Ripple has set 2028 as the target for full quantum resistance on the XRP Ledger. The migration’s main constraint is signature size, not cryptography selection. XRPL’s native key rotation remo
Ripple’s Senior Director of Engineering, Ayo Akinyele, has put technical detail behind a four-stage plan to make the XRP Ledger quantum-resistant by 2028, a roadmap first outlined in April 2026 and now moving through its testing phase with NIST-certified algorithms on Devnet. The work matters because the ledger’s account security rests on elliptic curve cryptography, the same math that secures Bitcoin and Ethereum, and because research published by Google’s Quantum AI team in March 2026 shortened the industry’s estimate of when that math stops holding. The company is not migrating a database. It is proposing to change the signature scheme underneath a live payment network that settles transactions in seconds, and it needs independent validators to vote the change in.
2026 ML-DSA and Dilithium tested on Devnet 2027 Hybrid signatures run in parallel 2028 Mainnet migration, amendment vote Any time Emergency hard shift on breakthroughPhase 1 of the roadmap is an audit, and the number that came out of it has been repeated widely: only 0.03% of all XRP sits in vulnerable dormant accounts. It is also a narrower statistic than it looks. That is a genuinely favourable starting position. The same Google paper that produced the qubit estimate also counted Bitcoin’s exposure and found roughly 6.9 million BTC, about 32% of supply, sitting in wallets with public keys already visible on chain, much of it in early P2PK outputs from the 2009 to 2011 period whose keys have been in the open for over fifteen years.
A public key becomes exposed the moment an account signs its first outgoing transaction. Dormancy is only one route to exposure, and arguably the least urgent one, because dormant funds are not moving and their owners may be unreachable. Every active account on the ledger has broadcast its public key too. What protects those accounts today is not secrecy but the assumption that nobody can derive a private key from a public one in useful time. Google’s researchers put a figure on how much hardware that would take: roughly 500,000 physical qubits, at which point the derivation takes around nine minutes rather than geological time.
So the audit’s real output is not reassurance. It is a triage list, separating accounts that can be rotated by their owners from accounts that will need protocol-level intervention because nobody is left to rotate them.
ML-DSA, the standardised form of Dilithium, is what Ripple is testing on Devnet in partnership with Project Eleven. The algorithm choice is close to settled across the industry. The cost is bytes.
Post-quantum signatures are substantially larger than the secp256k1 or Ed25519 signatures the XRPL uses now, and on a ledger designed around small, fast, cheap transactions, that lands on several systems at once. Every validator relays every transaction, so payload growth translates directly into bandwidth. Ledger history grows faster, which raises the storage cost of running full history nodes and pushes more operators toward pruning. Transaction size feeds the fee calculation, and the XRPL’s reserve requirements exist precisely to price the cost of state that validators must keep forever.
Phase 2 exists to find out how much of that cost the architecture can absorb before it changes the ledger’s economics for ordinary users. That is a product question dressed as a cryptography question, and it is the reason the timeline stretches to 2028 rather than 2027. Phase 3 then runs the classical and quantum-safe schemes in parallel before anything touches mainnet, which is where integrators feel the change first.
Akinyele has pointed to native key rotation as XRPL’s structural head start, and the claim survives scrutiny.
On the XRP Ledger, an account address and its signing key are separate objects. An account can replace its master key with a regular key, or disable the master key entirely, while keeping the same address, the same trust lines, the same balances and the same history. Apply that to a post-quantum migration and the user-facing action becomes a single transaction. No new address. No re-onboarding with every exchange, custodian and counterparty that has the old one on file.
Compare that with Bitcoin. UTXO-based ownership binds coins to specific script conditions, so migrating to a new signature scheme means spending every output into new ones, and the consensus change itself requires a fork process with no equivalent of XRPL’s amendment voting. Ethereum sits somewhere in between, with account abstraction giving smart contract wallets a path that externally owned accounts do not have.
NetworkUser-side migrationActivation mechanismXRPLKey rotation, address unchangedValidator vote on amendmentsBitcoinSpend every UTXO to new script typeSoft or hard fork, broad coordinationEthereumContract wallets easier, EOAs harderScheduled protocol upgradeThe caveat is that key rotation solves the mechanics for accounts with an attentive owner. It does nothing for the abandoned ones, which is why the contingency track leans on zero-knowledge proofs to let holders establish ownership and recover funds after public-key access is switched off.
The hard shift is the most consequential piece of the plan and the least discussed. If an adversary reaches cryptographically relevant quantum capability ahead of schedule, the response deactivates public-key account access across the network and forces migration to pre-established quantum-safe accounts.
That is an emergency power over a decentralised ledger. Ripple writes the code; validators decide whether to run it. Deciding when the trigger has been met is harder still, because a state actor with a breakthrough has every reason to keep it quiet, and the first public evidence of quantum key derivation would likely be funds already moving. Networks that wait for proof act late by construction.
Two arguments are driving the timeline compression. The first is harvest now, decrypt later: adversaries copy encrypted data today and hold it until hardware catches up. Blockchain data is a natural target because it is public by design, permanent, and tied to assets that will still have value in a decade.
The second is that AI systems are now finding attacks on the post-quantum candidates themselves. In July 2026, Anthropic published a key-recovery attack against HAWK, a lattice-based signature scheme still standing in NIST’s additional-signatures round, found by its Claude Mythos Preview model over roughly 60 hours of work. For the smallest HAWK-256 parameter set, expected attack cost fell from about 2^64 operations to about 2^38, a reduction of roughly 67 million times. HAWK is not deployed anywhere and the finding touches no production system, but the repair is instructive: fixing it means roughly doubling HAWK’s key size, which strips out the compactness that made it attractive in the first place. A scheme can survive two rounds of expert review and still lose its main advantage in a week.
For exchanges, custodians and payment providers building on the XRPL, Phase 3 is the deadline that matters more than Phase 4. Hybrid operation means signature verification logic has to handle two schemes at once, and any integration that hardcodes signature length or key format will break. That work needs scheduling in 2027 budgets.
For validator operators, the relevant planning number is bandwidth and storage headroom under larger payloads, which Phase 2 should quantify during 2026.
For holders, the practical exposure is concentrated in cold storage and paper wallets set up years ago and never touched since, precisely the accounts least likely to perform a rotation transaction when the amendment activates. Ripple has also tied the push to a commercial argument worth watching: autonomous AI agents executing payments without human confirmation need settlement rails that cannot be compromised, and institutions evaluating those rails have begun asking about quantum roadmaps during procurement rather than after it.
The post XRPL Post-Quantum Roadmap Runs Into a Size Problem appeared first on ETHNews.
