The State of Exchange Quantum-Readiness 2026
By Jeremy Ryan, Founder & CEO · September 2026 · A public-evidence survey of 26 major crypto exchanges by NFT Demon Holdings
Exchange quantum-readiness is largely undisclosed. We assessed 26 major crypto exchanges against six strict post-quantum migration criteria, using public evidence only — every point scored required a concrete, attributable public source.
The rubric: six questions, one point each
A passing mention does not count. Each point requires concrete, attributable public evidence — an official blog, documentation, or reputable press coverage.
C1 — Published migration plan. A public document, blog post, or roadmap — not a passing mention.
C2 — Named algorithm targets. Such as ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205), or Falcon.
C3 — Dated timeline. Public milestones or target dates for migration phases.
C4 — Crypto/key inventory. A public inventory of cryptographic dependencies or exposed keys in a quantum context.
C5 — PQC deployed or piloted. Evidence in wallet signing, custody, TLS, or API communications.
C6 — Executive acknowledgment. A named executive or official channel acknowledges the threat and commits to act. "We are monitoring" scores 0.
Findings: a disclosure gap, not a verdict on internal work
Only two exchanges top the table — Coinbase and KuCoin, each scoring 4/6 — followed by Bithumb at 3/6. All three tie to named corporate programs (Coinbase's PQ-CoreKMS; KuCoin's PQC gateway proof-of-concept; Bithumb's Aton partnership framework), not generic blog paragraphs.
Coinbase leads on breadth, not deployment. It is the only exchange publicly disclosing a full cryptography inventory (C4) and it funds ecosystem work — a Quantum Advisory Board, the Bitcoin Security Consortium, BIP-360 — but names no algorithm targets (deliberately algorithm-agnostic) and has nothing deployed; PQ-CoreKMS is "being built." (Coinbase blog, CoinDesk)
KuCoin runs the lone live test. The only exchange with live PQC in any form: a public test gateway (pqctest.kucoin.biz) using X25519+ML-KEM-768 hybrid key exchange, built with the W3IF pqc-gateway project and flomesh.io. A test environment, not production. (KuCoin blog)
Bithumb commits to full-lifecycle scope. The only exchange committing to PQC across wallet management, authentication, private-key protection, transmission, and storage, with a named vendor (Aton, February 2026) and named algorithms (ML-DSA, ML-KEM) — scoring 3/6 (plan, algorithms, executive commitment; no dated timeline, inventory, or deployment yet). Phased pilots were under discussion as of June 2026; no deployment yet. (Bloomingbit, Aju Press)
Twenty-two exchanges score zero. No public plan, algorithm targets, timeline, inventory, deployment, or executive commitment. Binance's named-executive statement (CSO Jimmy Su, August 2026) is explicitly monitoring language — "monitoring quantum developments, evaluating post-quantum security standards" — which the rubric scores 0. (Binance Square)
Education is not readiness. OKX, Binance, Bitget, Gate.io, Bitfinex, BingX, and MEXC all publish quantum explainers; none describe their own migration work, so all score 0 under the strict rules.
One protocol-governance intervention. BitMEX (1/6) publicly engaged Bitcoin's quantum debate with a "Quantum Canary" proposal — an alternative to freezing vulnerable coins — the only exchange-level intervention in protocol governance we found. (Cointelegraph)
Pressure is building faster than disclosure. The SEC Crypto Task Force's Post-Quantum Financial Infrastructure Framework proposal (citing NIST FIPS 203–205 and HQC) explicitly prioritizes institutional wallets and exchanges for phased migration, and G7 messaging in September 2026 urges exchanges to demonstrate PQC preparation. The disclosure gap will close under compliance pressure — the only question is who closes it voluntarily. (Cointelegraph, Reuters)
No dated industry roadmap exists. No exchange has a dated migration timeline or a published cryptography inventory except Coinbase (relative timeframes only, no calendar dates) — even as Google's March 2026 research compresses Q-day estimates and StarkWare demonstrated the first quantum-safe Bitcoin transaction in August 2026.
Score distribution
Method: strict by design, and read zero correctly
This is a public-disclosure index — not a penetration test, vendor audit, or claim about internal capability. Scores draw only on publicly available sources accessed through September 2026. A score of 0 means "no public evidence found," not proof that no internal program exists; many exchanges may well have non-public work underway. Where sources conflicted, the more authoritative and consistent source prevailed. One discrepancy from the research record is noted for transparency: an earlier compilation reported Bithumb at 4/6 while its criterion values sum to 3/6; the criterion values govern, and Bithumb is published at 3/6.
