NEAR puts post-quantum signing on mainnet. The hard part starts now.

NEAR Protocol activated network upgrade 2.13 on mainnet on Monday, adding a post-quantum signature scheme and automatic sharding to a live layer-1 blockchain.

The signature scheme is FIPS-204, also called ML-DSA, a lattice-based algorithm the US National Institute of Standards and Technology published in August 2024 in its first batch of post-quantum standards. Cryptographers knew it for years as CRYSTALS-Dilithium. Alongside it, the release introduced dynamic resharding, which lets the network split its workload across more shards automatically as demand rises.

The problem this addresses

Blockchains prove ownership with digital signatures. NEAR has used Ed25519 by default, with secp256k1 as an option, and both rest on elliptic curve mathematics that a sufficiently powerful quantum computer could unwind using Shor’s algorithm. Bitcoin and Ethereum sit on the same foundation.

The threat is theoretical for now, since no machine of that scale exists. The estimates have been moving, though. Google researchers published a paper in late March 2026 arguing that breaking the 256-bit elliptic curve problem could need roughly twenty times fewer physical qubits than earlier work suggested. Google has set 2029 as its own deadline for moving to post-quantum cryptography.

A note on one figure doing the rounds. NEAR’s announcement attributes an estimate of $470 billion of Bitcoin at risk to Google’s quantum team. That number traces to a March 2026 Galaxy Digital research note built on analysis by Project Eleven, covering roughly 7 million BTC held in addresses whose public keys have already appeared on chain. Google’s contribution was the qubit estimate. Two separate pieces of research, worth keeping apart.

Why NEAR could move quickly

The interesting part is architectural. A Bitcoin or Ethereum address is derived from one keypair and stays bound to it, so moving to a new signature scheme means moving funds to a new address. NEAR accounts use human-readable names with access keys that can be rotated underneath them. An account holder can add an ML-DSA key and retire the old one in a single transaction, keeping the same account name.

That design decision, made years ago for usability, turns out to carry the migration.

How first is first

NEAR describes itself as one of the first blockchains running a NIST-approved post-quantum signature scheme in production. That holds up with qualification.

Quantum Resistant Ledger launched in June 2018 built on XMSS hash-based signatures, so every account on it has been quantum-safe since day one. Algorand activated State Proofs in 2022 using Falcon, another NIST selection, and demonstrated a post-quantum mainnet transaction with Falcon in 2025, though its ordinary account signatures remain elliptic curve based. Solana has an optional Winternitz vault for key rotation and ran a Dilithium testnet in December 2025. The XRP Ledger has tested ML-DSA on a development instance.

So the accurate framing is narrower and still meaningful: NEAR is among the first major layer-1 networks to offer a NIST-standardised post-quantum signing option for ordinary accounts on mainnet, at the protocol layer.

The hard part

Getting the scheme into the protocol was the tractable engineering problem. The downstream stack is the difficulty, and NEAR’s own team has said so plainly.

Post-quantum keys are large. A Dilithium public key runs to roughly 1.6 kilobytes against 32 bytes for Ed25519, and signatures grow to match. Every wallet, API, indexer and hardware device has to handle that increase, and every byte on chain costs blockspace.

Hardware wallets are the sharpest constraint. Near One has said current crypto hardware wallets offer no quantum-safe signing at all, and that it may be physically impossible for some existing devices to support it. The team has been working with wallet builders including Ledger. Until that support lands, quantum-safe signing on NEAR is available to accounts whose software can produce the keys.

What to watch

Three things will show whether this becomes real protection. First, wallet adoption, since a protocol feature with no wallet support protects nobody. Second, how many accounts actually rotate their keys, which is measurable on chain. Third, whether audits of the implementation hold up, because a standardised algorithm and a correct implementation of it are separate achievements.

For everyone else, the useful signal is competitive. A working migration path on a live network gives the chains still debating theirs something concrete to be measured against.