Quantus

Quantus is a post-quantum secure Layer 1 blockchain that describes itself as "quantum-secure encrypted money," built from the ground up to protect stored value against attacks by future quantum computers, and was founded by CEO and co-founder Yuvi Lightman, originating with the Heisenberg Inception milestone in December 2024. Rather than adding quantum defenses to an existing chain, the project uses a purpose-built architecture that adopts NIST-standardized post-quantum cryptography for signatures, key exchange, and node communications, and pairs it with zero-knowledge proof aggregation to keep transaction throughput high despite the larger size of quantum-resistant signatures.^[1]​^[2] Quantus launched its Bell mainnet as a proof-of-work network in September 2026, with QTC as its native coin distributed through open mining from genesis.^[7]​^[8]​

Overview

Quantus's rationale rests on the argument that the cryptography securing every major blockchain will eventually be broken by a cryptographically relevant quantum computer. Traditional chains rely on the hardness of the discrete logarithm problem, and the project points to Shor's algorithm, which can solve that problem exponentially faster than classical computers and could allow an attacker to derive a private key from a public key.^[4] The project's whitepaper cites an estimated requirement of roughly 2,000 logical qubits for an attacker to threaten typical blockchain asymmetric cryptography, while the home page presents a figure of 824 logical qubits as the number required to break Bitcoin.^[4]​^[5] Quantus lists Bitcoin and Ethereum (both using ECDSA-256) and Solana (using ED25519) as vulnerable to quantum attack.^[5]​

The whitepaper enumerates four categories of quantum threat: forging digital signatures by breaking elliptic-curve schemes such as Bitcoin's secp256k1; forging false zero-knowledge proofs so that invalid proofs appear valid and permit minting or state falsification; decrypting secret information in privacy protocols and peer-to-peer communications; and reversing hash functions, described as the least concerning threat. The first three stem from Shor's algorithm, while the last relates to Grover's algorithm, which provides a quadratic speedup for unstructured search and effectively halves symmetric-key security. Quantus notes that Grover's algorithm can be mitigated by doubling symmetric key sizes and characterizes it as impractical given its high qubit and gate requirements.^[4]​

A central part of the argument concerns what the project calls the migration crisis: even if existing chains adopt post-quantum cryptography, coordinating an upgrade would require agreement on migration timelines, potential coin seizure, block-size increases, and every holder moving their coins. The whitepaper estimates that between $250 billion and $500 billion worth of Bitcoin is permanently inaccessible because of lost keys, deceased holders, or forgotten wallets, and argues that these unmigrated public keys form a public bounty for a quantum attacker. It states that "the only technical solution requires a hard deadline that freezes unmigrated coins — a political impossibility," and presents building quantum security into a new chain from day one as the way to sidestep that problem.^[4]​

Technology and Architecture

Quantus is built on Substrate, the blockchain software development kit from Parity Technologies, a major contributor to Ethereum and the core development company behind Polkadot. The project extends Substrate by adding support for post-quantum signature schemes, upgrading peer-to-peer networking security to be post-quantum, adding user-controlled transaction reversibility, and aligning database data types to field-element boundaries so they are friendly to zero-knowledge proving systems.^[4] The project states that because its foundation is post-quantum from the start, no migration from an existing blockchain is required.^[2]​

Post-Quantum Cryptography

Every transaction on the Quantus network is signed with ML-DSA-65 or ML-DSA-87, parameter sets of the Module-Lattice-based Digital Signature Algorithm (formerly CRYSTALS-Dilithium), standardized by NIST as FIPS 204 in 2024.^[7]​^[8] The scheme's security rests on the hardness of the Learning With Errors and Short Integer Solution problems over module lattices, a class of problems the project says quantum computers cannot solve efficiently. ML-DSA-87 corresponds to NIST Security Level 5, equivalent to 256-bit classical and 128-bit quantum security. Quantus states that ML-DSA is being adopted by organizations including Cloudflare and Signal, and contrasts it with the ECDSA used by classical blockchains, which it categorizes at NIST Level 1 and vulnerable to Shor's algorithm.^[2]​^[4]​

The whitepaper records that Quantus considered and rejected alternatives: FN-DSA (Falcon) was rejected for its implementation complexity involving floating-point operations, its lack of deterministic key generation, and its non-finalized status, while the hash-based SLH-DSA was rejected because its signatures exceed 17 KB. The project notes that crypto-agility is built into Substrate so signature schemes can be swapped later if needed.^[4] Poseidon2 serves as the hash function throughout the system, chosen because it is algebraic over field elements and reduces the gate counts of SNARK and STARK proof circuits compared with SHA-256.^[1]​^[4]​

Networking is secured at the peer-to-peer layer using ML-DSA-87 signatures for peer identity and ML-KEM-768 — the Module-Lattice-based Key Encapsulation Mechanism (formerly CRYSTALS-Kyber), standardized as FIPS 203 — for transport encryption. Quantus extends the Noise handshake protocol used by libp2p with an additional key-encapsulation message to establish quantum-resistant shared secrets, so that, in the project's words, there is "no weak point in the stack."^[4]​^[2] The project also names ML-KEM as securing peer links in its CoinGecko listing.^[3]​

