Mentioned in This Article
1. XRP Ledger quantum-resistant accounts: what the design does
The XRP Ledger Foundation has laid out a design that would let XRP Ledger account owners protect their funds against future quantum computers without paying higher transaction fees. Described in the Foundation's quantum study, which belongs to its 2027 protocol roadmap updated on November 4, it lets an owner add a quantum-resistant signing key and then switch off the original key. Ripple is targeting a full quantum transition by 2028.
The mechanism is deliberately simple from the user's point of view. An account holder registers a second key built on a post-quantum signature scheme. Once that key is active, the holder disables the key the account was created with. From that point, a transaction can be authorized only by the new key, so an attacker who has recovered the old one gains nothing.
The proposal is still a design rather than shipping software. It would arrive on the ledger as an amendment, which is the XRP Ledger's term for a protocol change that validators must approve before it takes effect. The roadmap treats this amendment as one item among many and attaches a review budget and a development estimate to it, details of which appear later in this article.
2. Why do quantum computers threaten crypto accounts?
Quantum computers threaten blockchain accounts because the signature systems used today rest on mathematical problems that a sufficiently powerful quantum machine could solve far faster than any conventional computer. Every time a user signs a transaction, the network sees a public key attached to it. A large enough quantum computer could, in principle, work backward from that public key to recover the secret that controls the account.
That exposure is not hypothetical for the XRP Ledger. Any account that has ever sent a payment has revealed its public key on the ledger. This includes every exchange wallet, since exchanges send funds out routinely. Accounts that have only received funds and never signed anything are in a somewhat different position, but the design addresses the broader population of accounts that have already spent.
No machine capable of this attack exists today, and the study does not claim otherwise. The reasoning behind acting early is practical. Changing the signature scheme of a live network that secures real balances takes years of design, testing, auditing and coordination among validators, developers, exchanges and wallet providers. Starting before the threat is imminent is the only way to finish before it arrives.
The same concern has surfaced across the industry. Bitcoin developers have debated their own approaches to quantum risk, and Ethereum researchers have discussed it as well. The XRP Ledger Foundation's contribution is a concrete account-level mechanism with a stated cost profile, rather than a general statement of intent.
It helps to separate two risks. One is the theft of funds from accounts whose public keys are already visible. The other is the loss of confidence that would follow if the industry were seen as unprepared. A published, costed plan addresses both, because it shows holders and institutions that a path to quantum resistance exists and has a budget attached to it.
3. How does the new key work, and which standard does it use?
The new key uses ML-DSA-44, a digital signature scheme that the US National Institute of Standards and Technology approved in 2024 as resistant to quantum attacks. Choosing a standardized scheme matters because it has been examined by cryptographers worldwide, which lowers the risk of an unexpected weakness appearing after deployment.
The trade-off with post-quantum signatures is size. A regular XRP Ledger payment carries a compact signature and key, and the whole payment comes to about 105 bytes in the comparison the Foundation uses. The quantum-resistant key and signature together total 3,732 bytes. That adds roughly 3.6 kilobytes to each protected transaction.
Once the transaction is stored along with its history and database overhead, the Foundation estimates 5,331 bytes of storage for each protected payment. A baseline payment, measured the same way, takes 1,704 bytes. In other words, a protected payment occupies roughly three times the storage of an ordinary one when all overhead is counted.
For readers unfamiliar with the process, the key swap itself is a two-step sequence. First, the owner adds the quantum-resistant key to the account. Second, once the owner is satisfied that the new key works, the owner turns off the old key. Keeping the steps separate lets a holder confirm the new setup before closing the original route, which reduces the chance of being locked out of an account.
Another point is that the scheme is added alongside the existing system rather than replacing it overnight. Accounts that never opt in keep working as they do now, which allows the network to move at the pace of its users instead of forcing a single cutover date. That gradual approach is common in protocol upgrades, since a forced switch would risk stranding wallets that have not been updated.
