$ZEC The Zcash Foundation has a clearly defined three-stage post-quantum upgrade plan (Tachyon project, ZIP‑2005):
1. Stage 1: Quantum-recoverable wallets (transition solution)
No direct cryptographic changes; add a recovery mechanism. If the quantum era arrives, the shielded pool can be frozen, and users can migrate assets to next-generation post-quantum addresses to prevent coins from being permanently locked or lost.
2. Stage 2: Post-quantum privacy layer
Replace the ECDH elliptic curve used in note encryption with the NIST-standard lattice cryptography ML‑KEM, completely eliminating the historical privacy-leak risk of “collect now, decrypt later.”
3. Stage 3: Post-quantum zero-knowledge proof system
Replace the Pasta elliptic curves currently relied on by Halo2 with a quantum-resistant proof system to prevent quantum-forged ZK proofs from creating coins out of thin air.
Plan goal: complete the full post-quantum protocol launch by 2027; as of 2026‑09, the mainnet has not yet launched true quantum-resistant cryptography, and everything remains part of the roadmap, not current capability.
1. Stage 1: Quantum-recoverable wallets (transition solution)
No direct cryptographic changes; add a recovery mechanism. If the quantum era arrives, the shielded pool can be frozen, and users can migrate assets to next-generation post-quantum addresses to prevent coins from being permanently locked or lost.
2. Stage 2: Post-quantum privacy layer
Replace the ECDH elliptic curve used in note encryption with the NIST-standard lattice cryptography ML‑KEM, completely eliminating the historical privacy-leak risk of “collect now, decrypt later.”
3. Stage 3: Post-quantum zero-knowledge proof system
Replace the Pasta elliptic curves currently relied on by Halo2 with a quantum-resistant proof system to prevent quantum-forged ZK proofs from creating coins out of thin air.
Plan goal: complete the full post-quantum protocol launch by 2027; as of 2026‑09, the mainnet has not yet launched true quantum-resistant cryptography, and everything remains part of the roadmap, not current capability.