In March 2023, just over half of the Estonians who voted for their parliament did it over the internet, and none of those votes went through a blockchain. Four years earlier, in September 2019, Moscow ran a city election in which ballots were written to a blockchain, and two researchers showed that the encryption protecting them could be broken in minutes. Put side by side, the two cases say what this lesson is about: blockchain voting is not what makes an online vote safe or unsafe.
The short answer to the question in the title: yes, a blockchain can record votes, and it has been done in pilots and in thousands of crypto governance polls. For public elections, the security researchers who have studied the idea most closely say no, and the guidance US federal agencies give election officials warns of the risks of sending marked ballots back over the internet. The reasons have little to do with the ledger itself. They concern the secret ballot, the voter’s own phone or computer, and the ability to check and contest a result.
This is the fourth lesson of the use-cases path. Our lesson on digital identity and blockchain diplomas showed what a ledger can and cannot prove about a person; voting adds a harder twist, because the system must know who you are and then forget it. If you need the basics first, our overview of blockchain use cases lists every sector. Facts and figures below are as of October 2026.
A ledger can store votes, but an election asks for more
What supporters expect from a ledger
The pitch is easy to follow. A blockchain is a public list that many computers keep in sync, and that nobody can quietly edit once an entry is buried under later blocks (our guide on why a blockchain is hard to change explains the mechanism). Apply that to an election and you seem to get a ballot box that cannot be stuffed after the fact, a count anyone can redo, and voting from a phone, which could help people abroad, soldiers, or voters with disabilities.
Some of those hopes are real. Election officials do want tamper-evident records, and there is a long line of research on publishing encrypted ballots so that voters can check them. The question is whether a blockchain adds anything that an election actually lacks.
Five properties an election must have
In their 2021 paper “Going from bad to worse: from Internet voting to blockchain voting”, published in the Journal of Cybersecurity, Sunoo Park, Michael Specter, Neha Narula and Ronald Rivest of MIT start from a list of minimum requirements for any voting system. They name five: ballot secrecy, software independence, voter-verifiable ballots, contestability and auditing.
Software independence is the least familiar of the five and the most useful. It means that an undetected bug or hack in the software cannot cause an undetectable change in the result. Paper ballots give it almost for free: if a scanner miscounts, people can count the paper again. A fully digital system, with or without a blockchain, has no such fallback. Contestability means a voter or candidate can show that something went wrong, and auditing means someone routinely checks that the declared winner really won.
Against that list, the verdict in the paper’s abstract is blunt: internet and blockchain voting “would greatly increase the risk of undetectable, nation-scale election failures.” They treat voting on a blockchain as a subcategory of internet voting, since every such proposal sends ballots over the internet.
The cryptographers’ objections to blockchain voting
A public ledger and a secret ballot pull in opposite directions
The secret ballot exists to make two crimes pointless: buying votes and forcing them. If nobody can be sure how you voted, a buyer has no reason to pay you and a boss has no reason to threaten you. A polling booth enforces that, because you mark the paper alone and keep no proof.
Remote voting loses the booth. The MIT authors put it simply in their draft of November 2020: a coercer or vote buyer can “look over the shoulder of a voter” to confirm the vote. That is true of any internet vote. A public blockchain makes it worse, because a voter can point to the transaction afterwards and prove how they voted. The paper sketches the obvious design, which it calls a strawman: the authority gives each registered voter one coin, the voter sends it to a candidate, and anyone can add up the coins. It works as arithmetic and fails as an election, since every vote is public and provable.
Encrypting the votes on the chain moves the problem rather than solving it. Someone holds the decryption key, and in Moscow, as shown below, that key was the weak point.
The voter’s phone is the weak point, not the ledger
A blockchain protects data after it arrives. It knows nothing about what happened before. If malware on a phone changes a vote from candidate A to candidate B before the app signs and sends it, the chain will faithfully record B forever.
The US National Academies of Sciences, Engineering, and Medicine made the same point in “Securing the Vote: Protecting American Democracy”, their 2018 report: if malware on a voter’s device alters a vote before it ever reaches a blockchain, “the immutability of the blockchain fails to provide the desired integrity, and the voter may never know of the alteration.” Park and her co-authors add that an examination of the device may not reveal the malware, and that even computers kept off any network have been infected in the past.