4. Will users pay more in fees?
Users will not pay more. The base transaction fee stays the same even though protected transactions are larger. This is the headline feature of the design and the reason the Foundation describes the upgrade as costing users nothing extra.
The added burden does not disappear, though. It moves. On the XRP Ledger, transaction fees are destroyed rather than paid to validators or other participants. Because no fee income flows to the people running the network, the operators who store and serve the ledger absorb the additional storage that larger transactions require.
That arrangement has consequences worth understanding. If many accounts adopt the new key and send frequent payments, the storage demands on servers rise. The study's own figures, roughly 5.3 kilobytes per protected payment against 1.7 kilobytes for a baseline one, give a sense of the scale per transaction, although the study does not publish what that means for total network load in aggregate.
Keeping fees flat also has a user-experience benefit. Wallets and exchanges would not need to explain a new fee tier, and payment flows that depend on predictable costs would not be disrupted. For businesses that move large volumes of XRP, a quantum-safe option that does not change their cost structure removes one obstacle to migration.
Storage costs matter in a different way for a ledger than for a single payment. Every full-history server must keep the data it is asked to hold, and larger records mean larger disks and more bandwidth for anyone syncing the chain. The Foundation's decision to publish per-payment byte counts lets operators estimate their own exposure, even without an aggregate forecast.
5. What work is still unfinished?
Several technical and testing items remain open. Developers are fixing a mismatch in which the Python prototype and the server and JavaScript implementations can generate different keys from the same seed. A seed is the short secret from which an account's keys are derived, so any disagreement between implementations is serious: a user could recover different accounts depending on which software they used.
Performance testing is also incomplete. Results showing how the network behaves when all validators verify the new signatures have not been published. Post-quantum signatures are larger and can take different amounts of time to verify than the current ones, so measuring validator behavior under realistic load is a necessary step before any amendment goes to a vote.
These gaps explain the cautious tone of the timeline. The proposal is mapped out, but the evidence needed to approve it is still being gathered. Readers should treat the 2028 target as a goal set by Ripple and the Foundation, not as a committed activation date.
The Foundation's own framing is that these are known problems with known fixes. Key derivation bugs are the kind of defect that a prototype stage is meant to expose, and publishing them openly gives outside developers a chance to review the work before an amendment is proposed to validators.
6. What does the quantum work cost?
The roadmap puts numbers on the effort. It allocates between $215,000 and $255,000 for review and auditing of this amendment, plus 640 hours of development. Audits are a large part of the figure because a change to how accounts are authorized touches the most security-sensitive part of the protocol.
This amendment is one of 24 on the 2027 roadmap. Across all 24, the budget runs from about $5 million to nearly $6 million. Against that total, the quantum-resistant account work is a modest share in dollar terms, though it is likely to be among the most consequential items for long-term security.
The figures also show how the Foundation approaches funding protocol work: each amendment is scoped, estimated in hours and priced for outside review before it proceeds. That structure gives the community a way to compare the cost of the quantum work with the cost of the other upgrades queued for the same period.
Readers comparing the cost with the potential downside may find the audit figure the most telling number. A quarter of a million dollars is small next to the value held on the ledger, yet the dependence on outside reviewers shows how seriously the roadmap treats any change to account authorization.
7. What comes next for the 2028 quantum transition?
The next milestone is a migration study scheduled for the first half of 2027. It is meant to work out how existing accounts, exchanges and wallet software would actually move to the new keys. Development and auditing of the amendment follow in late 2027 or 2028, which leaves the full transition to land around the 2028 target Ripple has set.
Before any of that reaches users, the amendment would still need to clear the XRP Ledger's validator approval process. Unresolved items, such as the key-generation mismatch and the missing validator performance results, would need to be closed first.
For holders, the practical takeaway is that no action is required today. The design is intended to give account owners a way to opt in to quantum resistance when it becomes available, using a standardized signature scheme and without a higher fee. Whether the timeline holds will depend on how the testing and audits turn out over the next two years.