ETHEREUM · L1 · STAGE 2 ACKNOWLEDGED · QRI 25 v3.1.0 methodology

In plain terms

What it is. Ethereum has done more public planning for the day quantum computers can break today's account security than any other major network we looked at, yet none of that work has reached the live network.

What we found. The keys protecting the money on Ethereum are still the old kind a future quantum computer could crack, and because so much value sits here, it is the single largest pot of exposed accounts in this whole field.

Why it matters. Anyone holding or building on Ethereum is relying on protection that is planned to be replaced only around 2029, later than the dates regulators are already setting, so the gap between intent and action is yours to watch.

Ethereum publishes the deepest PQ research program of any L1 evaluated (pq.ethereum.org hub, leanXMSS, leanVM SNARK aggregation, three EIPs in CFI/draft pipeline) and ships zero PQ primitives on mainnet. The Architecture-Execution Gap of 50 points is the largest in the v3.1 pilot.

inLinkedIn ↷Audit access ⇆Compare Verified 2026-05-01

Summary

Ethereum scores QRI 25, Band 2 Acknowledged, Migration Stage 2. Mainnet runs ECDSA secp256k1 (EOA signatures), BLS12-381 (validator attestations, sync committee aggregation, deposit signatures, KZG over EIP-4844 blobs), Groth16 over BN254 (precompile EIP-196/197/198), and Keccak-256. Every active asymmetric primitive is Shor-vulnerable. Approximately every active EOA reveals its secp256k1 public key on first outbound transaction; the deposit contract reveals BLS12-381 G1 public keys for every active validator. EIP-7702 (Final, activated Pectra 2025-05-07) and ERC-4337 provide a live AA substrate; EIP-8141 (CFI, Frame Transactions, type 0x06) and EIP-8051 (ML-DSA precompile, draft) target client-layer PQ migration. Consensus PQ candidate is leanXMSS, stateful, slot-tied, paired with a leanVM SNARK aggregation pipeline targeting ~250× compression. Foundation roadmap states 2029 planning target for L1 PQ protocol upgrades; full execution-layer migration takes additional years. mainnet-traffic cap binds at 5a=0%, Architecture-Execution Gap at 50 caps QRI ≤70, Milestone-Discipline binds Stage at 2. The headline gap is 18+ announcements against zero shipped mainnet PQC primitives.

What the gates say

Gate 1a, Hybrid signature: FAIL , no documented hybrid signature composition deployed or specified at protocol level for execution or consensus signatures; EIP-8141 + EIP-8051 enable per-account choice but do not constitute protocol-level hybrid composition
Gate 1a, Hybrid KEM: FAIL , no documented hybrid KEM composition for libp2p validator gossip, devp2p, or RPC TLS
Gate 1b, Commit-to-hash: COND , only applicable if 1a-Sig OR-composition; 1a-Sig FAIL
Gate 2, Evidence reconstruction: PASS , every sub-score has ≥3 public-URL artifacts; full reconstruction from foundation hub + EIP repository + public client repos within 48 hours
Gate 3, Primitive naming: PASS , every sub-score names specific primitives

Burn-vs-rescue policy on file

Declared option c, Hybrid client-layer (architecturally; undeclared as ratified policy). Documented execution-layer PQ migration is via account abstraction (EIP-7702 already Final, EIP-8141 + EIP-8051 in draft), a per-account opt-in client-layer path with no foundation-position freeze/burn or rate-limit canary. Foundation has not formally ratified a sunset for ECDSA secp256k1, leaving the policy documented direction, not ratified position.

Seven dimensions

Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.

1 Cryptographic Exposure weight 15% 28 / 100

1a · primitive inventory 16 / 20

Foundation publishes a complete public inventory at pq.ethereum.org and across consensus-specs. Inventory is complete and primitive-specific.

Primitives: ECDSA secp256k1 (EOA signatures, execution layer) · BLS12-381 (validator attestations, sync committee aggregation, deposit signatures, consensus layer) · KZG commitments over BLS12-381 (EIP-4844 blob data availability) · Groth16 verifier (EVM precompile EIP-196/197/198 over BN254/alt_bn128) · Keccak-256 (state hashing, addressing)

1b · shor grover pq tag 4 / 20

Zero PQ-safe primitives in active mainnet use.

