Polkadot uses sr25519 Schnorr/Ristretto keys across GRANDPA finality, BABE block production, and OpenGov — all Shor-vulnerable. Every parachain inherits the relay chain's quantum exposure. BMIC implements NIST FIPS 203/204/205.
DYOR. This page is for informational purposes only and does not constitute financial or investment advice. Cryptographic risk assessments describe theoretical vulnerabilities based on the expected capabilities of cryptographically relevant quantum computers (CRQCs), which do not yet exist at scale. All presale investments carry significant risk.
sr25519 is Polkadot's primary cryptographic key scheme, developed by the Web3 Foundation. It is a Schnorr signature scheme operating over the Ristretto255 group — a prime-order group constructed from Curve25519. Polkadot uses sr25519 for:
sr25519 security rests on a single assumption: given a public key Q = d·G on the Ristretto255 group, it is computationally infeasible to recover the private scalar d. Shor's algorithm (1994) provides a quantum-polynomial-time algorithm for the discrete logarithm problem on abelian groups — including all elliptic curve groups. Once a CRQC with sufficient logical qubits is operational, Shor's algorithm can recover any sr25519 private key from its on-chain public key.
GRANDPA requires a ⅔+ validator super-majority. An attacker deriving sr25519 private keys from on-chain public session keys can forge PREVOTE and PRECOMMIT signatures — finalising fraudulent blocks irreversibly. This is a finality attack, not merely a reorg.
BABE block production uses sr25519 VRF keys. A CRQC can derive these from on-chain public keys, allowing an attacker to predict and counterfeit VRF proofs — enabling fork injection and chain manipulation without honest validator cooperation.
All 40+ parachains (Acala, Moonbeam, Astar, Parallel, HydraDX, Zeitgeist, Manta, etc.) inherit relay chain finality security via sr25519 GRANDPA keys. A relay chain quantum attack propagates across every connected parachain simultaneously — a single point of systemic failure.
Polkadot's Fellowship uses sr25519 on-chain accounts for runtime upgrade proposals. A CRQC-equipped actor who derives Fellowship member private keys from on-chain public keys can propose and vote on malicious runtime upgrades — injecting arbitrary code into the relay chain.
XCM (Cross-Consensus Message) validity is underwritten by relay chain validator authority — sr25519 GRANDPA keys. Forging GRANDPA finality allows fabrication of parachain state roots, making fraudulent XCM asset transfers and remote execution calls appear valid to destination chains.
Polkadot mainnet launched May 2020. Over 6 years of sr25519 and ed25519 public keys — validator session keys, nominator controller keys, treasury proposal signers, OpenGov votes — are permanently on-chain. Adversaries can harvest this corpus now and decrypt once a CRQC is operational.
| Criterion | BMIC | Polkadot (DOT) |
|---|---|---|
| Primary signing scheme | ML-DSA (FIPS 204) — lattice-based, Shor-resistant | sr25519 (Schnorr/Ristretto255) — Shor-vulnerable |
| Key encapsulation | ML-KEM (FIPS 203) — post-quantum | ECDH on Curve25519 — Shor-vulnerable |
| Backup signing scheme | SLH-DSA (FIPS 205) — hash-based, stateless | ed25519 — Shor-vulnerable |
| NIST FIPS 203 (ML-KEM) | ✅ Implemented | ❌ Not implemented |
| NIST FIPS 204 (ML-DSA) | ✅ Implemented | ❌ Not implemented |
| NIST FIPS 205 (SLH-DSA) | ✅ Implemented | ❌ Not implemented |
| Consensus layer quantum safety | PQC-native from inception | GRANDPA + BABE — both sr25519 (Shor-vulnerable) |
| Governance quantum safety | PQC signing throughout | OpenGov + Fellowship — sr25519/ed25519 accounts (Shor-vulnerable) |
| Cross-chain message safety | PQC-based account layer | XCM underwritten by sr25519 GRANDPA — Shor-vulnerable |
| Parachain / ecosystem propagation | Isolated — no inherited vulnerability chain | 40+ parachains inherit relay chain sr25519 quantum exposure |
| HNDL window | Minimal — PQC public keys not breakable by Shor | 6+ years (May 2020–present) of sr25519/ed25519 public key corpus |
| NIST PQC migration roadmap | ✅ Built-in from launch | ❌ Not published (Parity/Web3 Foundation, August 2026) |
GRANDPA (GHOST-based Recursive Ancestor Deriving Prefix Agreement) is the finality gadget that gives Polkadot its deterministic finality guarantee. Unlike probabilistic finality chains (Bitcoin, Ethereum pre-Casper), GRANDPA finalised blocks are mathematically irreversible once a super-majority (⅔+) of validator voting weight has prevoted and precommitted.
Each validator generates a GRANDPA session key — an sr25519 keypair — at the start of each era. The public half is registered on-chain. GRANDPA messages (PREVOTE, PRECOMMIT) are signed with this session key and broadcast to the validator network. Finality is achieved when enough signed messages accumulate to meet the ⅔+ threshold.