Immutability, in other words, protects the wrong thing. It is valuable once the right data is in. Voting’s hardest problem is making sure the right data goes in.
Keys, deadlines and fees
Every blockchain vote is a signed transaction, so every voter needs a private key. The 2020 draft spells out the consequence: lose the key and you cannot vote; let someone steal it and they can vote as you without anyone noticing. Crypto users know this risk well, and our guide to private and public keys explains why a key is the only proof of ownership a chain accepts. An election would also need a secure directory linking each key to one real voter, which brings back the trusted authority the chain was supposed to remove.
Elections also have a closing time. On a public chain, blocks have limited room and transactions pay fees. The paper notes that an attacker willing to spend enough could flood the network, push fees up and delay votes until after the cutoff. Smaller chains have another weakness: their history has been rewritten by attackers controlling most of the mining or validating power. The authors write that blockchains are often called immutable, “but these attacks show that this is not always true in practice.” Our guide on whether a blockchain can be hacked covers those rewrites.
Permissioned chains trade one problem for another
Most real pilots did not use a public chain. They used a permissioned one, where only approved computers keep the ledger (the difference is explained in public vs private blockchains). That removes fees and outsiders, but the MIT authors point to a dilemma. If ordinary voters cannot read the chain, they cannot verify the tally. If they can read it, they can again prove how they voted. And a few servers chosen by the organiser, often running the same software, are easier to compromise together than a large open network.
What a chain contributes, in their view, is narrow. Cryptographers have long used a public bulletin board, a shared, append-only list where encrypted ballots are posted. In the authors’ words, blockchain technology “does not add anything beyond a way of implementing a public bulletin board”, and simpler, more reliable ways exist, such as traditional databases.
Advanced cryptography can help. Zero-knowledge proofs let a system show that a tally is correct without revealing individual votes, and they predate blockchains by decades. The paper says they may be useful for verifiable voting but are not enough alone: they do nothing about a hacked phone or a stolen key.
What US official bodies concluded
The National Academies’ Recommendation 5.11 says the internet, or any network connected to it, “should not be used for the return of marked ballots” until much stronger guarantees of security and verifiability exist. That is about internet voting in general. On ledgers, the same chapter says the idea of a blockchain as an immutable ballot box may look promising, but that blockchain technology “does little to solve the fundamental security issues of elections” and adds vulnerabilities of its own.
Four federal bodies, the Cybersecurity and Infrastructure Security Agency (CISA), the Election Assistance Commission, the FBI and NIST, wrote joint guidance on electronic ballot delivery, marking and return for state officials in 2020. For the 2024 cycle the four bodies reclassified and redistributed it, so that officials are “fully informed of risks associated with electronic ballot return”, and states on its page that the guidance remains operative.
Estonia: two decades of internet voting without a blockchain
Estonia is the example everyone cites, often wrongly, as a blockchain election. It is the reverse: the only country that has used internet voting at national scale for twenty years, built on a national ID card and digital signatures. Nothing in the official descriptions of the system, or in the main independent security study of it, involves a blockchain.
How an Estonian i-vote travels
Estonians first voted online in the 2005 local elections. To vote, a citizen uses the ID card, Mobile-ID or Smart-ID, and a computer running the voter application; the national ID portal states that phones and tablets cannot be used to cast the vote. A first PIN logs the voter in, a second one signs the ballot.
A team from the University of Michigan and independent experts, led by J. Alex Halderman, described the architecture in their security analysis of the system (Springall et al., ACM CCS, November 2014). The voter application encrypts the choice with the election’s public key, a 2,048-bit RSA key in that study, and the voter’s ID card signs the encrypted ballot. The design copies the double envelope of postal voting: the signature is the outer envelope that shows who voted, the encryption is the inner envelope that hides the choice.
The ballots then pass through ordinary servers. In the 2014 description, a vote forwarding server faced the internet and checked eligibility, a vote storage server kept the signed, encrypted ballots, and a separate vote counting server, never connected to a network, held the election’s private key in a hardware security module. After voting closed, officials stripped the signatures, carried the anonymous encrypted ballots to the counting machine on a DVD, decrypted them and added the totals to the paper count. The system has been updated since 2014, but the principle, signatures for identity and encryption for secrecy, is unchanged.
