Chain profile
The only chain in the index where a post-quantum signature is mandatory for every account on mainnet, and has been since 2018.
Yes. The Quantum Resistant Ledger is post-quantum secure at mainnet today. Every QRL account is protected by XMSS, a hash-based signature scheme that is not broken by Shor's algorithm and that NIST approved for use in SP 800-208. There is no quantum-vulnerable elliptic-curve fallback on the network, and there never has been: QRL launched with XMSS in June 2018 rather than retrofitting it later. The trade-offs are real and worth stating plainly: XMSS is a stateful scheme, so reusing a one-time signature key can expose funds and users depend on wallet software to manage that state correctly, and QRL is a very small network by liquidity, developer activity and validator count compared with the chains below it in this index. QRL scores highest here because the index measures quantum readiness, not size, adoption or investment merit.
Where we are making a judgement call QRL ranks first on quantum readiness and nothing else. It is a small network by liquidity, ecosystem and developer activity, and this index does not measure those things. A high Hardy Score is not a statement that a chain is a good asset, a good platform or a good investment.
XMSS (stateful hash-based), mandatory for all accounts
XMSS today; ML-DSA-87 in QRL 2.0 (Project Zond), with SPHINCS+ signalled post-mainnet
NIST SP 800-208 (XMSS) today; FIPS 204 (ML-DSA) in QRL 2.0
Tier 1: Native. Post-quantum secure at mainnet today, with quantum-resistant signatures built in from genesis.
| No. | Dimension | Score | Weight | Contribution |
|---|---|---|---|---|
| 1 | Signature scheme | 10 | 30% | 30.0 |
| 2 | Deployment stage | 10 | 25% | 25.0 |
| 3 | NIST alignment | 9 | 15% | 13.5 |
| 4 | Migration path | 7 | 15% | 10.5 |
| 5 | Exposure | 9 | 10% | 9.0 |
| 6 | Verification | 8 | 5% | 4.0 |
| Hardy Score | 92.0 | |||
XMSS is the mandatory signature scheme for all accounts on the QRL mainnet that launched in June 2018. There is no elliptic-curve alternative on the network, so no account can opt back into a quantum-vulnerable scheme. source
Tier 1: Native. Post-quantum signatures have protected every unit of supply since genesis, which is the only case in this index where nothing needs to be migrated to reach quantum safety. source
XMSS is approved by NIST in SP 800-208, which supplements FIPS 186 to permit XMSS and LMS. It is a full approval rather than a candidate status, but NIST restricts stateful schemes to controlled applications, which is why this is not a 10. QRL 2.0 moves to ML-DSA-87 under FIPS 204. source
QRL holders have no quantum migration to make, because their keys were never elliptic-curve. The deduction is for the separate QRL 1 to QRL 2.0 chain migration, which remains ahead of the network: Zond has been on testnet since 2024 and its mainnet date is contingent on audit completion. source
No QRL public key is a quantum liability, because XMSS security does not rest on the discrete logarithm problem. The one point deducted reflects XMSS's operational hazard: signing twice from the same one-time key leaks private key material, so exposure risk here is a wallet-state problem rather than a cryptographic one. source
QRL is open source and has run XMSS in production on a public mainnet for over eight years, which is the strongest form of verification available: the claim is checkable on-chain. QRL 2.0 is undergoing external audits that had not concluded at the time of writing. source
The deployment dimension is not a separate judgement. It is Tier 1 expressed as a number. See the tier mapping.
QRL mainnet launches with XMSS as the mandatory signature scheme for every account. source
QRL 2.0 (Project Zond) beta-testnet launches, moving the chain toward proof of stake and ML-DSA. source
Zond Testnet V1 goes live. source
Zond Testnet V2 launches as the audit-ready public testnet, using NIST-standardised ML-DSA-87. source
QRL 2.0 mainnet launch, explicitly contingent on audit outcomes and network stability rather than a fixed date. source
Exposure measures how much of the chain's value already sits behind a public key that an attacker can record today and break later. This is the part of the threat that a future upgrade cannot undo.
QRL has no harvest-now-decrypt-later exposure in the usual sense. Because XMSS security rests on hash function preimage resistance rather than the discrete logarithm problem, an attacker who records every QRL public key today gains nothing from a future quantum computer. The residual risk is operational: XMSS is stateful and each one-time signature key must be used exactly once, so a wallet that loses or mismanages its signing state can expose a key through reuse rather than through cryptanalysis.
What this rating means for you
QRL already runs post-quantum signatures for every account on mainnet, so there is no migration for you to make here. The habits that still matter are address hygiene and keeping your own keys.
Editorial guidance from the Hardy Index. Nothing on this profile is sponsored and nothing on it is an affiliate link. The guides carry disclosed affiliate links, which never affect a rating. How we make money.
Yes, on the measure this index uses. QRL's mainnet has required XMSS hash-based signatures for every account since June 2018, and XMSS is not broken by Shor's algorithm. QRL is the only chain in this index with no quantum-vulnerable signature scheme available on mainnet at all.
XMSS is the eXtended Merkle Signature Scheme, a hash-based signature system specified in RFC 8391 and approved by NIST in SP 800-208. Its security rests on the difficulty of finding hash preimages rather than on the elliptic-curve discrete logarithm problem, and Shor's algorithm only breaks the latter. Grover's algorithm weakens hash functions, but only quadratically, which the parameter sets already account for.
XMSS is stateful. Each signing key may be used exactly once, and the wallet must reliably track which keys have been consumed. If the same one-time key signs twice, an attacker can recover private key material without any quantum computer at all. NIST flags this in SP 800-208, which is why it restricts stateful hash-based schemes to applications where key use can be carefully controlled.
No. QRL 2.0, also called Project Zond, is on a public testnet. Testnet V2 launched in Q1 2026 as the audit-ready release, using NIST-standardised ML-DSA-87. QRL has not published a fixed mainnet date and states that launch depends on audit outcomes and network stability. The original XMSS mainnet continues to run.
No. The Hardy Score measures quantum readiness only. It says nothing about liquidity, adoption, developer activity, security outside the quantum question, or price. QRL scores highest in this index because it deployed post-quantum signatures first and made them mandatory, which is exactly the one thing this benchmark measures.
This is a security-readiness assessment, not investment advice.