Post-Quantum Security for Ethereum Wallets

Key Takeaways:

• RSA-896, a 270-digit number, was factored on September 19, 2026 by Anthropic engineer Stephen Weis using Claude and up to 2,048 GPUs, sixteen days after RSA-260 fell. Both used classical number field sieve factoring, not quantum hardware.
• Ethereum accounts sign with ECDSA over secp256k1. RSA and elliptic curve cryptography rely on different mathematical problems, so factoring RSA-896 does not weaken Ethereum’s curve directly; it shortens the assumed time available to migrate.
• The Ethereum Foundation targets December 2029 for base-layer quantum resistance, with Hegotá as a critical milestone and roughly five forks after Glamsterdam at about 7.2 months per fork.
• Account abstraction through EIP-8141 Frame Transactions gives accounts signature flexibility, letting users move off secp256k1 without a protocol-wide flag day.
• Layer-2 chains add their own exposure. A rollup can verify final proofs with elliptic curve pairings, and app-layer ERC-4337 wallets are not a protocol migration.

The Quantum Threat Landscape After RSA-896

On September 19, 2026, Anthropic engineer Stephen Weis announced he had factored RSA-896, a 270-digit challenge number, using Claude to port the CADO-NFS factoring software to graphics processors and coordinate up to 2,048 idle GPUs, as reported by Startup Fortune. It was the second AI-assisted factoring record in sixteen days, following RSA-260 on September 3.

The result did not compromise any deployed key. RSA-2048, the size behind most TLS certificates and banking infrastructure, is roughly 309 decimal digits, and the cost of the general number field sieve increases sharply with digit count rather than linearly. The practical implication is narrower: RSA-1024 now falls within reach of a well-funded organization with a data-center GPU fleet. For blockchains, that adds time pressure rather than a new break.

The relevance to Ethereum lies in timing, not the math. RSA and Ethereum’s secp256k1 curve rely on different hard problems, so factoring RSA-896 does not weaken an Ethereum key. Both problems can be solved by a sufficiently capable quantum computer running Shor’s algorithm, and every 2026 update to the resource estimates for that machine has lowered the required resources. As we explained in our analysis of Bitcoin’s on-chain public key exposure, the main constraint is not the cryptography but the coordination time needed to move assets.

Ethereum’s Post-Quantum Roadmap: Deadlines and Goals

The Ethereum Foundation’s protocol team set December 2029 as its target for quantum resistance across the execution, consensus, and data layers, according to the Foundation’s September 2026 update covered by Blockchain.News. The plan schedules full readiness roughly five hard forks after Glamsterdam, requiring an average interval of about 7.2 months per fork. A contingency path offers a minimum viable post-quantum state earlier at a slower pace with reduced guarantees.

Glamsterdam targets December 2026 and precedes the fork sequence toward 2029. Hegotá is the next upgrade and the first real test. Its two main proposals are EIP-7805, fork-choice enforced inclusion lists, and EIP-8141, Frame Transactions. The Foundation has stated that the schedule is ambitious and that fork ordering may change as research progresses.

The consensus layer illustrates why this is difficult. Replacing BLS signatures with leanXMSS, a hash-based scheme, is straightforward in principle, but hash-based signatures run roughly 3,000 bytes compared to 96 bytes for BLS. The leanVM zero-knowledge virtual machine aggregates and compresses those signatures by about 250 times. Ethereum is rebuilding the infrastructure around the signature, not just swapping a library.

Ethereum’s secp256k1 Key Reliance and Migration Paths

Every standard Ethereum account, an externally owned account, uses ECDSA over the secp256k1 curve to sign transactions. A standard account’s public key is exposed the moment it sends its first transaction, because the network must verify the signature against that key. Accounts that have only received ether and never sent a transaction expose only an address, which is a hash of the public key. That is a meaningful but temporary advantage, and it does not survive the first spend.

The Ethereum post-quantum roadmap identifies four vulnerable surfaces. Consensus-layer BLS signatures secure validator votes. KZG polynomial commitments secure data availability for rollups. ECDSA account signatures secure ordinary accounts. Zero-knowledge proof systems used by rollups rely on elliptic curve pairings. Each has a different solution path, which is why the transition is a multi-layer program rather than a single signature swap.

For account keys specifically, Ethereum plans to enable a transition to quantum-resistant schemes through account abstraction rather than a forced protocol-wide replacement. The Foundation’s guidance is that wallet software will guide users through migration once post-quantum signature schemes are widely supported, expected after the Hegotá hard fork. Users who want protection early can adopt it voluntarily, while the broader migration happens over time.

Account Abstraction as a Migration Tool

The practical part of the plan is account abstraction migration through EIP-8141. Instead of one protocol-wide switch, Frame Transactions split a transaction into programmable frames, allowing an account to define its own validation logic. That provides signature flexibility: an account can adopt a post-quantum scheme without waiting for the base layer to change first, which removes the need for a disruptive flag day.

Frame Transactions were scheduled for the Hegotá upgrade and remain a draft proposal. Developers committed to the frame model in August 2026, but the Ethereum and Base teams ended an effort to merge their account abstraction designs, leaving EIP-8141 on the L1 side and EIP-8130 on Base, as CryptoBriefing reported. Smart wallets may need to support two transaction formats during the transition, which adds real integration cost.