Why public evidence is the right yardstick: in a market where trust is the product, an undisclosed program protects no one's reputation. The first exchange to publish a credible, dated migration plan turns readiness into a competitive weapon — and everyone silent into a laggard by comparison.
"The standards are final, the harvesting has started, and the regulators have started naming names. In 2026, 'we're monitoring the situation' stopped being an answer."
The full 26-exchange scorecard
| Exchange | C1 | C2 | C3 | C4 | C5 | C6 | Total | Public evidence |
|---|---|---|---|---|---|---|---|---|
| Coinbase | 1 | · | 1 | 1 | · | 1 | 4/6 | Official blog “What Coinbase is Doing to Prepare for Post-Quantum Cryptography” (~Jul 23, 2026, coinbase.com): three workstreams incl. building PQ-CoreKMS (post-quantum MPC key management), crypto inventory, Bitcoin dev sessions, Bitcoin Security Consortium founding membership (BIP-360 work). C2=0: plan is deliberately algorithm-agnostic (“any post-quantum signature algorithm”; “lattice-based” only). C3=1: “within the next year” signing pipeline, “two to three years” MPC research (relative, not calendar). C4=1: “completing a full inventory of all cryptography used across the company, ranked by migration priority”. C5=0: PQ-CoreKMS “have begun building” — not deployed/piloted. C6=1: “a large-scale quantum computer... will eventually be built... the work to prepare needs to start now, not when it’s urgent.” [Coinbase blog] |
| KuCoin | 1 | 1 | · | · | 1 | 1 | 4/6 | Official blog “KuCoin Releases Post-Quantum Cryptography (PQC) Gateway Proof-of-Concept” (2026, kucoin.com): built with pqc-gateway (W3IF) + flomesh.io; live test gateway at pqctest.kucoin.biz where “your connection is already protected by post-quantum cryptography” using X25519MLKEM768 hybrid key exchange. C2=1: names X25519MLKEM768, Kyber, Dilithium. C3=0, C4=0. C6=1: “we choose to explore proactively rather than wait passively” + stated aim to build industry PQC best practices and quantum-resistant wallets/DApps. [KuCoin blog] |
| Bithumb | 1 | 1 | · | · | · | 1 | 3/6 | Announced PQC security framework (Feb 20, 2026; technical agreement with Aton signed Feb 11, 2026) covering input, authentication, transmission, storage; focus on private-key protection in wallets/auth systems (multiple corroborating Korean/English outlets). Jun 11, 2026 Information Security Advisory Committee (attended by CEO Lee Jae-won) discussed “quantum-ready” strategy incl. phased pilot tests. C2=1: Aton’s products use ML-DSA and ML-KEM (NIST-selected). C3=0: no dated migration milestones. C5=0: pilots planned, no deployment evidence (one low-quality outlet claimed 2025 implementation — contradicted by Jun 2026 “phased pilot tests” framing, not counted). C6=1: Bithumb rep quote — “failing to prepare proactively now risks leaving us with critical security vulnerabilities... We will continuously evolve our security framework to keep pace with technological change.” [plan coverage · Aju Press pilot report] (Reported elsewhere in the research record as 4/6; the criterion values above sum to 3/6 and are published as such.) |
| BitMEX | · | · | · | · | · | 1 | 1/6 | BitMEX Research proposed a “quantum canary fund” soft-fork mechanism (NUMS address bounty; 50,000-block safety window) as an alternative to BIP-361’s coin freeze (reported Apr–Jun 2026). Substantive official-channel engagement with the quantum threat → C6=1, but this is a Bitcoin-protocol governance proposal, not a BitMEX exchange migration plan (C1=0). [Cointelegraph] |
| Binance | · | · | · | · | · | · | 0/6 | CSO Jimmy Su Q&A (Aug 11, 2026): quantum “not an immediate threat”; Binance is “monitoring quantum developments, evaluating post-quantum security standards” — monitoring language per rubric → C6=0. Binance Academy carries an educational article only. Founder CZ (X, Apr 2026) said crypto “has to do is to upgrade to Quantum-Resistant (Post-Quantum) Algorithms” — generic, no commitment. [Binance Square Q&A] |
| Binance.US | · | · | · | · | · | · | 0/6 | No Binance.US-specific disclosures; only parent-Binance material (see Binance row). |
