. It lets any EOA delegate to smart-contract code; per-account verification logic then needs no protocol-wide hard fork. ERC-4337 (alt-mempool account abstraction, Final) has had its EntryPoint on mainnet since 2023-03-01. EIP-8141 (Frame Transactions, type 0x06, created 2026-01-29) is status Draft as of 2026-08-19; the Forkcast upgrade tracker records it as Considered for Inclusion in Hegotá since 2026-03-26 (ACDE #233) as the native-AA placeholder, with FOCIL (EIP-7805) the sole Scheduled headliner; on the ACDE #243 thread Nethermind reported an initial implementation and a testnet run on 2026-08-07, a competing design requiring no new EVM opcodes (EIP-8130, Draft, created 2025-10-14) was put forward against it on 2026-08-10, and a 2026-08-13 comment records that EIP-8141 was moved to Considered as a placeholder for native account abstraction with the specific implementation still disputed. EIP-8141 states its own purpose as a native off-ramp from elliptic-curve transaction authentication to post-quantum secure systems, the hook for future ML-DSA / SLH-DSA / Falcon verifier contracts.

ERC-4337 (mainnet since 2023-03-01) and EIP-7702 (since 2025-05-07) let accounts implement arbitrary signature validation. Documented client-layer migration path: EIP-8141 (Draft, Considered for Inclusion in Hegotá), ML-DSA precompile proposals EIP-8051 (Draft since 2025-10-15, ML-DSA-44 only, declined for Glamsterdam 2026-01-15) and EIP-8355 (Draft in an open EIP-repository pull request, created 2026-07-30, ML-DSA-44/65/87 per FIPS 204, proposed for Hegotá 2026-08-13), and EIP-7932 (Secondary Signature Algorithms, SIGRECOVER precompile, Draft since 2025-04-12, declined for Glamsterdam 2025-12-04). No PQ verifier contracts are deployed in production. A public research-forum thread documents proof-of-concept ERC-4337 Falcon wallet flows, reporting on-chain Falcon verification cut from 24M to about 3.6M gas in a Solidity implementation, with a contributor in the same thread reporting about 2M gas for Falcon-512 instantiated with Keccak-256 and about 6.6M gas for Dilithium; these are forum-reported benchmarks, not audited or peer-reviewed results. The same thread states the blocker directly: the bundler transaction still relies on ECDSA, so every such flow terminates in a classical ECDSA secp256k1-signed transaction and no end-to-end PQ account path exists without a protocol change.

Coordinated hard forks in the trailing 3 years: Dencun (2024-03-13), Pectra (2025-05-07) and Fusaka (2025-12-03); Shapella (2023-04-12) has aged out of the window. No contested forks since the DAO fork of 2016. Both stated 2026 fork windows slipped: Glamsterdam (foundation-stated target first half of 2026 as of 2026-02-18) had not activated by 2026-08-19 and entered a publicly joinable testnet (Platåberget, announced 2026-08-17); Hegotá (foundation-stated to follow later in 2026) is listed for 2027 on the Forkcast upgrade tracker. Coordination remains uncontested but the stated cadence was not held.

Foundation documentation endorses incremental migration via account abstraction (EIP-7702 + EIP-8141 + ML-DSA precompiles), allowing EOAs to migrate to PQ verifier contracts one account at a time. Architecturally possible; not announced as foundation policy with a formal sunset for classical schemes.

Primary consensus PQ candidate is leanXMSS, a synchronized (stateful) hash-based scheme in which signing is tied to a slot index with at most one signature per slot (IACR ePrint 2025/055). State management is therefore a protocol-level concern. No mainnet enforcement spec yet; design-level discussion only.

BLS12-381 aggregate path on consensus is in scope (sync committee of 512 validators rotating every 256 epochs, about 27.3 hours; about 901,000 active validators attesting per epoch). Foundation-declared path is hash-based leanXMSS signatures plus leanVM SNARK aggregation (250x compression target; about 3,000-byte signatures vs 96-byte BLS). Public spec and reference code exist (leanSpec, leanSig, leanMultisig); pq-devnet-4 active and pq-devnet-5 planned per the public devnet tracker, which itself shows last updated May 2026. Weekly PQ interop calls ran through #49 (2026-07-29) with none scheduled after as of 2026-08-19, while the bi-weekly PQ transaction-signature (PQTS) breakout series (kickoff 2026-01-21; #10 to #13 June to August 2026) continues on the execution side; net call cadence is mixed, not weekly. No mainnet pilot.

