MultiversX Quantum Upgrade: Post-Quantum Accounts Explained
MultiversX quantum plan explained: post-quantum keys with the same address and 24 words, ML-DSA first, ZK seed proofs for late movers, and what holders should do now.
MultiversX is designing a way for existing accounts to switch from today's Ed25519 signatures to a post-quantum signature scheme while keeping the same address, the same assets and, for most users, the same 24-word recovery phrase. The plan was published on 29 October 2026 in an article on the MultiversX X account, "MultiversX Accounts Unlock Post-Quantum Security Foundations." It is research with draft specifications and Rust prototypes. No activation date has been set, and holders have nothing to do yet.
Why quantum computers threaten Ed25519
Every MultiversX transaction is signed with the sender's private key using Ed25519, an elliptic-curve signature scheme (MultiversX docs). The security of elliptic-curve keys rests on a math problem that ordinary computers can't solve in any useful time. A large enough quantum computer running Shor's algorithm could solve it, which would let an attacker work out a private key from a public key and sign transactions as the owner.
No such machine exists today, and estimates of when one might arrive vary widely. Preparing early is practical, because changing how every account on a network signs transactions takes years of wallet, custody and protocol work, and the switch has to happen while the old signatures are still safe enough to approve the new keys.
Post-quantum signatures use different math (for the two schemes MultiversX is looking at, lattice problems) and run on ordinary hardware. NIST published the first of these standards in August 2024 (NIST Post-Quantum Cryptography project).
How the upgrade would work: three stages, same address
The core idea is to separate an account's permanent address from the key allowed to sign for it. Today those are tied together, because a MultiversX address encodes its Ed25519 public key. Under the proposal, the address stays as the account's identity while the signing key can be replaced. The flow has three stages.
- Prepare and register. A supported wallet creates a new post-quantum key. Your current key approves its registration, and the new key proves you hold it. Until the network activates the change, transactions keep working under the current rules.
- Activate through a network upgrade. At one point for the whole network, spending authority switches to registered, approved keys. In the article's words, "Legacy Ed25519 signatures cease to authorize spending."
- Use and maintain. Transactions are signed with the approved scheme. The account can later replace its key again, including moving to a different approved scheme, and the address never changes.
This reuses the pattern of MultiversX Guardians, the optional co-signer feature that is set up with one transaction and becomes active after a waiting period of 20 epochs (MultiversX docs). The difference is that a guardian adds a second signature per account, while the post-quantum upgrade changes the owner's own signing authority for everyone at once. The first version targets direct transactions from accounts without guardians. Support for guardians, relayers and custody setups comes later, with their current approval rules kept.
Each new signature scheme needs explicit protocol approval after security and implementation review. That lets the network add a better algorithm in future without another address change.
Your 24 words would still work
For supported wallets, the plan is to derive the new post-quantum keys from the same 24-word recovery phrase you already have. A phrase is turned into keys through a fixed series of steps called a derivation path (our seed phrase guide explains the basics). MultiversX would add new branches to that path for each signature scheme, leaving the current branch for your existing account untouched. If you protect your phrase with an optional passphrase, that passphrase stays part of the backup.
MultiversX says it intends to follow an ecosystem-wide derivation standard as one matures, so phrases keep working across wallets. Two public proposals already exist: Tectonic Labs' hybrid hierarchical deterministic (HHD) wallet specification, which covers both Falcon and ML-DSA, and an ML-DSA extension to SLIP-0010 that was still an open pull request when the article was written. Owners who use other custody setups can instead register a separately generated key that meets the protocol rules.
If you only have a PEM file or an old keystore
This is the one group with a clear recommendation. If your only backup is a PEM file or an old single-account keystore file and you no longer have the 24 words, MultiversX recommends creating a fresh wallet, writing down and checking its recovery phrase, and moving your assets to it. The new wallet will have a new address; a fresh, phrase-based wallet is what puts you on the planned upgrade path. Some keystore files contain a mnemonic and some don't, and MultiversX says it is still assessing which legacy file formats keep enough key material for the late-migration route below.
What if you come back late?
Some people will not touch their wallet for years. Under the proposal, an account that has not registered a new key can still receive funds after activation, but it must register before it can spend.
For those accounts MultiversX is developing zero-knowledge proofs of "account-seed knowledge." Your Ed25519 key is derived from a secret seed. A quantum attacker who recovered the Ed25519 private scalar from your public key would still not learn the seed that produced it. So a proof that you know the seed, which reveals nothing about the seed itself and is bound to a specific new key, can show you are the real owner even after Ed25519 is broken. Once registered, normal payments use the new signature scheme, and seed proofs are only used for onboarding.
Mysten Labs researchers published a similar approach for EdDSA chains, including Sui, in the paper "Post-Quantum Readiness in EdDSA Chains" (IACR ePrint 2025/1368, accepted to Financial Cryptography 2026). Their proof of concept took 6.2 seconds to prove and produced a 5.4 MB proof, which shows why size matters. MultiversX's prototypes in Plonky3, Spartan/WHIR and VEIL aim for a complete proof under 100 KB, verification in milliseconds and proving on a user's own device. MultiversX calls 100 KB a research goal.