Tags:

ECDSA secp256k1 → Shor-break-via-DL-without-pairings
BLS12-381 (consensus aggregate, KZG, deposits) → Shor-break-via-pairings
Groth16 over BN254 → Shor-break-via-pairings
Keccak-256 → Grover-weaken (256→128bit)

1c · family diversity 0 / 20

Zero PQC family deployed on mainnet. All primitives are classically-hard and quantum-vulnerable. Diversity Cap not yet applicable.

1d · nist security category 0 / 20

ECDSA secp256k1: 128-bit classical, 0-bit post-quantum; BLS12-381: ~120-128-bit classical, 0-bit post-quantum; KZG/Groth16/BN254: pairing, 0-bit post-quantum; Keccak-256: 256→128-bit Grover-weakened. No NIST PQC category 1-5 primitive in mainnet.

1e · implementation quality 8 / 20

ECDSA and BLS12-381 implementations broadly audited across five execution clients (geth, nethermind, besu, erigon, reth) and five consensus clients (Prysm, Lighthouse, Teku, Nimbus, Lodestar). Machine-checked formal proofs for prospective leanXMSS / SLH-DSA exist in academic literature but no PQ primitive is in mainnet client code yet. blst (BLS), libsecp256k1 (ECDSA), audited. Tier 1-2 maturity; no tier-3 or tier-4 PQ primitive deployed.

2 Quantum Recovery Exposure weight 10% 16 / 100

Forge subtotal: 11/75 Decrypt subtotal: 5/25

2a · active key exposure 3 / 25

Every EOA reveals its full secp256k1 public key on its first outbound transaction. Approximately all active EOAs holding meaningful balances have transacted at least once. Validator deposit contract reveals BLS12-381 G1 public keys for every active validator. Both surfaces are forge-vulnerable post-Shor. Ethereum's TVL (~$300B+ in May 2026) is the largest exposed pubkey surface in crypto.

2b · cold key exposure 4 / 25

120 months of mainnet history; large unmoved EOA balances exist with revealed pubkeys. Institutional cold-storage signs ECDSA secp256k1, all classical. No PQ migration pathway in cold storage publicly disclosed.

2c · sig long term validity 4 / 25

Every historical ECDSA secp256k1 signature, every historical BLS12-381 attestation, and every KZG blob commitment archived on-chain or in beacon archives is forgeable post-Shor. Archive nodes retain all execution-layer signatures; beacon archive nodes retain attestations.

2d · encryption confidentiality hndl 5 / 25

Validator gossip over libp2p uses Noise XX with classical X25519 ECDH; execution-layer devp2p uses ECIES over secp256k1; RPC endpoints (Infura, Alchemy, QuickNode) terminate TLS 1.3 with classical ECDH or RSA. No hybrid PQ KEM deployed in any major Ethereum client or major RPC provider. HNDL surface for validator-to-validator gossip and RPC traffic is open.

3 Metadata, Anonymity & Confidentiality weight 13% 20 / 100

3a · tx graph visibility 3 / 20

Fully transparent ledger; every tx, every contract call, every value transfer publicly readable. Largest tx graph in crypto.

3b · rpc mempool concentration 4 / 20

Top-3 RPC: Infura (Consensys), Alchemy, QuickNode, combined market share estimated >70% of public-RPC traffic. Mempool gossip is fully observable; private mempools (Flashbots, MEV-Share) used by significant fraction of validators but base-layer mempool is public. Validator metadata retention undeclared at protocol level.

3c · cross chain bridge correlation 4 / 20

Largest bridge surface in crypto: LayerZero, Wormhole, Circle CCTP, canonical L2 bridges (Optimism, Arbitrum, Base, ZKsync), all enable address-to-address correlation across chains via passive observation.

3d · retroactive de anonymization 5 / 20

ZK applications on Ethereum (Tornado Cash historical sets, Aztec Network, Railgun, Semaphore-based mixers) build on Groth16 over BN254 or Halo2-KZG over BLS12-381, both Shor-breakable via pairings. Post-Shor, any historical shielded set is retroactively de-anonymizable.

3e · mixnet shuffle 4 / 20

No protocol-level mixnet. Application-layer mixers (Tornado Cash historically) operate on Ethereum but are not part of the consensus protocol.

