# Aptos (APT) Quantum Readiness Report

> Aptos has a QRI score of 20/100 and is assessed at Stage 2 (Mitigation / Development) with medium evidence confidence.

Evaluation date: 2026-08-12. Review status: draft. Evaluated scope: Native asset (APT), base-layer accounts, consensus, ZKP/privacy layers, encrypted mempool.

Aptos is a Move-based PoS L1 blockchain that relies entirely on classical cryptography in production: Ed25519 for user transaction signatures, BLS12-381 for validator consensus authentication and per-epoch threshold encryption, and Groth16/BN254 for zero-knowledge proof verification. All active production cryptographic primitives are quantum-vulnerable to Shor's algorithm.

AIP-137, authored by Aptos Labs Head of Cryptography Alin Tomescu and accepted by governance in early 2026, proposes adding SLH-DSA-SHA2-128s (FIPS 205, NIST-standardized hash-based PQ signature) as an optional post-quantum account signature scheme. The implementation code has been merged into aptos-core v1.41.5 (PRs #18293, #18300) behind feature flag 107, with unit tests, e2e smoke tests, and feature-gated gas pricing. However, the feature flag is NOT enabled on mainnet—no user can create or use a PQ account, and 0% of signing traffic or value-at-risk is protected.

The Aptos account model provides a strong structural advantage: public keys are stored as account metadata with mutable authentication keys, allowing users to rotate to a PQ key without moving assets. This makes migration architecturally straightforward once the PQ scheme is activated. However, consensus (BLS12-381), ZKP verifiers (Groth16/BN254), Bulletproofs, and KZG commitments have no PQ migration proposals or implementation timelines.

QRI Score of 20 reflects Stage 2 (Mitigation/Development): a well-designed PQ proposal exists with merged code and accepted governance, but no production users are materially protected against quantum attacks as of the evaluation date. The score is capped at 40 by both the Stage 2 cap and the Readiness & Risk Cap for active production spend authorization remaining entirely ECC-only.

## Core resources

- [Aptos QRI report](https://qrindex.org/projects/aptos/): Human-readable assessment with score, stage, evidence, blockers, risks, and assurance notes.
- [Aptos structured report data](https://qrindex.org/projects/aptos/report.json): Complete report as JSON for deterministic machine processing.
- [QRI methodology](https://qrindex.org/methodology/): Scoring model, evidence handling, readiness stages, confidence, assurance, and report status.
- [All QRI project reports](https://qrindex.org/llms.txt): Score-ranked index of every published project assessment.
- [Aptos official website](https://www.coingecko.com/en/coins/aptos): Project-maintained website.



## Evidence sources

- [Evidence source 1](<https://aptos.dev/build/smart-contracts/cryptography>): Public source cited by the Aptos QRI assessment.
- [Evidence source 2](<https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-137-post-quantum-aptos-accounts-via-slh-dsa-sha2-128s.md>): Public source cited by the Aptos QRI assessment.
- [Evidence source 3](<https://alinush.github.io/post-quantum-aptos>): Public source cited by the Aptos QRI assessment.
- [Evidence source 4](<https://github.com/aptos-labs/aptos-core>): Public source cited by the Aptos QRI assessment.
- [Evidence source 5](<https://github.com/aptos-labs/aptos-core/pull/18300>): Public source cited by the Aptos QRI assessment.
- [Evidence source 6](<https://aptos-labs.github.io/framework-book/move-stdlib/features.html>): Public source cited by the Aptos QRI assessment.
- [Evidence source 7](<https://aptos.dev/network/blockchain/accounts>): Public source cited by the Aptos QRI assessment.
- [Evidence source 8](<https://reports.zksecurity.xyz/reports/aptos-encrypted-mempool/>): Public source cited by the Aptos QRI assessment.
- [Evidence source 9](<https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-144-encrypted-mempool.md>): Public source cited by the Aptos QRI assessment.
- [Evidence source 10](<https://explorer.aptoslabs.com/releases/networks>): Public source cited by the Aptos QRI assessment.