# IOTA (IOTA) Quantum Readiness Report

> IOTA has a QRI score of 6/100 and is assessed at Stage 1 (Quantum Risk Assessed) with medium evidence confidence.

Evaluation date: 2026-06-18. Review status: draft. Evaluated scope: Native IOTA asset on IOTA Rebased L1 (post-May 2025 MoveVM/DPoS architecture). PQ features in IOTA Identity v1.7 are noted but do not protect the native asset..

IOTA's Rebased mainnet (launched May 2025) uses a Sui-inspired MoveVM/DPoS architecture with entirely classical ECC cryptography for all critical layers. User transaction signatures use Ed25519 Pure (default), ECDSA secp256k1, or ECDSA secp256r1. Validator/authority consensus signatures use BLS12381 aggregated signatures. All native IOTA asset spend authorization, consensus authentication, and account ownership remain quantum-vulnerable with no PQ or hybrid option available on mainnet. IOTA Identity v1.7 introduces PQ signatures (ML-DSA, SLH-DSA, Falcon, hybrid) but exclusively for Verifiable Credentials/Verifiable Presentations in the identity layer, explicitly not extending to core token spend, consensus, or ledger state. No public PQ migration roadmap, governance proposal, or testnet for the core L1 protocol has been identified. The project demonstrates quantum risk awareness through Identity-layer PQ work and cryptographic agility claims, but no meaningful production protection exists for the native asset or consensus. No independent audit of the core protocol's current cryptographic implementation has been found. The QRI Score of 6 reflects Stage 1 (Quantum Risk Assessed): risk is acknowledged through documentation and Identity-layer PQ work, but no meaningful production PQ protection exists for the native asset.

## Core resources

- [IOTA QRI report](https://qrindex.org/projects/iota/): Human-readable assessment with score, stage, evidence, blockers, risks, and assurance notes.
- [IOTA structured report data](https://qrindex.org/projects/iota/report.json): Complete report as JSON for deterministic machine processing.
- [QRI methodology](https://qrindex.org/methodology/): Scoring model, evidence handling, readiness stages, confidence, assurance, and report status.
- [All QRI project reports](https://qrindex.org/llms.txt): Score-ranked index of every published project assessment.
- [IOTA official website](https://iota.org/): Project-maintained website.
- [IOTA source repository 1](https://github.com/iotaledger): Project source code referenced by QRI.
- [IOTA source repository 2](https://github.com/iotaledger/goshimmer): Project source code referenced by QRI.
- [IOTA source repository 3](https://github.com/iotaledger/iota.c): Project source code referenced by QRI.
- [IOTA source repository 4](https://github.com/iotaledger/documentation): Project source code referenced by QRI.
- [IOTA source repository 5](https://github.com/iotaledger/firefly): Project source code referenced by QRI.
- [IOTA source repository 6](https://github.com/iotaledger/streams): Project source code referenced by QRI.
- [IOTA source repository 7](https://github.com/iotaledger/hornet): Project source code referenced by QRI.
- [IOTA source repository 8](https://github.com/iotaledger/bee): Project source code referenced by QRI.
- [IOTA source repository 9](https://github.com/iotaledger/chronicle.rs): Project source code referenced by QRI.
- [IOTA source repository 10](https://github.com/iotaledger/iota.go): Project source code referenced by QRI.
- [IOTA source repository 11](https://github.com/iotaledger/stronghold.rs): Project source code referenced by QRI.
- [IOTA source repository 12](https://github.com/iotaledger/iota.rs): Project source code referenced by QRI.
- [IOTA source repository 13](https://github.com/iotaledger/iota.js): Project source code referenced by QRI.



## Evidence sources

- [Evidence source 1](<https://docs.iota.org/developer/cryptography>): Public source cited by the IOTA QRI assessment.
- [Evidence source 2](<https://docs.iota.org/developer/cryptography/transaction-auth/signatures>): Public source cited by the IOTA QRI assessment.
- [Evidence source 3](<https://docs.iota.org/developer/iota-identity/how-tos/post-quantum>): Public source cited by the IOTA QRI assessment.
- [Evidence source 4](<https://github.com/iotaledger/iota>): Public source cited by the IOTA QRI assessment.
- [Evidence source 5](<https://github.com/iotaledger/hornet>): Public source cited by the IOTA QRI assessment.
- [Evidence source 6](<https://blog.iota.org/iota-identity-1-7-beta/>): Public source cited by the IOTA QRI assessment.
- [Evidence source 7](<https://docs.iota.org/developer/cryptography/transaction-auth/keys-addresses>): Public source cited by the IOTA QRI assessment.
- [Evidence source 8](<https://docs.iota.org/about-iota/iota-architecture/consensus>): Public source cited by the IOTA QRI assessment.
- [Evidence source 9](<https://blog.iota.org/starfish-mainnet-release/>): Public source cited by the IOTA QRI assessment.
- [Evidence source 10](<https://blog.iota.org/builders-welcome-rebase-complete/>): Public source cited by the IOTA QRI assessment.
- [Evidence source 11](<https://docs.iota.org/developer/ts-sdk/typescript/cryptography/keypairs>): Public source cited by the IOTA QRI assessment.
- [Evidence source 12](<https://blog.iota.org/bitgo-adds-iota-to-global-custody-offering/>): Public source cited by the IOTA QRI assessment.
- [Evidence source 13](<https://github.com/iotaledger/tips/blob/main/tips/TIP-0034/tip-0034.md>): Public source cited by the IOTA QRI assessment.
- [Evidence source 14](<https://changenow.io/blog/iota-roadmap-team-interview>): Public source cited by the IOTA QRI assessment.
- [Evidence source 15](<https://blog.iota.org/perfect-audit-iota-smart-contracts/>): Public source cited by the IOTA QRI assessment.
- [Evidence source 16](<https://hacken.io/audits/echo-protocol/sca-echo-protocol-bridge-iota-jul2025/>): Public source cited by the IOTA QRI assessment.
- [Evidence source 17](<https://crates.io/crates/iota-crypto>): Public source cited by the IOTA QRI assessment.