Re-voting and paper as the answer to coercion
Estonia’s defence against a boss looking over your shoulder is not cryptography. During the online period, which runs from the tenth day before election day to the fourth day before, you may vote as many times as you like. In the words of the official ID portal, “Only the last vote counts!” A voter who also casts a paper ballot at a polling station cancels all their online votes, and only the paper ballot counts.
That rule needs a system that can throw ballots away, which is exactly what an immutable ledger is designed not to do. It is one reason why Estonia’s approach and a blockchain sit awkwardly together.
Checking your own vote
Voters can check their own ballot, a feature the 2014 study already describes. A phone app, published by the election authority, reads a QR code shown after voting, downloads the encrypted vote from the central server and shows the choice on the phone. According to the election authority’s instructions, a vote can be checked up to three times within half an hour, and the app closes after 30 seconds. The check is meant to reveal a compromised voting computer; it does not let anyone else see your vote later.
Turnout online has grown from almost nothing to the majority of votes cast in the 2023 parliamentary election, according to the election authority’s statistics (the national ID portal rounds the 2023 share to 51.2 percent).
| Election | Internet voters | Share of eligible voters | Share of those who voted |
|---|---|---|---|
| Local, October 2005 (first) | 9,317 | 0.9% | 1.9% |
| Parliament, 2007 | 30,275 | 3.4% | 5.5% |
| Parliament, 2015 | 176,491 | 19.6% | 30.5% |
| Parliament, 2019 | 247,232 | 27.9% | 43.8% |
| Local, 2021 | 275,587 | 25.7% | 46.9% |
| Parliament, March 2023 | 313,514 | 32.5% | 51.1% |
| European Parliament, 2024 | 153,848 | 15.7% | 41.7% |
Source: valimised.ee, statistics about internet voting in Estonia, consulted 26 October 2026. The page publishes no 2025 figures yet.
What the critics found
Estonia’s record does not mean the experts approve of it. The 2014 Michigan team observed elections in person, reviewed the code and attacked a reproduction of the system in their lab. They found “serious architectural limitations and procedural gaps that potentially jeopardize the integrity of elections”, showed how attackers could target either the servers or voters’ computers to change results, and recommended that Estonia discontinue internet voting. According to the paper, Estonia’s National Electoral Committee replied that the threats were already accounted for in the design and that the attacks were infeasible; its Internet Voting Committee held that the system “is as reliable and secure as voting in [the] traditional way”. Estonia kept internet voting.
The lesson for ledger-based voting is indirect but clear. What makes Estonia work is a national ID card that carries a legally binding digital signature, twenty years of practice and the paper override. What the critics worry about is the voter’s computer and trust in a few servers. A ledger would fix none of that.
Blockchain voting experiments and what they showed
A handful of public bodies have actually put votes on a blockchain. The tests were tiny, or their encryption broke, and in Moscow both problems showed up at a larger scale.
Zug, 2018: a 72-person trial
The Swiss town of Zug, home of many crypto companies, ran a consultative municipal vote on a blockchain platform between 25 June and 1 July 2018. The software firm Luxoft built it on Hyperledger Fabric, a permissioned blockchain, and connected it to the town’s Ethereum-based digital ID app (uPort), according to Luxoft’s announcement of 25 June 2018. According to Luxoft’s report published on 30 November 2018, more than 220 residents had the required digital ID and 72 voted. In the town’s follow-up survey of 95 residents, 79 percent welcomed e-voting in the city and 21 percent said blockchain made it more secure.
The vote had no legal effect. It showed that the software ran, not that it would hold up in a contested election.
West Virginia and Voatz, 2018 to 2020
In the November 2018 midterms, West Virginia became the first US state to let some voters cast a ballot in a federal election on a phone, through an app from the Boston company Voatz. The pilot was aimed at voters abroad: service members, Peace Corps volunteers and other citizens living overseas. The state said an estimated 144 people in about 30 countries used it, GovTech reported on 9 November 2018, and that it had no plans to offer mobile voting to voters at home. Voatz has also been used in Denver, Oregon and Utah, according to the MIT researchers.