The key distinction for risk is between app-layer wallets and protocol migration. ERC-4337, the earlier account abstraction standard, works without changing the core protocol. A post-quantum wallet built on top of ERC-4337 does not change the underlying chain, and it inherits whatever the base layer does. Only protocol-level account abstraction lets a signature change take effect for the account itself, which is why app-layer support is a stopgap rather than a migration.

Layer-2 Post-Quantum Considerations

Rollups inherit Ethereum’s settlement security but add their own cryptographic choices, and those choices are often the more exposed ones. The Quantum Tracker audit of X Layer illustrates this pattern. X Layer generates its execution proofs as eSTARK proofs, which are hash-based and considered quantum-resistant, but compresses them into a final FFLONK SNARK verified on Ethereum.

FFLONK is a KZG-style SNARK over BN254 elliptic curve pairings, which Shor’s algorithm can break. The quantum-resistant inner proof provides no protection while the outer wrapper that Ethereum verifies remains elliptic-curve based. This pattern recurs across the rollup category, so a chain can appear modern while its L1 verification bottleneck remains vulnerable.

Admin keys add to the problem. The upgrade authority over many Layer 2 bridge and rollup contracts is held through elliptic-curve keys that Ethereum’s own migration plan does not cover. Centralized sequencers signing batches with secp256k1 keys carry the same exposure. The June 2026 Taiko bridge exploit, where an attacker forged cross-chain proofs to steal about $1.7 million according to CoinDesk, shows cross-chain verification is already a live attack surface; quantum exposure increases the risk.

GLAMERSTADAM, Hegotá, and the Transition Standards

GLAMERSTADAM and Hegotá are the fork milestones that carry the transition. Glamsterdam targets December 2026, and Hegotá follows with the account abstraction work that enables signature flexibility. The Ethereum Foundation’s protocol cluster has ranked 62 EIPs proposed for Hegotá, with EIP-7805 and EIP-8141 as the two main proposals that must work together. Testing the interaction between inclusion lists and the new transaction model is the fork’s central engineering focus.

Comparing the two forks clarifies what each contributes. Glamsterdam is the starting point; Hegotá is where account-level cryptographic flexibility becomes real. The table below summarizes the difference.

Interoperability depends on standards. NIST finalized its first three post-quantum standards in August 2024: ML-KEM for key encapsulation, ML-DSA for signatures, and SLH-DSA as a hash-based backup. Ethereum’s work builds on those rather than creating new primitives, which lets wallets and Layer 2 teams reuse vetted implementations. NIST expects to deprecate ECDSA by 2030, which sets the outer bound for the secp256k1 transition.

Practical Steps for Users and Developers

You can start moving before the later parts publish. These steps apply whether you hold ether in a wallet or build on top of Ethereum.

• Separate the two threats in your risk register. RSA factoring does not weaken secp256k1, so the September records are a scheduling signal, not an incident response.
• Inventory how much value sits in accounts whose public key is already on-chain, meaning any account that has ever sent a transaction. Those are the harvest-now, decrypt-later cohort.
• Avoid address reuse on holdings you control. Note that Project Eleven’s Quantum Threat to Blockchains 2026 Report places its baseline Q-Day scenario at 2033, with a pessimistic case at 2042 and an optimistic case at 2030.
• Track Glamsterdam and Hegotá timelines, but treat published dates as planning milestones. The Foundation itself allows for contingency forks and changing order.
• If you build smart wallets, support both EIP-8141 and EIP-8130 transaction formats, since the L1 and L2 account abstraction designs diverged.
• For each Layer 2 you use, ask what proof system verifies on Ethereum. Where the final proof uses elliptic curve pairings, a post-quantum migration plan is usually absent.
• Check whether bridge and rollup admin keys are elliptic-curve based and whether they sit outside any documented migration scope. They usually do.
• Follow GLAMERSTADAM and Hegotá standards work rather than waiting for a final deadline. NIST expects to deprecate ECDSA by 2030, which sets the outer bound.

RSA-896 does not break Ethereum tomorrow. It shortens a clock that was already running, on a network that has published a 2029 target and a credible, though demanding, path to reach it. Part 4 of this series covers Solana, where early use of Ed25519 and a Falcon-512 test implementation in its validator clients provide a different migration approach.

Related Reading

More in-depth coverage from this blog on closely related topics:

• Post-Quantum Security for Blockchain Systems
• SSH Key Management Strategies for Security
• Bitcoin Public Key Exposure and Risks

Sources and References

Sources cited while researching and writing this article:

• AI agents just broke two RSA factoring records in sixteen days
• Ethereum Foundation Targets Post-Quantum L1 by 2029
• Post-quantum cryptography on Ethereum | ethereum.org
• X Layer , Quantum Exposure Report | Quantum Tracker
• Taiko halts its Ethereum layer 2 network after a bridge exploit, token dives 10%Taiko halts its Ethereum layer 2 network after a bridge exploit, token dives 10%
• Quantum Threat to Blockchains 2026 Report