A future Bitcoin upgrade to protect on-chain funds from quantum attacks would not by itself secure the Lightning Network, with five parts of its off-chain payment system requiring separate changes, according to a research preprint published on 12 September.
The paper introduces PQLN, a hybrid post-quantum extension developed as a research prototype for rust-lightning. It examines protections for gossip, which shares node and channel information; encrypted connections between peers; signed invoices and reusable payment offers; and onion packets, which hide payment-routing details.
Lightning currently relies on secp256k1-based ECDSA, Schnorr signatures or ECDH for those functions. PQLN retains those established mechanisms while adding ML-DSA signatures to gossip, invoices and offers. It also uses hybrid ML-KEM key exchange for transport connections, payment onions and BOLT 12 privacy paths.
Researchers created a feature-gated rust-lightning fork and a modified ldk-sample node for testing. Across a 12-scenario matrix, post-quantum and standard binaries built from the same rust-lightning base were able to coexist. However, the outcome depended on the route and configuration: some mixed deployments used classical protection, while others failed closed.
The result does not demonstrate that Lightning is ready for a network-wide transition. The repositories identify the software as a research artefact, and the study did not test interoperability with other Lightning implementations.
Increased traffic and storage demands
The largest impact in the experiments came from communications rather than the amount of cryptographic processing required. During static synchronisation of a full network graph, the default ML-DSA-44 and ML-KEM-768 configuration increased gossip downloads by 10.2 times and graph-data storage by 8.8 times compared with standard Lightning.
A smaller FN-DSA configuration derived from Falcon reduced the download increase to 4.2 times. However, NIST continues to list that scheme as under development rather than as a final standard.
Private payment routing also required more bandwidth. On an emulated 10 Mbit/s connection, a fixed 21.8-kilobyte post-quantum ciphertext list added between 19 and 53 milliseconds for every hop. At 1 Mbit/s, the additional delay was between 160 and 187 milliseconds per hop.
By comparison, ML-DSA-44 signing took an average of 327 microseconds on the researchers’ 16-core AMD Ryzen Threadripper PRO 3955WX workstation, which had 64 GB of RAM. The authors stressed that this hardware-specific measurement should not be interpreted as the end-to-end delay for a payment.
PQLN also does not address risks rooted in Bitcoin itself. It leaves unprotected the on-chain keys associated with funding, commitment and HTLC outputs, as well as penalty transactions. Protecting channel funds would therefore still require post-quantum changes at the Bitcoin layer.
The preprint considers a future cryptographically relevant quantum adversary and does not report any current quantum compromise of Bitcoin or Lightning. Its prototype indicates that Lightning’s off-chain protections can be assessed separately from a Bitcoin upgrade, but it does not show that the network is ready to migrate. In the tests, the main operational issue was how much additional gossip, storage and payment traffic node operators could handle.