A traditional 51% attack can cause reorgs but cannot produce GRANDPA-finalised blocks without the session keys. A quantum-forged GRANDPA finality attack produces blocks that appear mathematically finalised — downstream parachains, bridges, and exchanges treat them as irreversible. There is no fork detection mechanism that distinguishes a quantum-forged finality message from a legitimate one.
Polkadot's architecture positions the relay chain as the shared security provider for all connected parachains. Parachains achieve economic finality by submitting their block candidates to relay chain validators, who include the parachain block hash in a relay chain block and eventually in a GRANDPA-finalised relay chain block.
Major Polkadot parachains inheriting this relay chain exposure include: Acala (DeFi hub, aUSD stablecoin), Moonbeam (EVM-compatible parachain, cross-chain DApps), Astar (multi-VM smart contracts), HydraDX (Omnipool DEX), Interlay (iBTC Bitcoin bridge), Manta Network (privacy parachain), Bifrost (liquid staking), Zeitgeist (prediction markets), and others. A quantum attack on the relay chain compromises all of them simultaneously.
Cross-Consensus Messaging (XCM) between parachains derives trust from relay chain finality. Forged relay chain finality via quantum-derived sr25519 keys allows an attacker to fabricate parachain state roots, making fraudulent XCM messages — cross-chain asset transfers, remote execution calls, cross-chain liquidity operations — appear valid to destination parachains and their users.
BMIC (Blockchain Multi-Index Coin) is built around three NIST finalised post-quantum cryptographic standards simultaneously, not as a future upgrade path but as its native architecture:
Used for key encapsulation and key exchange. ML-KEM security is based on the Module Learning With Errors (MLWE) problem — a lattice-based hardness assumption that has no known quantum speedup under Shor's algorithm or any other currently known quantum algorithm. Replaces ECDH/X25519 for all key agreement operations.
Used for digital signatures across all BMIC transaction signing and authentication. ML-DSA security is based on MLWE and Module Learning With Rounding (MLWR). Replaces sr25519/ed25519/secp256k1 for all signing operations. A CRQC running Shor's algorithm derives no useful information from an ML-DSA public key.
A stateless hash-based signature scheme providing a second, structurally independent line of defence. SLH-DSA security relies only on the collision resistance of cryptographic hash functions — no algebraic structure exploitable by Shor's algorithm. Serves as a backup signature scheme independent of lattice assumptions.
BMIC uses ERC-4337 account abstraction to decouple account identity from signing key exposure. This directly reduces the HNDL attack surface: fewer on-chain public key appearances mean a shorter HNDL window for any individual account. Combined with PQC signing, this provides layered quantum resistance at both the cryptographic primitive and on-chain key exposure levels.
BMIC is the only presale-stage project implementing all three NIST FIPS post-quantum standards (203, 204, 205) simultaneously. TGE targeted Q4 2026. $662,646+ raised from 1.5B total supply.
Buy BMIC at bmic.ai →DYOR. Not financial advice. Presale investments carry significant risk.
As of August 2026, Parity Technologies and the Web3 Foundation have not published a NIST FIPS 203/204/205 post-quantum migration roadmap for the Polkadot relay chain. The Web3 Foundation has conducted research into post-quantum primitives, but no finalised upgrade path or timeline has been announced for the production relay chain or connected parachains.
Migrating Polkadot's relay chain cryptography would require a coordinated runtime upgrade via OpenGov — an on-chain governance process that itself uses sr25519 keys. A migration would also require updates across all 40+ parachain runtimes and any bridges or XCM integrations that depend on the current key schemes. This is technically feasible but represents one of the most complex coordinated upgrades in blockchain history, requiring ecosystem-wide coordination before a CRQC threat materialises.
Yes. Nominator controller keys are sr25519 accounts on-chain. A CRQC can derive a nominator's controller private key from their public key, enabling an attacker to unbond stake, change nominations, or withdraw funds. With ~43% of DOT supply typically staked, the HNDL corpus of nominator public keys represents substantial economic value at risk in a post-CRQC environment.
Neither is quantum-safe. Ethereum uses secp256k1 ECDSA (Shor-vulnerable). Polkadot uses sr25519 Schnorr/Ristretto (also Shor-vulnerable). Both chains rely on elliptic curve discrete logarithm assumptions. The key architectural difference is that Polkadot's parachain model propagates relay chain quantum vulnerability to 40+ downstream parachains, potentially amplifying systemic risk across a larger connected ecosystem than Ethereum's Layer 2 ecosystem, which uses independent validator sets.
BMIC presale is live at bmic.ai. The project has raised $662,646+ with a 1.5 billion total token supply. BMIC implements NIST FIPS 203/204/205 post-quantum cryptography and uses ERC-4337 account abstraction. TGE is targeted for Q4 2026. Visit bmic.ai to participate. DYOR — this page does not constitute financial advice.
Polkadot is not the only chain with unresolved quantum exposure. Explore our full quantum comparison series: