Ethereum & EVM
ECDSA secp256k1
One-transaction sweep into a post-quantum account, or harden in place via EIP-7702.
Migrationshipped
GOOGLE QUANTUM AI · MAR 2026/~1,200 logical qubits to break secp256k1
Your public key is already published.Shor's algorithm turns it into your private key.
Every transaction you have signed put your public key on chain. PQWeave measures that exposure across 16 chains, and moves EVM wallets behind a post-quantum signature a quantum computer cannot forge. Bitcoin, Solana and Stellar get the honest version of the same idea — not a promise the protocol cannot keep.
carried in the signaturerecomputed by the verifier
~1,200logical qubits
to derive a secp256k1 private key, in minutes of runtime
Google Quantum AI, Mar 2026
34% of BTC
had already revealed a public key on chain by 1 March 2026
BIP-361
41% odds
of a key being derived before a Bitcoin transaction confirms
Google Quantum AI, Mar 2026
16chains
scanned live across all three exposure families
This repository
What a chain lets you do about it
Scanning and protecting are different problems. How a chain publishes public keys decides which fix is even possible — so the work in progress below is the shape the cryptography allows, not a roadmap we invented.
- Scanning
- 16
- Protection shipped
- 4
Bitcoin
ECDSA / Schnorr
Watch-only PSBT sweeps, whole-wallet xpub scanning, on-chain key attestation, BIP-360/361 tracking.
Evacuation kitshipped
Solana
Ed25519
Vault program live on devnet. Hash-based signature verified on-chain, one-time leaf enforced.
PQ vaultshipped
Stellar
Ed25519
Soroban custom-account vault uploaded to testnet. Verification fits in one transaction.
PQ vaultshipped
Litecoin
ECDSA secp256k1
Shares Bitcoin’s UTXO model, so the evacuation kit ports directly.
Evacuation kitporting Bitcoin’s kit
Dogecoin
ECDSA secp256k1
UTXO chain; the same watch-only sweep applies.
Evacuation kitporting Bitcoin’s kit
Cardano
Ed25519
Key stays behind a hash until first spend, so evacuation is the right shape.
Evacuation kitporting Bitcoin’s kit
Cosmos
ECDSA secp256k1
Account key revealed on the first signature; evacuation path in design.
Evacuation kitporting Bitcoin’s kit
XRP Ledger
Ed25519 / secp256k1
Key revealed on the first send, which is the oldest transaction — the scanner reads forward for it.
Evacuation kitporting Bitcoin’s kit
Aptos
Ed25519
Address is a hash of the key until the account transacts.
Evacuation kitporting Bitcoin’s kit
Sui
Ed25519
Key revealed once the account sends, so the same watch-only sweep applies.
Evacuation kitporting Bitcoin’s kit
TON
Ed25519
The wallet contract publishes its key on deployment.
Evacuation kitporting Bitcoin’s kit
Tron
ECDSA secp256k1
Key revealed on the first signed transaction.
Evacuation kitporting Bitcoin’s kit
NEAR
Ed25519
Implicit accounts are the public key itself; a vault is the only honest fix.
PQ vaultporting the vault
Algorand
Ed25519
Address encodes the key directly, so exposure is permanent from creation.
PQ vaultporting the vault
Polkadot
sr25519
SS58 addresses encode the public key; exposure is structural.
PQ vaultporting the vault
Bitcoin Cash
ECDSA secp256k1
Scanner is written; blocked on a public indexer that is not rate-walled.
Evacuation kitporting Bitcoin’s kit
Shipped August 2026
The same security, an order of magnitude cheaper
A Lamport signature has to transmit its one-time public key so the chain can rebuild the Merkle leaf. Winternitz derives that key by finishing each hash chain instead, so nothing but the chain values travel. Identical assumption — keccak256 preimage resistance, nothing lattice-based — at a tenth of the calldata.
