Is HBAR quantum resistant?

Two quantum algorithms matter for cryptocurrencies. Shor's algorithm would let a large, fault tolerant quantum computer work out a private key from its public key. That breaks RSA, ECDSA and Ed25519, the signature schemes behind nearly every wallet in use today.

Grover's algorithm speeds up brute force search. Against a hash function it roughly halves the security level in bits. It weakens hashes; it does not break them, so a hash with a large output keeps a wide margin.

No quantum computer has yet run Shor's algorithm at the scale needed to break these keys. Standards bodies plan for one anyway. In a transition plan that is still a draft, the US National Institute of Standards and Technology (NIST) proposes deprecating the weakest RSA and elliptic curve signatures after 2030 and disallowing all of them after 2035. Read NIST's draft transition plan.

Layer	What Hedera uses	Quantum outlook
Record stream and event hashing	SHA-384	Strong. Grover leaves about 192 bits of security.
Consensus topic running hashes	SHA-384	Strong, for the same reason.
Consensus ordering	Hashgraph gossip and virtual voting	No mining race to speed up. Safety rests on node signatures.
Node event signatures	RSA-3072	Breakable by a future large quantum computer. Hybrid post-quantum signing is on Hedera's roadmap.
Node to node encryption	TLS with AES-256 and an elliptic curve key exchange	AES-256 holds. The key exchange is the first layer Hedera plans to upgrade.
Account signatures	Ed25519 or ECDSA secp256k1	Breakable by a future large quantum computer, as on Bitcoin and Ethereum.
Account identity	Account ID such as 0.0.12345	Not derived from the key, so the key can be replaced in place.

A check marks a layer that holds today; a stopwatch marks one Hedera plans to upgrade. The table is the whole story in brief: hashing and symmetric encryption are ready, public key signatures and key exchange are the layers to upgrade, and Hedera's account model makes the account side of that upgrade simpler than it is on most chains. Hedera says the same of itself: SHA-384 and AES-256 are already post-quantum primitives, its signatures are not yet.

Hedera hashes consensus events with SHA-384 and links its record files and consensus topic messages with SHA-384 running hashes. Changing any past transaction would change every hash after it, which is how a mirror node or an auditor can prove the history is intact.

SHA-384 produces a 384 bit output. Even with Grover's speedup, finding an input that matches a given hash would take on the order of 2^192 operations, far beyond any computer, classical or quantum. Bitcoin and Ethereum use 256 bit hashes, which also remain strong; SHA-384 simply keeps a larger margin.

The choice was deliberate. HIP-1424, approved in 2026, fixes SHA-384 as the hash for Hedera's blocks and state, and says it was chosen so the network's hashing would be post quantum.

Proof of work chains secure their history with a race to solve hash puzzles. Hashgraph works differently: nodes gossip transactions and a record of who heard what from whom, then compute the order by virtual voting on that shared history. No puzzles are solved and no energy race is involved.

The algorithm is asynchronous Byzantine fault tolerant, and that property has been checked with a machine verified proof. Its guarantees hold as long as more than two thirds of the stake is honest and node signatures cannot be forged. Every event a node gossips is signed and hash linked, which is why signatures, not the consensus logic, are the part a post-quantum upgrade has to address.

On Bitcoin and Ethereum, an address is derived from a public key. An ordinary Ethereum account cannot change its key at all, and its public key can be recovered from any transaction it has signed. Most Bitcoin addresses hide the key until the coins are spent, but reused addresses and Taproot outputs reveal it. Moving to a quantum safe key means moving every coin and token to a new address, one holding at a time, and anything left behind stays exposed.

On Hedera, an account is a ledger entry such as 0.0.12345 with a key attached. An account update transaction, signed by both the current key and the new one, replaces that key. The account ID, the HBAR balance, the NFTs, the token associations and the allowances all stay where they are. How to change a Hedera account key walks through it.

In August 2024 NIST published its first post-quantum standards: FIPS 203 (ML-KEM) for key exchange, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for digital signatures. A fourth, FN-DSA (the Falcon algorithm), is being standardized as FIPS 206. NIST had not published it as final by October 2026, and Hedera expects the final standard around early 2027.

Size is the practical trade-off. An Ed25519 signature is 64 bytes. Hedera's plan uses FN-DSA-1024, with signatures of 1,280 bytes; ML-DSA at the same security level (ML-DSA-87) needs 4,627 bytes. A network that moves thousands of transactions per second has good reason to prefer the smaller one, and Hedera says it will raise its maximum transaction size to fit them.

In April 2026 Hedera published a staged plan along those lines. It starts with the connections that carry data today, then moves to the signatures:

1. Post-quantum TLS between consensus nodes, once Hedera's TLS libraries support it. Consensus security does not depend on TLS, so this protects data in transit.
2. Post-quantum TLS for connections from applications and wallets.
3. Hybrid signing of consensus events, pairing a classical signature with FN-DSA once the FIPS 206 draft is out, then FN-DSA alone once the standard is final.
4. A new post-quantum key type for user accounts, targeted for 2027. It uses FN-DSA, or ML-DSA if FIPS 206 is delayed.

Existing Ed25519 and ECDSA keys keep working throughout, and each account opts in when it is ready. Wallets will need an update before their users can rotate to the new key type. Read Hedera's plan.

Network changes are proposed and discussed in public as Hedera Improvement Proposals. As of October 8, 2026 no post-quantum key type has been accepted there, so that is the place to watch.

• Keep your recovery phrase and private keys offline and private. Quantum or not, a leaked key is the most common way accounts are emptied.
• Protect large holdings with a threshold key, such as two of three keys, so one exposed key is not enough to move funds.
• If you think a key was exposed, replace it with an account update, then remove any allowances you did not give, since a key change does not cancel them. Your account ID and your NFTs stay the same. Here is how.
• When your wallet supports a post-quantum key type, rotate to it. On Hedera that is one update per account, not a migration.

Is Hedera quantum proof?

No network is quantum proof today. Hedera's hashing is already quantum resistant, its signatures are not yet, and its account model lets every account switch keys without moving assets once a post-quantum key type is available.

When will Hedera have post-quantum account keys?

Hedera targets 2027 for a post-quantum key type for user accounts, based on FN-DSA once NIST finalizes FIPS 206, or on ML-DSA if that standard is delayed. Until then, Ed25519 and ECDSA keys keep working.

Can a quantum computer steal HBAR today?

No. No quantum computer today can derive an Ed25519 or ECDSA private key from a public key. The risk is a future machine, which is why the upgrade path matters now.

What cryptography does Hedera use?

SHA-384 for hashing events, records and consensus topics; Ed25519 or ECDSA secp256k1 for account signatures; RSA-3072 for the signatures nodes put on consensus events; and TLS with AES-256 between nodes. Accounts can also use key lists and threshold keys that combine several keys.

Do I need to move my NFTs to stay safe?

No. On Hedera your NFTs stay in your account when you change its key. Are NFTs safe from quantum computers? covers the artwork, the metadata and the royalties as well.