Most projects answer "are you quantum-safe?" with a yes or a no. Both are lies — a blockchain isn't one cryptographic thing, it's a stack of them: proofs, signatures, hashes, key agreement, addresses. A quantum computer breaks some and merely dents others. The honest answer is a map, not a label. Here's ours — including the parts that aren't there yet.
A quantum computer is not just a faster classical one. It runs two algorithms that bear on cryptography, and their consequences could not be more different. Everything on this page follows from the gap between them.
It breaks the math behind elliptic-curve and discrete-log cryptography outright — not "weakens," breaks. Every ECDSA signature, every RSA key, every classical Diffie-Hellman exchange falls. If your security rests on "factoring is hard" or "discrete logs are hard," Shor ends it.
Against hash functions and symmetric ciphers it offers only a quadratic speedup — effectively halving the security level. A 256-bit hash drops to 128 bits of resistance, still far beyond reach. You don't replace hashes for the quantum era; you size them with margin, and most already have it.
The rule for the rest of this page: anything resting on elliptic curves dies; anything resting on hashes survives. Where Stealth sits depends entirely on which one each component used.
The honest map. ✓ post-quantum · ◐ weakened but safe, or conditionally safe · ✗ classical, Shor-vulnerable.
| Shielded proof system zk-STARKs · FRI · commitments · nullifiers |
✓ Post-quantum | Hash-based, no elliptic curves, no trusted setup. Guarantees no forgery, no double-spend, no inflation — and it is quantum-resistant by construction. Grover only halves the hash margin; the parameters carry the headroom. |
| Shielded note encryption the transport hiding amounts & recipients |
✗ Classical | Uses classical elliptic-curve key agreement — the same kind Shor breaks. The validity of a private transaction is post-quantum; the confidentiality of its contents is not yet. Isolated behind one module so a post-quantum KEM can replace it. |
| All hashing txids · Merkle trees · Rescue-Prime · Argon2 feework |
◐ Weakened, safe | Grover halves effective security; the output sizes and existing margins keep every one of them safe. No action needed beyond sizing. |
| Transparent (XST) signatures | ✗ Classical | secp256k1 ECDSA. Shor-broken. This is the base layer that has existed since launch. |
| Junaeth consensus signatures block signatures · staker keys |
✗ Classical | Also secp256k1 ECDSA. To be clear: the protocol is fast and novel, but "quantum" in qPoS — the consensus class Junaeth implements — names the design, not the signature scheme. The keys are classical. |
| Addresses Hash160 of the public key |
◐ Conditional | An address never spent from and never reused hides its public key behind a hash — Shor can't attack a key it can't see. The moment you spend, or reuse an address, the key is exposed on-chain and becomes harvestable. |
The takeaway isn't "Stealth is quantum-safe" or "Stealth isn't." It's that the part that proves your privacy is post-quantum today, the part that encrypts it isn't yet, and the transparent base layer carries the same classical signatures as every other UTXO chain — and we're not going to pretend otherwise. What changes from here, and in what order, is the roadmap below.
An adversary doesn't need a quantum computer today to attack you today. They need only to record the chain today — every exposed public key, every shielded note ciphertext — and wait. When a cryptographically-relevant quantum computer arrives, they decrypt and forge retroactively, against data they captured years earlier.
On a value-bearing privacy chain this cuts twice. Exposed signature keys can be forged to move funds. And recorded note ciphertexts, today protected by classical key agreement, can be decrypted to unmask the very transactions you shielded — amounts, recipients, the history you paid to keep private. Privacy that depends on classical encryption is privacy with an expiry date you don't control.
That's why the proof system is hash-based from day one — and why the encryption KEM and the base-layer signatures are the work that follows.
Stealth's shielded layer proves every private transaction with zk-STARKs — zero-knowledge proofs whose security rests entirely on hash functions and a technique called FRI, with no elliptic curves and no trusted setup ceremony anywhere in the system.
That's a deliberate, unusual bet: by building the proof system on hashes alone, its soundness inherits the same Grover-only, survivable exposure as every other hash in the stack. No Shor-breakable assumption sits underneath your privacy guarantees.
The remaining piece is confidentiality transport — how a recipient privately receives a note. Today that uses classical elliptic-curve key agreement (the same kind Shor breaks), deliberately isolated behind a single module so a post-quantum KEM — the lattice-based key-exchange schemes now being standardized — can take its place without touching the proof system. Soundness is already there; sealing confidentiality against harvest-now-decrypt-later is the next step.
Step back from Stealth. Here's the general picture — true of every chain.
STARKs, hash-based commitments, and Merkle trees are post-quantum today. The cost is proof size and prover time, not security.
Post-quantum schemes exist and are being standardized — lattice designs like ML-DSA and Falcon, hash-based designs like SPHINCS+. A PQ signature can be tens to hundreds of times larger than ECDSA's ~72 bytes, straining block space, storage, and bandwidth. Choosing one is a real trade between size, speed, and how many assumptions you carry.
Grover halves their security; doubling output sizes or relying on existing margins restores it.
Classical Diffie-Hellman and ECDH die to Shor. The replacement is a post-quantum KEM (key-encapsulation mechanism) — a different primitive from signatures, requiring its own swap. A chain can be post-quantum in its signatures and still leak its encrypted contents if it skips this.
The hard limit no one escapes: coins locked to a legacy elliptic-curve address cannot be retrofitted to a post-quantum scheme. Cryptography can't reach back and re-secure a key that already exists. The only path is for owners to move their funds to new post-quantum addresses — a voluntary, multi-year migration that no protocol upgrade can perform on anyone's behalf. Any project claiming it will "make your existing coins quantum-safe" is automatically misrepresenting how this works.
The transparent base layer uses the same ECDSA signatures it has since launch, and those are not quantum-resistant. We're not going to hide that behind the privacy layer's strengths.
The direction is a base layer where the signature scheme is a parameter, not a constant — engineered so a post-quantum scheme can be switched on by a network upgrade rather than a second rewrite. The Rust reimplementation of the node is where that groundwork is already in place: versioned signatures, a reserved address format for post-quantum keys, and an activation mechanism that rides the same fork machinery that has shipped every prior upgrade.
We're deliberately not naming a specific scheme or a date here. The right choice depends on a size-and-bandwidth analysis we'd rather finish honestly than announce prematurely — and a post-quantum activation is a one-way, consensus-level change where getting it right matters more than getting it early. When it's real, it'll be on this page, mapped component by component, with the same honesty as everything above.
What we can commit to is the order: prove it, then encrypt it, then sign it — soundness first (done), confidentiality next, transparent-signature migration after, that last step following the Rust client proving itself on mainnet. And the part we can't do for you, because no one can: when post-quantum addresses arrive, moving your funds to them will be yours to initiate.