Skip to main content
This guide creates a user account backed by ml_dsa_65, the post-quantum signature algorithm, and moves funds into it. Accounts do not rotate. An existing account keeps its key for life, so moving to post-quantum means a new account and a transfer. For what ML-DSA is and when account migration matters, see Post-quantum keys. Commands use simd. Substitute your chain’s binary and adjust key names and denoms.

​
Know the limits first

  • CLI only. Wallet support for ML-DSA accounts is minimal; expect to manage the account with the chain CLI.
  • No hardware wallets. Ledger devices sign with secp256k1 only. Recovery works from the mnemonic alone.
  • No EVM. EVM transactions require eth_secp256k1 account keys, so ML-DSA accounts do not work with the EVM. See the EVM section of Post-quantum keys.

​
Prerequisites

  • The chain runs Cosmos SDK 0.55 or later, on every node.
  • A running chain to send transactions to, with its CLI binary on your PATH and a funded account in the keyring. To stand up a local chain first, see Run a node.
Enabling ML-DSA accounts needs no chain configuration beyond the SDK version. Upgrading to 0.55 is sufficient, but every validator and node must run it: a binary built with an older SDK cannot process ML-DSA signatures.

​
1. Create the account

Generate the account with the keyring and select the ML-DSA algorithm:
Use the same --home and --keyring-backend on every command in this guide. Without them the key lands in a different keyring from your funded account, and the transfer in step 2 fails to find it. The output shows the new address and a mnemonic. Store the mnemonic securely. No hardware wallet can hold this key, so the mnemonic is the only recovery path. To recover the account later:
Do not create an ML-DSA account from a mnemonic already used for a secp256k1 account. ML-DSA key generation derives its seed from the same secp256k1 BIP32 path, so at that path the secp256k1 private key and the ML-DSA seed are the same secret. Reusing the mnemonic links the two keys: whoever obtains that secret controls both. Generate each ML-DSA account from a fresh mnemonic.

​
2. Move funds in

There is no in-place migration for accounts by design. Send funds from the old account with an ordinary transfer:
Add --chain-id if your client config does not supply it, and --fees (or --gas-prices) to meet the chain’s minimum gas price.

​
3. Verify the account signs

Prove the new key works by sending from it:
You may need to raise the gas limit for this transfer. The account’s first transaction writes its public key to state, and an ML-DSA public key is large enough that a default limit of 200000 runs out of gas. --gas auto sizes the limit to fit. Later transactions from the account are smaller and fit within the default. A successful send from pq-account means the chain accepted an ML-DSA signature for the account. Drain and retire the old account afterwards.

​
Next steps