Ripple Sets a 2028 Target for Quantum-Safe XRP as AI Breaks a Crypto Scheme

What Q-Day Actually Means for Digital Keys

Every private key on the Bitcoin network and the XRP Ledger is protected by math problems that ordinary computers cannot solve fast enough to be useful to an attacker. A quantum computer, once powerful enough, could run Shor's algorithm to reverse those problems in a fraction of the time. Researchers call the hypothetical moment when quantum machines reach that threshold "Q-Day," and blockchain networks are now planning for it.

Bitcoin's digital signatures use a system called ECDSA, which protects the private keys that authorize every transaction. The XRP Ledger uses a similar approach. Both systems depend on the elliptic-curve discrete logarithm problem, which a quantum computer running Shor's algorithm could solve. A successful attack would let an adversary derive a wallet's private key from its public key and drain the funds.

Google Quantum AI updated its engineering estimates and concluded that breaking Bitcoin's elliptic-curve keys might require roughly 500,000 physical qubits, down from the millions earlier models assumed. That narrower gap has made the timeline feel more concrete. The revised estimate is one reason cryptographers at Ripple, and independently within Bitcoin's developer community, began drafting formal migration proposals rather than treating quantum resistance as a distant concern.

Ripple's Four-Phase Plan for XRP

On April 20, 2026, Ripple published a formal post-quantum roadmap on its Ripple Insights blog. Five authors from the company's applied cryptography team co-wrote it: Dr. Murat Cenk, Dr. Aanchal Malhotra, Dr. Tamas Visegrady, Dr. Oleg Burundukov, and Denis Angell. Ripple developed the plan in partnership with Project Eleven, a research organization that measures blockchain networks' exposure to quantum attacks.

The roadmap outlines four phases and targets full quantum resistance through a new XRP Ledger network amendment by 2028. The design layers post-quantum algorithms on top of the existing protocol, allowing a staged transition in which different participants can upgrade at different times without breaking the network. The final phase requires an amendment vote among XRP Ledger validators to activate quantum-safe signing across the full network.

Ripple aligned its algorithm choices with the post-quantum standards NIST finalized in 2024 rather than with any experimental scheme still in testing. That decision insulated the roadmap from cryptanalysis risks that apply to unfinished candidates. The finalized NIST standards Ripple's team anchors to are listed below; each went through years of public scrutiny and peer review before receiving a FIPS designation.

• ML-KEM (FIPS 203): key encapsulation mechanism, lattice-based, finalized August 2024
• ML-DSA (FIPS 204): digital signature scheme, lattice-based, finalized August 2024
• SLH-DSA (FIPS 205): digital signature scheme, hash-based, finalized August 2024

How an AI Model Cracked a Post-Quantum Signature Scheme

HAWK is a lattice-based digital signature scheme that entered NIST's secondary post-quantum standardization track—a follow-on competition launched after NIST published its primary post-quantum standards. Unlike ML-DSA and SLH-DSA, which carry FIPS designations, HAWK remained experimental. Cryptographers found HAWK attractive partly because its small key sizes made it appealing for constrained environments such as smart cards and low-power embedded devices.

On July 28, 2026, Anthropic published research showing that Claude Mythos Preview—a restricted preview model not publicly available—had found an attack on HAWK's key-recovery problem. For HAWK's smallest configuration, the attack cut the cost from 2⁶⁴ to 2³⁸ operations, a reduction of roughly 67 million times. Anthropic's own language states that the required fix "eliminates many of the reasons making the scheme an attractive PQC signature candidate."

The attack targeted HAWK specifically, not the finalized NIST production standards. ML-DSA, ML-KEM, and SLH-DSA were unaffected. HAWK was effectively sidelined from the NIST additional signatures competition after the finding. The table below shows where each scheme stands. The episode illustrates that AI-assisted cryptanalysis can now stress-test candidate schemes faster, strengthening the case for blockchain networks to commit to finalized standards rather than waiting for lighter experimental alternatives.

Bitcoin Developers and the Same Race

Independent of Ripple's work, Bitcoin developers published formal proposals for phasing out quantum-vulnerable key formats. BIP-361, dated February 11, 2026, and co-authored by Jameson Lopp among others, pairs with BIP-360 to outline a two-phase sunset of legacy ECDSA and Schnorr address types. The proposals give Bitcoin users a defined migration window to move funds into new quantum-resistant address formats before the older formats are deprecated.

Understanding those proposals requires knowing what Bitcoin is at the protocol level. Each Bitcoin transaction is authorized by a digital signature created with a private key. The public key paired to that private key becomes visible on the blockchain once a transaction is broadcast. That visibility creates quantum exposure: a powerful enough quantum computer could derive a private key from its paired public key before the owner can react.

BIP-361 does not set a final cutoff date; it lays out the mechanism and the two-phase structure. The proposals remain under active review and have not been merged into Bitcoin's reference implementation. Evolving standards give wallet developers and custodians a stable technical reference: NIST's finalized FIPS 203, 204, and 205 documents are available alongside broader Bitcoin regulation resources for any team designing quantum-resistant key-management systems.

Ripple's Quantum-Safe Head Start Predates the AI Discovery

The chronology matters here. Ripple published its quantum roadmap on April 20, 2026. Anthropic published the HAWK attack finding on July 28, 2026—more than three months later. Press coverage that frames the Anthropic result as a catalyst for Ripple's quantum preparations has the sequence backwards. Ripple's roadmap was motivated by Google Quantum AI's revised qubit estimates, not by a cryptanalysis result that had not yet been released.

The Anthropic finding is still significant for anyone following cryptocurrency markets and blockchain infrastructure. AI-assisted cryptanalysis is shortening the time between a scheme's publication and the discovery of its weaknesses. That pressure makes the strategy of committing early to battle-tested, finalized algorithms more defensible—and makes the decision to wait for newer, lighter experimental candidates more dangerous.

Ripple's 2028 target puts quantum-safe XRP ahead of most competitors' public commitments. Bitcoin's BIP proposals are still under review and carry no fixed completion date. Most other major networks have not published roadmaps with a fixed deadline. Whether Ripple's 2028 window proves comfortable or tight depends on how quickly quantum hardware improves—but the decision to plan early, and to anchor the roadmap to finalized NIST standards, is what the April 2026 document established.