0%. Ethereum has shipped zero PQC primitive into mainnet consensus or execution. All active validators (about 901,000 at the finalized epoch on 2026-08-19) sign BLS12-381 attestations; all EOA transactions sign ECDSA secp256k1. leanXMSS is roadmap, not deployed.

PQC research code lives in the leanEthereum repositories (leanSpec, leanSig, leanMultisig). Six client teams are listed on the active pq-devnet-4 (Ream, Zeam, Qlean, Lantern, Grandine, ethlambda); the eight-team list that adds gean and Peam belongs to pq-devnet-5, which the public tracker marks Planned, not active. Of those six, only Grandine is also a mainnet consensus client; the other five are research clients. PQ interop calls ran through #49 (2026-07-29) with none scheduled after as of 2026-08-19; the PQTS breakout series, declared bi-weekly, continued through #13 (scheduled 2026-08-19), though actual spacing between #9 and #13 ranged from 7 to 34 days. Code search across all six mainnet consensus clients (Lighthouse, Prysm, Teku, Nimbus, Lodestar, Grandine) returned zero hits for XMSS and ML-DSA identifiers on 2026-08-19, Grandine included; no mainnet consensus client carries PQ signature code.

All active validators use BLS12-381. Zero PQ keys registered in deposit contract.

VOIDED per v3.1 because 5a = 0. For the record, Ethereum publishes a dense set of dated PQ milestones: the pq.ethereum.org hub (last updated 2026-06-27); a 2029 stated planning target for L1 PQ protocol upgrades; the Poseidon cryptanalysis program (Poseidon1 Collision Prize with a total bounty budget of 992,000 dollars, one 32,000-dollar tier claimed 2026-04-06, program paused from 2026-08-01; a 2026 attack-reward fund of 90,000 dollars with a 5,000-dollar minimum; 66,000 dollars of earlier bounties recorded as earned). The milestone-delivery track record is now negative: the two fork windows the foundation stated on 2026-02-18 (Glamsterdam first half of 2026; Hegotá later in 2026) both slipped, with Glamsterdam still pre-activation at a public testnet (Platåberget, 2026-08-17) and Hegotá listed for 2027. None of the published dates are enforcement-mechanism-backed sunset dates for classical schemes.

Trailing 12 months announced: at least 21 distinct named PQC announcements by our count, including pq.ethereum.org hub content and its 2026-06-27 refresh, Poseidon prize and bounty programs, PQ team formation, leanXMSS / leanVM / leanSig / leanMultisig publications, EIP-8141 / EIP-8051 / EIP-8355 / EIP-7851 / EIP-7932 drafts and fork proposals, the 2026-02-18 protocol-priorities update naming post-quantum readiness under the Harden-the-L1 track, the PQTS breakout series (kickoff 2026-01-21) and pq-devnets 0 to 4. Shipped to mainnet: 0. Substantive technical research backing exists, distinguishing this from pure PR; partial deduction rather than full narrative-only zero.

Reference multipliers against a 64-byte ECDSA secp256k1 signature: SLH-DSA-SHA2-128s 7,856 bytes (FIPS 205, security category 1), about 123x; ML-DSA-44 2,420 bytes (FIPS 204), about 38x; Falcon-512 666 bytes (Falcon specification; FN-DSA was selected by NIST for standardization but no final FIPS exists as of 2026-08-19, so no FIPS-fixed size can be cited), about 10x. On consensus, leanXMSS signatures of about 3,000 bytes against 96-byte BLS, about 31x raw, with leanVM SNARK aggregation targeting 250x compression of the aggregate. Without aggregation the raw multiplier is about 10x to 38x for the lattice and NTRU candidates and about 123x for the stateless hash-based candidate; with the aggregation target met the consensus multiplier could fall under 2x.

Top-3: MetaMask, Ledger hardware wallets, Safe (formerly Gnosis Safe). We found no published binding PQC roadmap from any of the three as of 2026-08-19. Ledger published ML-KEM-512/768/1024 and ML-DSA-44/65/87 APIs in its embedded-OS SDK on 2026-07-06 (SDK level; no device firmware, Ethereum app or migration timeline) and a side-channel-and-PQC explainer on 2026-04-29.

