XRP Ledger Foundation Plan Requires Owners to Disable Old Keys by 2028

Owners Must Retire Exposed Keys

The XRP Ledger Foundation has published a design that places the work of quantum-proofing accounts on the people who hold them: each owner would add a post-quantum signing key to the account and then switch the original key off, cutting the route an attacker could otherwise use to reconstruct the secret behind a crypto wallet address. The mechanism forms part of the Foundation's 2027 protocol roadmap, refreshed on Nov. 4, and it sits inside a migration Ripple wants completed across the XRP network by 2028. Nothing in the proposal changes how payments move day to day; what changes is what owners must do before the threat arrives.

The exposure the design addresses is already written into the ledger's history. Every time an account signs a transaction, the signature reveals the public key the network uses to confirm the owner's approval, and a computer powerful enough could work backward from that key to the private secret controlling the funds. Any account that has ever sent a payment, every exchange wallet included, has exposed its key at least once. Once the new key is in place, switching the old one off closes the path an attacker could follow. The replacement key uses ML-DSA-44, a signature scheme the U.S. standards body NIST approved in 2024 specifically to withstand quantum attacks. It is bulkier than today's cryptography: key and signature together fill 3,732 bytes, against 105 bytes for a regular payment, adding roughly 3.6 KB to each protected transaction. Counting history and database overhead, the Foundation puts storage at 5,331 bytes per protected payment against a 1,704-byte baseline. Fee economics stay untouched. The proposal keeps the base transaction fee at its current level, and because fees on the XRP Ledger are destroyed, the operators who run the network absorb the added storage instead of billing users for it, a split our crypto network fees guide breaks down in detail.

Audit Budget and Open Bugs

Execution is where the plan still shows gaps. Developers are working through a mismatch in which the Python prototype, the server implementation and the JavaScript library can derive different keys from a single starting seed, the kind of divergence anyone who has restored an HD wallet across different tools will recognize. Tests showing how the network behaves when every validator signs with the new scheme have yet to appear; validators are the computers that agree on the ledger's history, and a signature change touches all of them at once. The roadmap sets aside $215,000 to $255,000 for review and auditing of this amendment, plus 640 hours of development time. Across all 24 amendments on the roadmap, the budget runs from about $5 million to nearly $6 million. Sequencing puts a migration study in the first half of 2027, with development and auditing to follow in late 2027 or 2028, and Ripple is targeting a full quantum transition by 2028. The quantum study sits alongside the Foundation's broader protocol work for the same period, including the planned 2027 XRP Ledger overhaul that followed criticism over 1,500 TPS throughput. Both tracks land in the same window, which concentrates protocol work on validator operators and wallet developers at the same time. Because the fee is burned rather than paid to anyone, no operator has a revenue line to fund the extra storage from, which is why the roadmap prices auditing and development so explicitly.

The protocol side looks like the easier half of this migration. The design hands every exposed account a remedy, but executing it depends on parties the ledger cannot reach, and those parties have not moved. Exchange operators whose wallets have revealed keys across years of payouts, and holders who keep funds in a cold wallet or a hardware wallet without any rotation routine, have announced no quantum-readiness plans of their own. Nothing in the design moves the XRP price near term either, since fees, supply and issuance all stay as they are. The roadmap sets no per-account deadline ahead of the 2028 target, which leaves custody the open item once the migration study lands in the first half of 2027.