Voatz said security came from a permissioned blockchain, biometrics, a mixnet and hardware key storage on the phone, but published no formal description. So three MIT researchers, Michael Specter, James Koppel and Daniel Weitzner, reverse-engineered the Android app and rebuilt the server side. Their paper, “The Ballot is Busted Before the Blockchain”, made public on 13 February 2020, found flaws that let attackers “alter, stop, or expose a user’s vote”, including an attack in which someone who only watches network traffic could potentially recover a secret ballot.
The title is the finding. Whoever controls the phone controls the vote before the chain sees it, and the authors judged that the blockchain was unlikely to protect against attacks on the server either. They also noted that, according to Voatz’s own documentation of the West Virginia election, the servers checking the chain were split between Amazon’s and Microsoft’s clouds, two companies that could in theory control the whole ledger. The researchers reported the flaws to CISA before publishing. Voatz disputed the findings, saying the team had examined an older version of the app, NBC News reported.
Moscow, 2019: one blockchain, two attacks
For the Moscow City Duma election of 8 September 2019, voters in 3 of the 45 electoral districts could register to vote online. The system, run by the city’s Department of Information Technology, used an Ethereum blockchain whose nodes were chosen by the organisers, with ballots encrypted using a variant of ElGamal, a classic public-key scheme. On 17 July 2019 part of the code was published, with a bounty of up to 2 million rubles (about $30,000 at the time) for anyone who could break it.
Pierrick Gaudry, of France’s CNRS, Inria and the University of Lorraine, and Alexander Golovnev, of Harvard, broke it twice.
- First attack: the keys were too small, under 256 bits each, even with three layers of encryption. The authors explained how to recover the private keys from the public ones “in a matter of minutes with easily available resources”. Since the public keys had to be published when voting opened, the ballots on the chain would have been readable all day, giving away partial results, which Russian law forbids before polls close.
- Second attack: after the first report, the developers raised the key size to 1,024 bits and switched to a single layer of encryption. The new version leaked enough information to count the votes cast for a candidate, a weakness the authors describe as a lack of semantic security.
Both issues were fixed after the authors reported them, the second only two days before the vote. Park and her MIT co-authors later wrote that Moscow responded constructively to the first flaw but appeared largely to ignore the second.
Election day showed the limits of the ledger itself. According to the organisers, more than 10,000 Muscovites voted online, and in one district the gap between the first two candidates was under 100 votes. The decryption key was posted to the blockchain once polls closed, and a few hours later the organisers cut public access to the chain. Analysts at the newspaper Meduza had recorded the data and decrypted the 9,810 ballots they found. The head of Russia’s Central Election Commission, Ella Pamfilova, then publicly expressed concern about the experiment, according to Gaudry and Golovnev. Their own conclusion: using a blockchain “is not enough to guarantee full transparency”, especially a permissioned one whose access can be cut at any time.
Sierra Leone, 2018: a claim the election authority rejected
In a press release of 8 March 2018, the Swiss startup Agora presented Sierra Leone’s general election of 7 March as the first time in history that blockchain had been used in a national government election. The National Electoral Commission disagreed. As Bitcoin Magazine reported on 22 March 2018, citing RFI, the commission said Agora had only been given observer status, that its involvement was not official and that it had tallied votes in two western districts on its own, with results that differed from the official ones. Agora’s own release had spoken of publishing figures days before “the usual manual count”. The company later said its participation was meant as a proof of concept.
| Case | Date | Scale | Technology | What it showed |
|---|---|---|---|---|
| Zug, Switzerland | 25 June to 1 July 2018 | 220 eligible, 72 voted | Hyperledger Fabric with an Ethereum-based ID | Software ran; no legal effect |
| Sierra Leone (claim) | March 2018 | Two districts, unofficial tally | Agora’s ledger as an observer | Election authority said Agora was only an observer |
| West Virginia, Voatz | November 2018 | About 144 voters in about 30 countries | Phone app with permissioned chain | MIT, February 2020: votes could be altered, stopped or exposed |
| Moscow City Duma | 8 September 2019 | 3 of 45 districts, over 10,000 online voters | Permissioned Ethereum, ElGamal | Keys recoverable in minutes; second flaw after the fix |
| Estonia (not blockchain) | Since 2005; March 2023 | 313,514 online voters in 2023 | ID-card signatures and encryption | Works at scale; criticised over servers and voters’ computers |
What the tests have in common
None of them removed the need to trust the organiser. In Zug and West Virginia the chain was run by the vendor’s chosen computers. In Moscow the city could switch the ledger off, and did. In each case the device, the encryption or the servers decided the outcome, and the blockchain only recorded what it was given, the same limit our lesson on blockchain in supply chains found with goods: a ledger cannot check what is fed into it.