Top-3: LayerZero, Wormhole, Circle CCTP. We found no published PQ migration plan or PQ-named primitive commitment from any of the three (vendor sites and documentation sitemaps checked 2026-08-19). The only Circle-related PQ signal is a presentation titled 'SPHINCS at Circle' on the agenda of the 2026-08-19 PQTS breakout call, which is research engagement, not a CCTP roadmap.

Top-3: a tier-1 US custodian, BitGo, Anchorage Digital. BitGo's IPO prospectus (filed 2026-01-23) lists quantum computing as a risk factor that could break elliptic-curve cryptography; we found no custodian-published migration date for ECDSA secp256k1 or BLS12-381 key material. MPC custody architectures face an additional PQ-MPC research gap (threshold ML-DSA adds rounds; SLH-DSA has no efficient MPC).

RPC: none of Infura, Alchemy or QuickNode publishes a PQ-TLS migration timeline; in a 2026-08-19 handshake probe QuickNode's edge negotiated hybrid X25519MLKEM768, Alchemy classical X25519, Infura TLS 1.2 ECDHE-RSA. HSM/KMS: AWS KMS offers ML-DSA-44/65/87 (FIPS 204) signing keys alongside ECC_SECG_P256K1, but Ethereum accepts only ECDSA secp256k1 transaction signatures, so no key-management product can sign a PQ Ethereum transaction today. TEE: Intel SGX/TDX attestation (PCS API v4; v2 and v3 reached end of life) still chains through ECDSA-signed provisioning certificates and is not PQ-protected.

About 901,000 active validators holding about 42.3M ETH (finalized epoch, 2026-08-19). Lido is a single staking pool holding about 22.5% of active stake (Lido-reported 9.54M ETH staked against 42.3M ETH active beacon balance, both read 2026-08-19); we did not measure every pool, so we make no claim about rank. Consensus client-diversity trackers read 2026-08-19 show at least one client above the 50% line while disagreeing on which, and by wide margins: Miga Labs reports Lighthouse at 50.98%, Rated.Network reports Teku at 53.86% (Lighthouse 20.6%), and a third reading on the same aggregator reports Teku at 99.83%, which is not credible as a share of the network and marks the spread as a measurement problem. On the execution side the aggregator still displays Geth at 50.13% attributed to Ethernodes, but the same page states that the Ethernodes dataset has been removed and does not reliably represent clients in use, and the survey source it recommends instead was unreachable on 2026-08-19; the execution-side figure is therefore reported without a working corroborating source. Six consensus and at least five execution client implementations exist, but every usable consensus reading places a single client at or above the community's own supermajority tripwire.

Pectra delivered on mainnet 2025-05-07 after Holesky and Sepolia testnet deposit-contract misconfigurations (Holesky suffered extended inactivity leaks) forced the creation of the Hoodi testnet in March 2025; recovered without a contested mainnet event. Fusaka followed on 2025-12-03. Glamsterdam is at a publicly joinable testnet stage (Platåberget, announced 2026-08-17) after missing its first-half-2026 window; Hegotá is listed for 2027. EIP-8141 / EIP-8051 / EIP-8355 / EIP-7851 PQ track remains Draft-stage.

Public PQ hub at pq.ethereum.org with an explicit mandate, maintained by the Post-Quantum team within the foundation's Protocol cluster; the hub names the Protocol Snarkification team lead but no PQ team lead or roster. The 2026-02-18 protocol-priorities update names the Security focus-area lead who drives post-quantum readiness; the 2026-05-11 protocol update names a research coordinator whose scope includes post-quantum consensus; the lean roadmap names a lead per research track. Multi-client culture with named client teams. Two points withheld because the PQ-specific accountable lead is split across two posts and not stated on the hub itself.

DAO fork (2016) demonstrates adversarial coordination capability, but produced a permanent contentious split (ETC). No precedent for emergency cryptographic primitive change. Liquid-staking concentration and proposer-builder separation introduce coordination complexity at scale.

No published canary, honeypot or tripwire mechanism for quantum cryptanalytic events. EIP-7851 (Code-Controlled EOA Delegation, Draft, proposed for Hegotá 2026-06-04) lets a delegated account irreversibly disable its own ECDSA authority via an ECDSA-disabled delegation prefix; it is a per-account migration tool, not a network-level tripwire.