Wormhole Addresses and ZK Scaling

Post-quantum signatures are far larger than classical ones, which creates a scaling problem. The whitepaper's comparison gives ML-DSA-87 a public key of 2,592 bytes, a private key of 4,896 bytes, and a signature of 4,627 bytes, against ECDSA's 32-byte keys and 65-byte signatures — signatures over 70 times larger and public keys more than 80 times larger. Without architectural changes, the project notes, such sizes would bloat transactions and cut throughput; it states that Bitcoin, for example, would have well under 1 TPS under post-quantum cryptography if its block size were not increased.^[4]​

Quantus addresses this with "Wormhole Addresses," an aggregated post-quantum signature scheme that uses zero-knowledge proofs to move balance verification off-chain, so the chain verifies a single compact proof instead of many individual signatures. The scheme is built on the Plonky2 proving system — described as "basically STARKs" — with Poseidon2 as the commitment hash via the FRI protocol, and it reduces the amortized per-transaction storage to roughly 256 additional bytes.^[4] A user can generate a provably unspendable address by double-hashing a salt concatenated with a secret; tokens sent there are effectively burned and can be re-minted without inflating supply. Each transfer creates a TransferProof storage object, double-spends are prevented by nullifiers, and the wallet generates a Merkle-Patricia-Trie storage proof from a recent block header. Any party — client, miner, or third party — can aggregate multiple proofs through Plonky2 recursion into a tree of proofs, and the network verifies the aggregate by checking that the referenced block hash is on-chain and recent, that nullifiers are unique, and that the proof is valid.^[4]​

The documentation states that Wormhole aggregation reduces per-transaction on-chain data from about 7,219 bytes to an amortized few bytes shared across an aggregated proof of roughly 100 KB, increasing throughput from an estimated ~685 TPS without Wormhole to approximately 3,800 TPS, a ~5.5× improvement.^[9] The documentation summarizes the result as "thousands of transactions, one compact proof, verified on-chain."^[2] Plonky2 was chosen because it is already audited, post-quantum, requires no trusted setup, offers efficient proving and verification and seamless aggregation, and has a Rust-native implementation compatible with Substrate's no-std environment. Quantus uses the Goldilocks field for both Poseidon2 and Plonky2, chosen because its order fits within an unsigned 64-bit integer for efficiency.^[4] The documentation describes the Wormhole and ZK scaling subsystem as covering privacy-preserving addresses and proof aggregation targeting ~3,800 TPS.^[1]​

Consensus and Mining

Quantus uses Proof-of-Work consensus, which it describes as the "same battle-tested model as Bitcoin," with one change: SHA-256 is replaced by Poseidon2 so that the zero-knowledge infrastructure is native and efficient rather than "bolted on." The whitepaper stresses this substitution is for zero-knowledge efficiency, not quantum security.^[2]​^[4] The documentation describes the consensus and mining subsystem in terms of lattice-based proof of work and mining economics, and lists an External Miner Protocol with a QUIC protocol specification for custom miner implementations, alongside a guide for setting up a node, starting mining, or running a non-mining full node.^[1] The project has stated that the only way to obtain Quantus coins is to mine them.^[6] For cross-chain connectivity, the documentation lists a NEAR integration as a bridge and interoperability layer.^[1]​

User Safety and Wealth Preservation

Quantus positions a set of user-protection features as capabilities it claims do not exist elsewhere in crypto, aimed at guarding against theft, coercion, and user error such as "wrench attacks," fat-fingered transactions, and lost funds.^[1] These are enforced on-chain to preserve decentralization.

• Reversible transactions. Senders can set a user-configurable time window during which they can cancel an outgoing transfer, implemented through a modified Substrate scheduler pallet using timestamps, with wallets displaying countdowns for both sender and recipient.^[4]
• High-security accounts. Any account can be upgraded so that all outgoing transfers carry mandatory reversal periods, during which a designated guardian — a hardware wallet, multisig, or trusted third party — can cancel a suspicious transaction and redirect the funds to the guardian. The upgrade is permanent once activated, and guardians can be chained, so a guardian may itself be a high-security account with its own guardian, forming composable hierarchies in which each guardian holds superior permissions over the account it protects.^[4]
• Key recovery. An account can specify a recovery address that can pull funds after a fixed delay, during which the owner can deny the recovery if they still hold the key — a mechanism the project describes as on-chain survivorship without courts or estates.^[4]
• Check-phrases. A cryptographically secure, human-readable checksum for addresses is produced by hashing an address into memorable words drawn from the BIP-39 mnemonic list, with a 50,000-iteration key derivation function to make rainbow-table attacks expensive; the project still recommends verifying every character for large transactions.^[4]

The project also describes an unresolved research area it calls HD-Lattice, an effort to adapt hierarchical-deterministic wallet concepts to lattice schemes. It identifies two challenges: HMAC-SHA512 output cannot directly form a lattice private key, which Quantus works around by using that output as entropy to deterministically construct the key; and non-hardened key derivation, which normally relies on elliptic-curve addition absent in lattices, is described as an open research question.^[4]​

Tokenomics

Quantus has a maximum supply of 21,000,000 coins. Its block reward is set by the formula (max_supply − current_supply) / constant, with the constant chosen so that, absent burns, 99% of coins are emitted over roughly 30 years.^[4] Private investors and the team are both subject to a four-year vesting schedule, while public-sale investors are fully liquid on day one; funds raised in the public sale are matched with tokens and used for liquidity across decentralized exchanges, centralized exchanges, and market makers. Investor allocations and liquidity are described as the only pre-mine, and if less than the maximum 10% is sold in the public sale, the liquidity tokens are reduced correspondingly and the remainder is emitted to miners through block rewards. A portion of the block reward is directed to the company for approximately four years, yielding a de facto vesting of about 15% of total supply, after which token holders can vote to turn off, adjust, or redirect that portion.^[4]​

The fee structure varies by transaction type. Standard transactions pay a fixed fee to miners. Reversed high-security transactions pay a 1% volume-based fee that is burned. ZK-aggregated transactions pay a 0.1% volume-based fee split evenly between miners and burning.^[4]​

The project's ticker has been presented inconsistently across sources. Quantus has presented QTC as the ticker and native coin of its mainnet, while CoinGecko lists the coin under the ticker QUAN and categorizes it as a Layer-1, Proof-of-Work, quantum-resistant asset; CoinGecko states that a price is not yet available and that QUAN is not currently tradable on its listed exchanges.^[7]​^[8]​^[6]​^[3]​

Governance

Quantus inherits Polkadot's OpenGov framework through Substrate. Governance uses conviction voting, in which locking assets amplifies vote weight from 1× with no lock up to 6× at the maximum lockup, and proposals are sorted into multiple voting tracks called "origins," each with its own approval thresholds, minimum deposits, preparation and enactment periods, and decision timelines. A Technical Collective — a curated group of technical experts — proposes, reviews, and whitelists urgent technical matters through a dedicated track.^[4] The network launches in a deliberately minimal configuration, with only the Technical Collective track active for binding, high-privilege decisions such as protocol upgrades and parameter changes; the project plans to add a non-binding community vote track later and to phase binding governance over to a DAO when the company hands the network over.^[4]​

Protocol changes are delivered through Substrate's forkless runtime upgrades: an approved on-chain referendum triggers a WebAssembly runtime swap in a single block, without a hard fork. The project states that as community confidence grows, the power to change the runtime will be significantly reduced.^[4] Implementation specifics across the protocol are delegated to a series of internal proposals referenced as QIP-0002, QIP-0004, QIP-0005, QIP-0006, QIP-0008, QIP-0009, and QIP-0011.^[4]​

Development History and Roadmap

The whitepaper, authored by Christopher Smith and classified as public, reached version v0.3.3 on March 21, 2026, with an earlier v0.3.1 published in January 2026. It states plainly that it is informational only and not an offer to sell or a solicitation of purchases.^[4] The project's development has proceeded through a series of named milestones:

• Heisenberg Inception (December 2024) — funding secured and Substrate chosen as the foundation.^[4]
• Resonance Alpha (July 2025) — public testnet with Dilithium signatures and reversible transactions.^[4]
• Schrödinger Beta (October 2025) — feature-complete and ready for audit.^[4]
• Dirac Beta (November 2025) — Proof-of-Work changed to Poseidon2 and audit findings addressed.^[4]
• Planck Beta (January 2026) — high-security accounts, multisigs, hardware wallet support, and zero-knowledge integration; the current testnet is branded "built on Planck testnet."^[4][5]
• Bell Mainnet (planned for Q2 2026) — is a roadmap target for mainnet launch, with the exact launch date not yet announced.^[4]
• Fermi Upgrade (Q4 2026) — zero-knowledge proof aggregation infrastructure.^[4]

The project's weekly updates in mid-2026 recorded a run of incremental progress. In July 2026 it launched encrypted accounts in the wallet, offering local zero-knowledge proofs and private transfers, alongside runtime v0.8.0 with second-layer aggregation and Keystone clear signing; it also shipped a redesigned block explorer at explorer.quantus.com with wormhole visibility, Subsquid indexing, and wallet version 1.5.7, and noted that its work had received coverage from Reuters. In August 2026 the project ran a public Immunefi bug bounty from August 12 to 24 and reported work on ML-DSA-65 alongside ML-DSA-87, security hardening, and Senoti high-availability and Keystone production designs.^[5] The whitepaper's stated risks include implementation flaws in software logic, the possibility of flaws or backdoors in NIST's selected algorithms ML-DSA or ML-KEM, uncertainty in the quantum-computing timeline, and broader concerns around adoption, regulation, and crypto volatility.^[4]​