There are two ways to assess blockchain quantum exposure. The technical approach scans at the protocol layer. signature schemes, wallet types, address formats, and network-level cryptographic dependencies. The strategic approach asks a different set of questions: how dependent is your organisation on quantum-vulnerable blockchain infrastructure, how well-managed are the private keys that would need to migrate, what is your on-chain HNDL exposure, and do you have any influence over the PQC migration timeline of the chains you depend on? The Blockchain Quantum Exposure Scanner covers the technical layer. This assessment covers the strategic layer. the questions a CTO or CISO needs answered before making decisions about blockchain infrastructure investment. Assess your blockchain's quantum exposure
What the Blockchain Quantum Exposure Assessment Covers
The assessment evaluates four exposure dimensions that a protocol-level technical scan does not reach:
Cryptographic dependency mapping
What cryptographic algorithms underpin the blockchain infrastructure your organisation uses or builds on? ECDSA (Elliptic Curve Digital Signature Algorithm) is the dominant signature scheme across Bitcoin, Ethereum, and most EVM-compatible chains. it is the algorithm used to sign transactions and prove ownership of addresses. ECDSA on the secp256k1 curve is broken by Shor's algorithm on a sufficiently large cryptographically relevant quantum computer. This dimension of the assessment asks how deeply your organisation depends on this specific vulnerability and through which channels.
Note: Ethereum's validator layer uses BLS12-381 signatures for validator operations, which is a different scheme from the ECDSA used for user-facing account transactions. The ECDSA dependency applies primarily to externally owned accounts and transaction signing, which is where most enterprise and institutional exposure sits.
Key management practices
How are the private keys underpinning your blockchain operations generated, stored, and managed? Cold storage, hardware security module management, software wallet management, and custodian-managed arrangements each carry different migration complexity. Key management practices determine whether a PQC migration is a software configuration change or a full key ceremony re-run across your organisation. with all the operational and governance overhead that implies.
HNDL exposure
Is your organisation writing data to a blockchain that will remain sensitive for 10 or more years? On-chain data is permanent. public blockchains maintain an immutable ledger, and data written to the chain cannot be deleted or re-encrypted by the original party. This is precisely what makes on-chain long-lived blockchain data different from traditional data storage. If adversaries are recording blockchain state now and hold it until a CRQC arrives, they will be able to decrypt transaction records, smart contract states, and identity records that are permanently visible on the ledger. The on-chain HNDL risk is not theoretical.
Governance and vendor dependency
If your organisation depends on a public blockchain, the PQC migration timeline for that chain is not within your control. It is within the control of the chain's core development team, its validator or miner community, and its governance process. Does your organisation have a position in the governance bodies of the chains you depend on? Have you reviewed the published PQC roadmap for those chains. and if no such roadmap exists, have you treated its absence as a risk signal?
The assessment scores each dimension and produces an aggregate blockchain quantum exposure rating.
Why Blockchain Quantum Risk Is a Strategic Issue, Not Just a Technical One
The technically accurate answer to "is blockchain quantum-safe?" is: mostly no, at the cryptographic layer, but the timeline and path to quantum safety varies substantially by chain type and governance structure. That answer does not help a CTO decide whether to continue building on a specific public chain or whether to include blockchain infrastructure in their organisation's PQC migration programme.
For enterprise organisations using blockchain for financial infrastructure, supply chain integrity, or identity: the relevant question is not "is this chain vulnerable" but "does this chain have a credible PQC migration roadmap, and does our dependency on it create a risk we cannot manage?" The HNDL risk is particularly acute here. financial transaction records written to a blockchain today may carry a confidentiality requirement that outlasts the current cryptographic security of the chain they are recorded on.
For organisations building on public blockchain infrastructure: they have no unilateral control over the PQC migration of the underlying chain. A major public blockchain migrating to quantum-safe cryptography requires coordination across thousands of validators, wallet providers, exchanges, and developers. The timeline for that is not comparable to an enterprise IT migration timeline, and the risk of delay is entirely outside the dependent organisation's control. Understanding that dependency exposure is what this dimension of the assessment measures.