MultiversX also says production activation needs either a reviewed, usable seed-proof route or an explicit change to its onboarding policy. The final policy for late returners is not set.
ML-DSA first, Falcon under consideration
ML-DSA is the initial candidate for transaction signatures. It is specified in NIST's FIPS 204, final since 13 August 2024 (NIST FIPS 204). Falcon, which NIST is standardizing as FN-DSA in FIPS 206, is also under consideration. As of October 2026 NIST lists Falcon's standardization as still underway, so FIPS 206 is not final.
ML-DSA's drawback is size. An Ed25519 signature is 64 bytes. An ML-DSA-44 signature is 2,420 bytes with a 1,312-byte public key (RFC 9964, reproducing FIPS 204). Falcon signatures are smaller, but signing relies on careful floating-point sampling that is hard to get right on every device, and NIST has noted that FN-DSA key generation can produce different keys from the same seed across implementations, which matters for phrase recovery. MultiversX says it will weigh signing safety, verification cost, wallet support and transaction size.
How other chains are approaching post-quantum security
MultiversX is one of several networks working on this. The status of each, as of October 2026:
| Network | Post-quantum work | Status (October 2026) |
|---|---|---|
| MultiversX | Account key replacement with same address; ML-DSA first; ZK seed proofs for late migration | Draft specs and Rust prototypes; no activation date |
| Algorand | Falcon signatures for state proofs; Falcon-signed transactions via logic signatures | First Falcon-signed mainnet transaction announced 3 November 2025; consensus still uses Ed25519 |
| Ethereum | Ethereum Foundation post-quantum team formed January 2026 | Research, post-quantum devnets and regular developer calls |
| Bitcoin | BIP-360 (Pay-to-Merkle-Root) removes the quantum-exposed Taproot key path | Draft BIP; not activated |
| Sui and other EdDSA chains | Mysten Labs paper on ZK seed proofs to migrate without changing address | Peer-reviewed research (FC 2026) |
Sources: Algorand, Decrypt on the Ethereum Foundation team, BIP-360.
The MultiversX plan covers user accounts only. The article lists validator consensus, randomness, bridges and signature checks inside applications as separate migration tracks still to come.
What MultiversX holders should do now
- Check you have your 24 words. Find your recovery phrase and confirm it restores your wallet. If you only have a PEM or keystore file, plan the move to a fresh phrase-based wallet described above. Our self-custody guide covers safe backups.
- Ignore anyone offering a "quantum migration." There is nothing to migrate yet. A site or direct message asking for your seed phrase, or asking you to sign a "quantum upgrade" transaction, is a scam. See wallet drainers and approval phishing.
- Don't move funds to a new address because of this news. The plan keeps your address. The only exception is the PEM or keystore case.
- Follow official channels. Wallet updates, testnet dates and migration guides will come from MultiversX and your wallet provider.
What it means for JewelSwap users on MultiversX
JewelSwap is a non-custodial protocol, so your positions on MultiversX belong to your own address. That covers JWLEGLD and SJWLEGLD from liquid staking, auto-compounded farm positions on AshSwap, xExchange, OneDex and Hatom, and NFT loans. Because the proposal keeps the address and changes only which key can sign, those positions would stay where they are and you would sign with your new key after activation. Nothing about the proposal requires you to exit a position today. If you are new to the network, start with what EGLD and MultiversX are and JewelSwap on MultiversX; staking is covered in how to stake EGLD.
We will update this post when MultiversX publishes wallet support, a testnet or an activation plan. For the regulatory side of holding crypto in your own wallet, see crypto regulation in 2026.
Frequently asked questions
Is MultiversX quantum resistant today?
No. MultiversX accounts sign with Ed25519, which a large enough quantum computer could break. The 29 October 2026 article describes research and draft specifications for a post-quantum upgrade, with no activation date.
Will my MultiversX address change?
Under the proposal, no. The address stays the same and only the key allowed to sign for it is replaced. The exception is if you hold only a PEM or keystore file without your 24 words, in which case MultiversX recommends moving to a fresh wallet with a new address.
Do I need to do anything with my EGLD now?
No action is needed yet beyond making sure you have a working 24-word recovery phrase. Treat any message asking you to "migrate" for quantum safety as a scam until MultiversX announces official wallet support.
What is ML-DSA?
ML-DSA is a post-quantum digital signature algorithm based on lattice math, standardized by NIST as FIPS 204 in August 2024. MultiversX has picked it as the initial candidate for transaction signatures, with Falcon (FN-DSA) also under consideration.
What happens if I come back after activation without registering a new key?
Under the proposal your account can still receive funds, but you must register a new key before spending. MultiversX is developing zero-knowledge proofs of your account seed for that case, and says production activation requires a reviewed version of that route or a revised onboarding policy.
Educational only, not financial or security advice. Based on MultiversX's 29 October 2026 article and sources checked the same day; the design may change before any activation.
