Find it. Fix it. Prove it.

No blockchain checks post-quantum signatures at consensus yet, so you can't rip out Ed25519 or ECDSA. What you can do today is add ML-DSA-87 next to them, bind it to your accounts on-chain, and refuse anything that isn't signed both ways. This is the whole path, with tools that work right now.

Rather have it done for you? See the migration packages, priced in USDC or SOL.

1. 1

   Find what's exposedEvery key and signature a quantum computer breaks, with a plan per family.

   Try the scanner

   On your whole repository (Pro and Enterprise), with the plan grouped by family and CI exit codes:

   vantax scan . --migrate
   vantax scan . --format sarif -o vantax.sarif --fail-on high   # in CI

2. 2

   Create your post-quantum keyML-DSA-87, NIST FIPS 204, security category 5.

   This key never replaces your wallet key. It stands next to it. Make one here to see the whole flow, or with the CLI for anything real:

   Generate a key in this browserUse my own .pub.json

   Back the key up across people or places with vantax vault create -k treasury.json (Shamir shares, 3-of-5 by default).

3. 3

   Bind it to your accountA commitment on-chain says "this post-quantum key belongs to this account", publicly and permanently.

   Create or load a key in step 2 first.

   A commitment is not a payment address. Never send funds to it.
4. 4

   Sign in hybrid modeYour wallet signs as it always has. Your ML-DSA-87 key signs the same intent next to it.

   Build a canonical intent for each transaction, sign it with the post-quantum key, and send both signatures. A verifier checks both, so a forged classical signature on its own gets nothing.

   intent.json holds the canonical intent, the exact bytes signed (signing_payload_hex) and the ML-DSA-87 signature. Anyone can check it with the CLI or the API:

   jq .signature intent.json > intent.sig.json
   vantax verify -k treasury.pub.json -s intent.sig.json --hex "$(jq -r .signing_payload_hex intent.json)"
   
   curl -s -X POST https://api.vantax-cybersecurity.com/api/v1/verify -H 'Content-Type: application/json' \
     -d '{"public_key":"<hex>","signature":"<hex>","message":"<signing_payload_hex>","encoding":"hex"}'

   Try signing in your browser
5. 5

   Enforce it, then retire the old pathRefuse anything without a post-quantum signature, and set a date for classical-only to stop counting.

   The Vantax gateway turns this into policy: algorithm allowlists, a required post-quantum signature, value and rate limits, and an optional sunset date after which classical signatures are refused even alongside a post-quantum one. Every decision is hash-chained in an audit log and attested with the gateway's own key.

   Ask the live gatewayTry classical-only

   Keep the scan in CI so nothing new slips in, and get an independent review before you secure real value.