The underappreciated risk in blockchain quantum security is governance dependency. Most discussions focus on the algorithm layer. ECDSA is broken by Shor's algorithm, therefore blockchain is vulnerable. What they miss is that for organisations dependent on public chains, the real question is whether those chains have credible, coordinated migration plans, and what happens to the organisations that depend on them if those plans fall behind. A technical scan will tell you the algorithm is vulnerable. A strategic assessment tells you whether you are exposed to someone else's migration timeline.
Our tools are designed as directional tools only. Advice and standards are changing rapidly and although we update tools as new information is periodically released they are not designed as a replacement for expert advice. If your organisation results show high-priority exposure the next step is to contact our team or speak to a qualified expert member.
How to Complete the Blockchain Quantum Exposure Assessment
Step 1. Open the assessment. No registration required.
Step 2. Identify the blockchain(s) your organisation uses or depends on and their primary signature scheme. For most EVM-compatible chains (Ethereum, Polygon, BNB Chain, and others), the answer for transaction signing is ECDSA on secp256k1. For Bitcoin legacy addresses, ECDSA on secp256k1. Confirm the signature scheme in use. do not assume. Select the identified scheme in the tool.
Step 3. Rate your key management practices. Select the category that best describes how your organisation manages the private keys used for blockchain transactions: cold storage, hardware security module (HSM) managed, software wallet, or custodian-managed. If you use multiple approaches for different asset types, select the one that covers your highest-value keys.
Step 4. Estimate your on-chain data longevity. The tool asks: how long will records you are writing to the blockchain remain sensitive? This question applies to transaction records, smart contract states, and identity data recorded on-chain. If your blockchain use cases involve permanent public-key records or identity anchors, these may carry indefinite longevity requirements.
Step 5. Assess your governance position. Answer whether your organisation participates in the governance of the chain(s) you depend on, and whether you have reviewed each chain's published PQC migration roadmap. If no roadmap exists, mark it as absent. the tool will flag this as a risk finding.
Step 6. Review the exposure score by dimension. Each of the four dimensions receives a score. Review where your exposure concentrates.
Step 7. Review the aggregate score and priority recommendations. The aggregate score provides an overall blockchain quantum exposure rating and identifies which dimensions require the most immediate attention.
How to Use Your Blockchain Quantum Exposure Results
The output is a strategic exposure profile, not a technical remediation checklist. The actions it points to are governance and planning decisions, not algorithm migrations.
High score on cryptographic dependency: your organisation is deeply dependent on quantum-vulnerable algorithms across its blockchain operations and has limited direct control over migration. Begin contingency planning for the scenario where the chains you depend on migrate on a timeline that does not align with your risk requirements. Engage with chain governance bodies where you have that capacity.
High score on HNDL exposure: if you are writing long-lived sensitive data to a quantum-vulnerable blockchain, assess whether on-chain storage is the appropriate architecture for this data category. For data with 10+ year confidentiality requirements, on-chain permanence may be a liability rather than a feature.
High score on governance dependency: your quantum risk timeline is determined by a third party whose governance process you may have limited influence over. Map your exposure to each chain's published PQC roadmap. Where no roadmap exists, treat that absence as a risk signal for dependency management.
Low scores across all dimensions: confirm this reflects genuine position rather than missing information. The assessment is only as accurate as the inputs. A low governance dependency score requires that you have actually reviewed the chain's PQC roadmap. not that you have assumed one exists.
For the technical layer. signature schemes, wallet address formats, and protocol-level vulnerabilities. the Blockchain Quantum Exposure Scanner provides the protocol-level detail. For organisations that want to model the effort required to migrate their blockchain infrastructure to PQC standards, the Blockchain PQC Migration Effort Estimator provides that analysis.
Discuss your results with a QSECDEF expert member. A directional assessment is the starting point, not the programme. If your results show high-priority exposure, the next step is a discussion about a structured migration programme with defined milestones. Request a consultation with our team or find a qualified expert member.
