Sui, the Layer 1 blockchain designed for scalable finance, has announced the adoption of two NIST-approved post-quantum signature schemes as part of its move toward quantum readiness. The initiative addresses the unique vulnerability of on-chain public keys, which are permanently exposed once an account transacts, unlike traditional systems where keys are protected behind a breach. With Shor's algorithm capable of breaking elliptic-curve cryptography, and Google Quantum AI's March 2026 estimate that a private key could be recovered from an exposed public key in minutes on a fault-tolerant machine with under half a million physical qubits, the threat is imminent.
Sui is integrating two complementary schemes. For everyday transactions, ML-DSA-65 (FIPS 204) will serve as a native protocol signature scheme, choosing Level 3 security after an AI model recently halved the effective key strength of the HAWK candidate. For high-value assets, SLH-DSA-SHA2-128s (FIPS 205) will operate inside Move smart contracts, offering hash-based security that remains adaptable to future industry standards without requiring a core protocol upgrade. Both rest on different mathematical foundations, ensuring a single weakness does not compromise the entire system.
Thanks to Sui’s cryptographic agility, the transition is designed to be seamless. Existing users retain their recovery phrases and can update their authorization keys via address aliases while keeping the same wallet addresses. No forced migration or asset transfers are required. The main trade-off is larger transaction sizes due to bigger signatures, but the network’s verification cost per signature remains close to that of Ed25519, and Sui’s architecture absorbs the overhead.
The rollout is staged: quantum-safe vaults are targeted for Mainnet later this year, native ML-DSA-65 accounts on Testnet by year-end, and native account authentication on Mainnet in Q1 2027. Wallet, SDK, and CLI support will arrive concurrently. Independent audits are underway, and the feature remains opt-in, much like zkLogin and passkeys were introduced.