Signature size10.7× smaller
Lamport24,736bytes
Winternitz2,304bytes
Total gas, all in2.6× smaller
Lamport670,062gas
Winternitz254,218gas
BIP-361
A second clock on every bitcoin address
Quantum exposure is a fact about your address. The proposed signature sunset is a policy that would freeze legacy outputs whether or not a key ever leaked. The draft does not resolve its own scope, so the scanner reports both readings rather than guessing one.
See the phase timelineBIP-2198
A hazard we found in our own shipped code
BIP-360 was amended so a single-leaf script tree is anyone-can-spend on purpose, to stop wallets dropping a post-quantum fallback leaf. Our tree builder accepted one leaf, and a test asserted it was correct. Now a two-leaf minimum is enforced at both layers.
Read the security modelScan, migrate, start clean
Measure the exposure, move an existing wallet behind a post-quantum signature, or begin on an account that never had a vulnerable key to begin with.
01
Scan
Check whether an address has published its public key and score the exposure — 16 chains, three exposure families, no wallet connection.
Open the scanner02
Migrate
Sweep an entire EVM wallet — native, ERC-20 and NFTs — into a post-quantum account in one EIP-7702 transaction, or keep the address and harden it in place.
Migrate a wallet03
Start clean
New accounts are post-quantum from the first block, with a counterfactual address safe to fund before it is even deployed.
Create an accountA circuit-breaker, not a rip-and-replace
ECDSA keeps signing routine activity, so the wallet still feels like the wallet. The moment an operation gets dangerous — a large transfer, a token approval, an account change — a second post-quantum signature is required. Break the ECDSA key and the gate still holds.
- Large native transfers above a configurable threshold
- Token approvals (approve / setApprovalForAll)
- Administrative changes: key rotation, verifier swap, owner change
Fully quantum-safe means removing ECDSA from the trust model entirely — sweeping into an account where the post-quantum key is sole authority. Keeping your old address is always transitional, because an EIP-7702 delegation stays revocable by the ECDSA key.
Pluggable verifiersIPQCVerifier
Winternitz + MerkleWOTS+, keccak256
Default. Same construction family as Ethereum’s leanSig. 2,304-byte signatures.
Lamport + MerkleHash-based, keccak256
The original verifier, still deployed. Simpler to audit, 10x larger on the wire.
Falcon-512FIPS 206
Blocked: FIPS 206 is still a draft, expected final late 2026. Pluggable when it lands.
Shipped, building, blocked
Including the blocked column, because two of the most important items are waiting on things no amount of code will fix — an independent auditor, and a NIST standard that is not finished.
Shipped16 chains
Exposure scanner
Detects published public keys across all three exposure families and scores value at risk. Free, instant, no wallet connection.
ShippedTestnet
EVM migration
One EIP-7702 transaction sweeps native, ERC-20 and NFTs into a post-quantum account. Deployed to Base Sepolia, proven through the real EntryPoint.
ShippedWatch-only
Bitcoin suite
PSBT evacuation kit, whole-wallet xpub scanning, on-chain key attestation, and BIP-360/361 tracking. Keys never touch us.
ShippedDevnet / testnet
Non-EVM vaults
Solana and Stellar vaults verify the same hash-based key on chain. Custody, not migration — the original address stays exposed, and we say so.
BuildingBy family
Remaining chains
Porting the evacuation kit to the other first-spend chains, and the vault pattern to the address-is-the-key chains.
BuildingDesign
Partner APIs
Bulk exposure and migration endpoints for wallets, exchanges and custodians who need to move many users at once.
BlockedNeeds funding
External audit
Scope is frozen and the money path is property-tested, but an audit cannot be done by the author of the code. Nothing here is audited yet.
BlockedFIPS 206 draft
Falcon verifier
The compact lattice signature would suit on-chain verification best. Its standard is still a draft, which is exactly why the default stays hash-based.
Build the migration layer with us.
Wallets, exchanges, and custodians: integrate quantum-safe detection and migration through the PQWeave SDK and partner APIs. We're onboarding launch partners now.