Banks Test Post-Quantum Wallet Security With ML-DSA

On August 24, 2026, a consortium of banks and financial regulators launched a cross-regional pilot to test post-quantum wallet security for digital assets. This exercise involves implementing NIST-standardized signatures on a private blockchain testnet, where regulator observe and not participate in transactions. The pilot aims to prepare for a threat that doesn’t yet fully exist, and understanding this distinction is crucial.

Pilot organizers and their project

According to the August 24 press release, the project is organized by the Responsible Fintech Institute, and Safeheron, a digital asset custody infrastructure company, serves as its technology partner. Two banks, Bison Bank and DK Bank, will create wallets and transfer assets within a shared application environment. Three regulatory bodies, which include Abu Dhabi Global Market, Bhutan’s Gelephu Financial Services Office, and the Malta Financial Services Authority, are participating as observers in this initial phase.

Central to the pilot is a signing method developed by Safeheron. This method combines multiparty computation (MPC) with ML-DSA-65, a parameter set from the US National Institute of Standards and Technology’s FIPS 204 standard. MPC distributes the signing of a transaction across multiple parties or devices, ensuring that no single machine ever holds a complete private key. This custody design is paired with a signature algorithm designed to withstand attacks from future quantum computers.

All testing is conducted on a quantum-resistant NEAR testnet, not the public NEAR mainnet, and no customer funds are involved.

ML-DSA-65 and the nuances of “quantum-safe”

ML-DSA is a lattice-based digital signature scheme finalized by NIST as FIPS 204 in August 2024. NIST’s language is cautious, as it states that ML-DSA is believed to remain secure against adversaries with large-scale quantum computers. This belief relies on two conditions often overlooked in marketing: correct algorithm implementation and continued cryptographic review of its underlying mathematics. NIST offers no guarantees for either.

There’s also a difference between supporting a NIST algorithm and holding a FIPS 140-3 module validation. The former indicates the use of an approved algorithm, whereas the latter certifies that a specific cryptographic module has been tested and meets a security standard. The pilot announcement describes algorithm support, not module validation, and these should not be conflated.

Current blockchain signatures are theoretically vulnerable due to Shor’s algorithm, which a sufficiently powerful quantum computer could use to derive a private key from a public key. However, such a machine doesn’t yet exist; no quantum computer today can break the elliptic-curve signatures securing Bitcoin, Ethereum, or NEAR at scale. Therefore, this pilot is not a defense against an active attack. Instead, it’s a “harvest-now-decrypt-later” strategy, which bases on the premise that it would be possible to exploit data or exposed public keys captured today once quantum hardware becomes available.

Undisclosed pilot details

The organizers have withheld most details necessary for a comprehensive evaluation of their work. They also haven’t disclosed information regarding the assets under test, transaction volumes, the schedule, or performance benchmarks. Though a testnet run demonstrates system functionality in a controlled environment, it can’t, by itself, prove readiness for live institutional use, where factors like throughput, latency, and failure handling are critical.

Safeheron has stated its intention to eventually release the protocol as open-source software, and the group plans to publish a white paper detailing the design and test results. However, neither has a confirmed publication date. Until these materials are available, external researchers can’t assess the implementation, measure its performance, or scrutinize its security assumptions, which significantly limits the current impact of the announcement.

Responsible Fintech Institute Chairman Chia Hock Lai commented on the collaboration:

No single bank, vendor, or regulator solves this alone.”

Though this statement from an interested party promotes his own project, it also highlights a reasonable point about the necessity of coordination.

Regulatory involvement

The three regulatory bodies are observing the technical phase without directly participating in transactions. Their level of involvement will vary based on their mandates and jurisdictions. A subsequent governance workstream plans to address operational resilience, oversight, and the feasibility of cross-border post-quantum wallet infrastructure. If this phase yields a usable compliance reference, it could be a more enduring outcome than the testnet results themselves. For now, this remains a future plan.

Broader migration landscape

This pilot is part of a larger shift in how financial institutions are addressing quantum risk. In July 2025, the Bank for International Settlements (BIS) published a roadmap emphasizing that transitioning to post-quantum systems is not merely an algorithm swap. The BIS advised banks to inventory their cryptographic assets, map third-party dependencies, and develop systems capable of switching cryptographic methods as needed. Its recommendations included coordinated planning, layered defenses, hybrid designs, and phased rollouts.

Some jurisdictions are already self-assessing their preparedness. Hong Kong’s banking sector, for instance, scored 2.3 out of 10 on quantum preparedness, with 32% of surveyed banks reporting no progress. The Hong Kong Monetary Authority aims for the sector to be fully ready by 2030.

Blockchains are also advancing on their own timelines:

• Effort
• What it covers
• Status
• This bank pilot
• ML-DSA-65 wallets and transfers on a NEAR testnet
• Testnet, phase one, Aug 2026
• Algorand Foundation
• Accounts, wallets, validator tools, consensus
• Stated 2027 target
• Bitcoin BIP-360
• New quantum-resistant transaction outputs
• Proposed; migration needs wide coordination

Each entry in this table represents a plan, target, or proposal. The Algorand date is a stated goal, not a delivered feature. Bitcoin’s proposed formats would still require users, wallets, exchanges, and custodians to transfer existing holdings into protected outputs, which presents a coordination challenge more than a cryptographic one.

Future milestones for this pilot

The key upcoming milestones include completing the wallet and transfer tests, conducting the governance review, publishing the white paper, and releasing the code. These materials will demonstrate whether the design performs adequately for real-world use alongside its claimed security. Currently, a genuine assessment has a lot of limitations. A group of banks and observing regulators has begun testing a NIST-standardized signature scheme on a private testnet, with a promise to disclose their findings later.

This is a sensible undertaking in anticipation of a machine that has yet to appear. At this stage, however, it remains an announced pilot rather than a proven system. Migration planning across the financial sector will span years, and pilots like this one are early data points in that extended process, not the culmination.