4 Migration Architecture weight 10% 64 / 100

4a · crypto agility 12 / 15

EIP-7702 (Set Code for EOAs) shipped Final and activated in Pectra hard fork on 2025-05-07 at epoch 364032. Allows any EOA to delegate to smart-contract code, enabling per-account verification logic without protocol-wide hard fork. ERC-4337 native account abstraction live since 2023. EIP-8141 (Frame Transactions, type 0x06; CFI for Hegotá H2 2026) generalizes signature verification to user-defined logic supporting future ML-DSA / FN-DSA / SLH-DSA verifier contracts.

4b · aa key rotation 16 / 20

ERC-4337 + EIP-7702 deployed on mainnet since 2023 / 2025-05-07 respectively; smart-contract accounts can implement arbitrary signature validation. Documented client-layer migration path via EIP-8141 (CFI for Hegotá H2 2026) and ML-DSA EVM precompile proposal at WG-stage (EIP-8051). No PQ verifier contracts deployed in production yet.

4c · hard fork track record 13 / 15

Coordinated hard forks last 3 years: Shapella (2023-04), Dencun (2024-03), Pectra (2025-05-07). Glamsterdam scheduled H1 2026, Hegotá scheduled H2 2026. No contested forks since DAO 2016. Cadence reliable.

4d · hybrid deployment readiness 8 / 15

Foundation publicly endorses hybrid migration via account abstraction (EIP-7702 + EIP-8141 + EIP-8051), allowing EOAs to migrate to PQ verifier contracts incrementally. Architecturally possible; not yet announced as foundation policy with formal sunset for classical schemes.

4e · stateful hash state management 5 / 15

Primary consensus PQ candidate is leanXMSS, a stateful hash-based scheme. Per pq.ethereum.org and design notes, the slot-tied design (each slot mapped to a different leaf in the Merkle tree) makes state management a protocol-level concern. No mainnet enforcement spec yet; design-level discussion only.

4f · bft aggregation path 10 / 20

BLS12-381 aggregate path on consensus is in scope (sync committee aggregates ~512 validators per ~27.3-hour rotation; up to ~1M+ validator attestations per epoch). Foundation declared path is hash-based (leanXMSS) signatures + leanVM SNARK aggregation (~250× compression target). Public spec exists at pq.ethereum.org; ~10 client teams running weekly post-quantum interop devnets. No mainnet pilot.

5 Deployment Execution weight 22% 14 / 100

5a · mainnet pqc traffic pct 0 / 25

0%. Ethereum has shipped zero PQC primitive into mainnet consensus or execution. All ~1M+ validators sign BLS12-381 attestations; all EOA transactions sign ECDSA secp256k1. leanXMSS is roadmap, not deployed.

5b · pqc code in consensus client 4 / 15

PQC research code lives in EF research repos and the leanSig Rust implementation; approximately ten client teams run weekly post-quantum interop devnets. Zero PQC code merged into mainnet branches of Prysm, Lighthouse, Teku, Nimbus, or Lodestar.

5c · validator pqc key adoption 0 / 15

All active validators use BLS12-381. Zero PQ keys registered in deposit contract.

5d · published dated milestones 0 / 10

VOIDED per v3.1 because 5a = 0. For the record, Ethereum publishes more dated PQ milestones than any chain in this batch: pq.ethereum.org hub launched Q1 2026; Glamsterdam H1 2026 / Hegotá H2 2026 fork windows; 2029 stated planning target for L1 PQ protocol upgrades; the Poseidon Initiative $1M Poseidon Prize headline + a research-paper bounty fund of approximately $90K with $5K minimum (≈$66K already claimed). None are enforcement-mechanism-backed sunset dates for classical schemes.

5e · pqc washing delta 5 / 15

Trailing 12 months announced: ≥18 distinct named announcements/blog posts/press articles tied to pq.ethereum.org launch, EF prize programs, EF PQ team formation, leanXMSS / leanVM / leanSig publications, EIP-8141 / EIP-8051 / EIP-7851 drafts and proposals, weekly interop devnets. Shipped to mainnet: 0. Substantive technical research backing exists, distinguishing this from pure PR; partial deduction rather than full narrative-only cap.

5f · signature footprint multiplier 5 / 20

Reference multipliers per design: SLH-DSA-128s ~110-125× raw; ML-DSA-44 ~38× raw; Falcon-512 ~10-11× raw; leanXMSS one-time-per-slot signatures larger than BLS aggregates, with leanVM SNARK aggregation targeting ~250× compression. Without leanVM aggregation the raw footprint sits in the 10-38× band; with aggregation target met, multiplier could fall under 2×.