DAO voting: where on-chain votes are normal
There is one place where votes on a blockchain happen every day: the governance of crypto protocols, often run as DAOs (decentralised autonomous organisations). Holders of a governance token vote on proposals such as fee changes, treasury spending or code upgrades. Uniswap, Compound and Aave all work this way; our Aave project page describes one of those governance tokens.
It works there because the problem is different. Nobody expects a secret ballot; votes are public on purpose. There is no one-person-one-vote rule: one token is one vote, so a large holder weighs more, which is closer to a shareholder meeting than to an election. And the voters already hold keys and wallets. Many DAOs poll on Snapshot, which, according to its documentation, is offchain and lets users vote without gas fees; the binding step then happens on-chain, where a smart contract executes the approved proposal.
On-chain governance has also failed in ways that would be unthinkable in a public election. On 17 April 2022, at about 12:24 UTC, an attacker used a flash loan, a loan borrowed and repaid within one transaction, to take over the governance of the stablecoin protocol Beanstalk. Cointelegraph reported on 18 April 2022 that the attacker took out $1 billion in flash loans from Aave, used them to take over 67 percent of the governance and passed proposals (BIP-18 and BIP-19) that asked the protocol to donate funds to Ukraine but carried a malicious rider. Beanstalk’s own post-mortem says about $77 million in non-Beanstalk user assets was stolen; Cointelegraph, citing the security firm PeckShield, put the protocol’s total loss at about $182 million and said the attacker left with roughly $80 million in ether and BEAN. The votes were valid by the rules: the money was simply borrowed.
On 20 May 2023, Tornado Cash’s governance approved what looked like a copy of an earlier, accepted upgrade. It contained an extra function. Once it passed, the attacker granted themselves 1.2 million extra votes and effective control of governance, according to The Block, citing the security researcher samczsun. About 483,000 TORN tokens were taken from the governance vault, according to the on-chain analyst EmberCN quoted by The Block, and Binance suspended TORN deposits and withdrawals. The attacker has not been publicly identified.
These failures are not about secrecy or coercion. They come from votes that can be bought, borrowed or tricked, from proposals that few people read, and from voting power concentrated in a few wallets. DAO voting is a useful tool for running software. It is not a model for choosing a government.
Online voting in the US and the UK in 2026
US elections are run by the states, and the federal advice they receive points one way. The National Academies recommended in 2018 that marked ballots not be returned over the internet, and the CISA, EAC, FBI and NIST guidance on electronic ballot return, first written in 2020, remains operative according to CISA as of October 2026. The US experiments with phone voting, West Virginia and the other Voatz pilots, were limited to small groups such as military and overseas voters.
For the United Kingdom the answer is shorter. The government’s official guide lists three ways to vote, in person, by post or by proxy, and says: “You cannot vote online in any elections.” England did test internet and telephone voting in local elections in the 2000s. After pilots in 13 English councils in May 2007, the Electoral Commission said it saw no merit in continuing with “small-scale, piecemeal piloting”, The Register reported on 2 August 2007, and asked for a clear strategy and better security first.
Neither country uses a blockchain in any official election, and no official body in either has endorsed one.
What should you ask before trusting an online voting system?
Pitches for blockchain voting will keep coming, from startups, candidates and sometimes election officials. The questions below come from the five requirements and the closing questions of the MIT paper, and they apply whether or not a ledger is involved.
- Can a voter prove to someone else how they voted? If yes, vote buying and coercion become easy.
- What happens if the voter’s phone or computer is infected? A good answer involves something outside the device, such as paper or an independent check.
- If the software is wrong, would anyone notice, and could the result be corrected without trusting the same software?
- Who runs the servers or nodes, and can they switch them off, as Moscow’s organisers did with their chain in 2019?
- Has the full design been published and tested by independent researchers, rather than just by auditors the vendor paid?
- Is there a paper record or another way to recount if the result is disputed?
If the answers rest on the word blockchain alone, the system has not answered the questions. The next lesson of this path moves to healthcare records, where the same gap between what a ledger stores and what happens around it returns.