| BingX | · | · | · | · | · | · | 0/6 | BingX flash-news repost of White House quantum EOs (Jun 23, 2026) only; no company plan. [BingX flash news] |
| BitMart | · | · | · | · | · | · | 0/6 | No public evidence found. |
| Bitfinex | · | · | · | · | · | · | 0/6 | Educational blog “How Can Digital Assets Defend Against Quantum Computing?” + Feb 20, 2026 X post: threat is “not imminent... a long-horizon engineering problem the ecosystem is already preparing for” — no Bitfinex commitment to act → C6=0. [Bitfinex blog] |
| Bitget | · | · | · | · | · | · | 0/6 | Bitget News carries third-party quantum news only; no company plan. [Bitget News] |
| Bitso | · | · | · | · | · | · | 0/6 | No public evidence found. |
| Bitstamp | · | · | · | · | · | · | 0/6 | No public evidence found. |
| Bullish | · | · | · | · | · | · | 0/6 | No public evidence found. |
| Bybit | · | · | · | · | · | · | 0/6 | No public evidence found. (An academic Zenodo paper speculatively lists “Bybit — Cyber” as expected PQC type — not a Bybit disclosure.) |
| Crypto.com | · | · | · | · | · | · | 0/6 | Only a glossary definition page (“Quantum Computing”); no company plan. [Crypto.com glossary] |
| Deribit | · | · | · | · | · | · | 0/6 | No public evidence found. |
| Gate.io | · | · | · | · | · | · | 0/6 | Gate News reposts third-party quantum research; no Gate.io company plan. [Gate News] |
| Gemini | · | · | · | · | · | · | 0/6 | No public evidence found (search results were unrelated Google-Gemini items). |
| HTX | · | · | · | · | · | · | 0/6 | No public evidence found. |
| Independent Reserve | · | · | · | · | · | · | 0/6 | No public evidence found. |
| Kraken | · | · | · | · | · | · | 0/6 | No public evidence found. |
| Luno | · | · | · | · | · | · | 0/6 | No public evidence found. |
| MEXC | · | · | · | · | · | · | 0/6 | MEXC News reposts third-party quantum stories; MEXC glossary says MEXC is “exploring post-quantum cryptographic methods” — vague, no plan/dates/algorithms. Unrelated: MEXC listed QoreChain (QOR), a quantum-themed token. [MEXC glossary] |
| OKX | · | · | · | · | · | · | 0/6 | OKX Learn publishes educational articles on quantum threats to Ethereum/Bitcoin (one names ML-DSA/SPHINCS+ in educational context). No OKX company plan, targets, or statements. [OKX Learn] |
| Toobit | · | · | · | · | · | · | 0/6 | No public evidence found. |
| Upbit | · | · | · | · | · | · | 0/6 | No public evidence found. |
C1 published migration plan · C2 named algorithm targets · C3 dated timeline · C4 crypto/key inventory · C5 PQC deployed or piloted · C6 executive commitment. "·" = no public evidence found.
What readiness actually looks like
The pattern in the leaders' work is sequencing, not moonshots: inventory the cryptography you depend on, prioritize long-lived keys and secrets, and protect at the wallet and exchange layer first — a step that can precede slower chain-level migration by years. That is the approach we advise on through QKey: quantum protection built into hardened HD wallet architecture, designed to migrate to post-quantum signatures without re-seeding, without moving funds, and without a per-transaction toll.
NFT Demon Holdings provides quantum-readiness advisory for exchanges, custodians, wallet providers, and funds — from key inventory and vendor evaluation to full migration planning. Start with a free evaluation call, or read our framework: how to evaluate a quantum-readiness vendor and quantum-resistant crypto without a new blockchain.
And to the field itself: 3/6 and 4/6 are better than 0/6 — but the technology to reach 6/6 already exists. Not in concept; in practice. All it takes is a call or an email to NFT Demon Holdings LLC.
Selected sources
Coinbase — What Coinbase is Doing to Prepare for Post-Quantum Cryptography · KuCoin — PQC Gateway Proof-of-Concept · Bloomingbit — Bithumb PQC adoption · CoinDesk — Coinbase advisory board warning · Cointelegraph — BitMEX Quantum Canary · Binance Square — CSO Jimmy Su Q&A · Reuters — crypto firms prepare quantum defenses · Cointelegraph — SEC Crypto Task Force PQFIF
Is your key infrastructure ready?
Free evaluation call — objective, constraints, and fit, before any proposal.