6 Supply Chain Vendor Readiness weight 22% 10 / 100

6a · wallet 3 / 25

Top-3: MetaMask, Ledger HW, Safe (formerly Gnosis Safe). No top-3 Ethereum wallet has published a binding PQC roadmap as of 2026-05-01. Ledger publishes general Side-Channel Attacks & Post Quantum Cryptography educational content but no firmware migration timeline.

6b · bridge 2 / 25

Top-3: LayerZero, Wormhole, Circle CCTP. LayerZero acknowledges PQ as future work without binding spec or date. Wormhole grants for ZK light clients exist but with no PQ-named primitive commitment. Circle CCTP, no public PQ migration plan.

6c · custodian 3 / 25

Top-3: Coinbase Custody, BitGo, Anchorage Digital. Custodian sector publishes general PQ alignment with NIST language but no migration date for ECDSA secp256k1 or BLS12-381 key material. BitGo's January 2026 IPO filing raises PQ topic as sector concern. MPC architectures (Fireblocks, BitGo) face additional PQ-MPC research gap.

6d · rpc hsm tee infra 2 / 25

Top-3 RPC: Infura, Alchemy, QuickNode. No published PQ-TLS migration timeline. HSM: AWS KMS, YubiHSM, Thales Luna, no PQC-for-secp256k1 product publicly announced. TEE: Intel SGX (server-only) and TDX continue PCS API v2/v3 EOL transition; PCS attestation chains themselves are not PQ-protected.

7 Governance & Coordination weight 8% 60 / 100

7a · validator stake distribution 14 / 20

~1M+ validators, largest set in crypto. Lido ~27% beacon stake share is primary concentration risk; Coinbase, Binance, Kraken next tier. Five-client diversity at consensus and execution layers.

7b · upgrade cadence under pressure 16 / 20

Pectra delivered 2025-05-07 after Holesky/Sepolia finality issues required Hoodi testnet fallback, recovered without contested mainnet event. Glamsterdam H1 2026 / Hegotá H2 2026 active. EIP-8141 / EIP-8051 / EIP-7851 PQ track in CFI/draft pipeline.

7c · named coordination lead 18 / 20

Public PQ leadership hub at pq.ethereum.org with explicit mandate, named team page, and identified roles (PQ team lead, consensus PQ design, Protocol Snarkification team, program coordination). Multi-client culture with named client teams.

7d · adversarial coordination precedent 12 / 20

DAO fork (2016) demonstrates adversarial coordination capability, but produced a permanent contentious split (ETC). No precedent for emergency cryptographic primitive change. Lido governance dynamics and proposer-builder separation introduce coordination complexity at scale.

7e · canary tripwire mechanism 0 / 20

No published canary, honeypot, or tripwire mechanism for quantum cryptanalytic events. EIP-7851 (deactivate delegated EOA's key with 7-day delay) is a per-account migration tool, not a network-level tripwire.

X + Y vs Z, when does the math turn against you?

v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?

X, signature shelf life

5–25 years

Y, migration time

8–15 years to Stage 5

Z10 (10% CRQC year)

2030

Z25 (25% CRQC year)

2035

Verdict

X+Y midpoint ≈ 2037, Outside risk window vs Z25 2035; Crisis Zone vs Z10 2030

Z-compliance

Outside compliance window risk if 2029 target slips; full execution-layer migration target sits at the edge of NIST 2030 deprecation

Source-disagreement disclosure

v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.

Migration timeline

Foundation roadmap states L1 protocol upgrades could be completed by 2029, with full execution-layer migration taking additional years beyond. Independent jurisdictional anchors (NIST IR 8547 2030 deprecation / 2035 disallowance; CNSA 2.0 2027-2030; EU NIS2 implementation track 2026-2027) place compliance pressure earlier than the 2029+ target.

Mainnet readiness

Foundation position emphasizes research depth and AA-substrate maturity (EIP-7702 live). Public sweep evidence emphasizes zero shipped mainnet PQC primitive. Both are true; weighting changes the headline.

Threat probability

Public estimates of cryptanalytically-relevant quantum computer arrival span 2030 (10% lower bound) through 2040+ (mainstream uncertainty). The mainnet-traffic cap binds regardless because 5a = 0%.