Every plan to save crypto from quantum computers shares one awkward assumption: that hundreds of millions of wallet holders, including the dead, the locked-out and the legally constrained, will one day move their funds on command. What if the entire premise is unnecessary?
A technical paper released today argues exactly that, and whether or not its claims survive peer review, the question it raises about migration-based security deserves more scrutiny than it has been getting.
AmericanFortress, the Wyoming-based company building what it calls a universal privacy layer for blockchains, today published ZK-PoSP, a post-quantum security scheme for existing crypto wallet addresses, with the technical paper, “ZK-PoSP: Post-Quantum Zero-Knowledge Proofs for Hierarchical Deterministic Wallets,” distributed on ePrint. The pitch is a deliberate inversion of the field: no fund migration, no key rotation, no new address formats. A wallet proves in zero knowledge that it knows the seed its address was derived from, a proof of seed provenance, resting on hash functions, the one cryptographic family quantum computers are not expected to break, and on the same post-quantum assumptions behind NIST’s standardized algorithms.
First, the Threat: The Hardware Bill Keeps Falling
It is tempting to file quantum risk under distant hypotheticals, and five years ago that was defensible. The research record since then reads differently. In 2019, Google’s Craig Gidney co-published an estimate that breaking RSA-2048 would take 20 million noisy qubits; his May 2025 follow-up cut that to under one million, a 20x reduction achieved entirely through algorithmic improvements, no new hardware required. Then it happened again, this time to crypto’s own math: in March 2026, Google Quantum AI published estimates putting an attack on secp256k1, the curve securing Bitcoin, at under 500,000 physical qubits, roughly 20x below the previous best estimate from 2023. The pattern, as the researchers themselves put it, is that attacks always get better. Nobody knows when a cryptographically relevant quantum computer arrives. What the record shows is that the finish line keeps moving toward the runners.
Estimated qubits required to break RSA-2048 and Bitcoin’s curve, by publication. Log scale.The exposure is not hypothetical either, because Bitcoin’s history already wrote it into the chain. Any address that has ever sent a transaction, plus the early pay-to-public-key coins, has its public key permanently visible on-chain, and a sufficiently capable quantum machine could work backward from that key to the private one. Galaxy Digital’s analysis, reported by Bloomberg this month, puts the value in those long-exposure addresses at up to $470 billion, roughly a third of circulating Bitcoin, including about one million BTC attributed to Satoshi Nakamoto that cannot opt into any defense because nobody can act for it. That last detail is the whole institutional argument in miniature: every migration-based plan assumes an actor, and a meaningful share of crypto has none.
The Field ZK-PoSP Is Arguing With
The serious responses to this problem so far share a family resemblance. The Ethereum Foundation formalized a dedicated post-quantum security team in January 2026, launched a public roadmap hub in March, and in June its researchers published the first concrete migration step, a public key registry letting roughly one million validators pre-register quantum-safe XMSS keys, alongside EIP-8141, which would let accounts opt into post-quantum verification on their own schedule. It is rigorous, well-funded work with a stated target of core protection by roughly 2029, and it is also, structurally, a migration: keys get rotated, accounts get moved to new verification, and every holder eventually acts.
For a retail wallet, acting is an afternoon’s chore. For a spot ETF, a qualified custodian or a corporate treasury, key rotation and fund movement touch compliance sign-offs, audit trails, insurance terms and sometimes prospectus language, multiplied across every product and jurisdiction. Migration at that layer is not a transaction. It is a legal project. That operational reality, more than any cryptographic novelty, is the market gap ZK-PoSP is aimed at.
How It Works Under the Hood
Strip the acronyms and the idea is almost domestic. Your wallet’s addresses were all grown from one seed phrase, the way every branch of a tree traces back to the same root. Today you prove ownership by signing with a private key, and it is that signature math, elliptic curves, that quantum computers threaten. ZK-PoSP adds a second, parallel way to prove ownership: demonstrate, without revealing anything, that you know the seed the address was originally grown from. The proof leans only on hash functions, which sit outside the quantum kill zone, which is why NIST’s own post-quantum standards build on the same foundations.
The design details worth a technical reader’s attention: the scheme runs alongside existing ECDSA signatures rather than replacing them, covering both secp256k1 and Ed25519 and all the HD derivation standards in live use, BIP32, BIP44 and SLIP-10, which between them hold the overwhelming majority of actively managed funds. It operates in classical mode today and flips to post-quantum mode when needed, with the same address either way. The paper also introduces QBIP32, a curve-agnostic derivation standard using one keyed-hash call per step, built on NIST’s KMAC256, where existing schemes need two, and the proofs are generated on RISC Zero with no trusted setup, meaning no ceremony whose compromise would poison the system.
The user journey under migration schemes versus proof of seed provenance, caveats included.The Claimed Numbers, and What They Would Mean
Per the paper’s benchmarks, run on a commodity 16-core server: securing an address costs about a fifth of a cent as a one-time proof, each transaction proof costs about an eighth of a cent, signing takes about 12 seconds on a desktop-class machine, and verification takes 9 to 10 milliseconds. There is no gas and no on-chain migration cost, because nothing moves on-chain. The company further states the approach is 21x more efficient than the Ethereum Foundation’s migration proposal, with 210x or better projected once hardware acceleration and proving-system improvements land.
Treat all of these as claims, not findings; the paper is an ePrint and has not been peer-reviewed, a status the company itself discloses. But it is worth spelling out what the numbers would mean if they hold. Twelve-second signing is unusable for a coffee purchase and entirely usable for institutional settlement, which is precisely the market segment where migration is hardest, so the performance profile and the target customer happen to align. Sub-cent proof costs would make securing an entire custodial book a rounding error. And 9-millisecond verification is the number that decides whether node operators would tolerate the check at all. The economics, if real, are not the obstacle. Adoption is.
The paper’s reported benchmarks, labelled for what they are: pre-review claims.The Honest Frame: What “Users Do Nothing” Actually Requires
Here is the analysis this announcement needs and press coverage will mostly skip. “Users do nothing” is accurate and also incomplete, because the scheme only binds once chains adopt proof verification through a node-level upgrade using the AmericanFortress SDK, which the company will license. That relocates the coordination problem rather than eliminating it: instead of persuading millions of holders, ZK-PoSP must persuade dozens of core development communities, and chain-level governance has its own politics, timelines and veto players. The Bitcoin community’s ongoing argument over whether to freeze or surrender quantum-vulnerable coins is a preview of how contentious such upgrades get. Moving the burden from millions of users to a handful of protocol teams is still a genuinely better trade, coordination among dozens beats coordination among millions, but it is a trade, not a disappearance.
The second boundary is disclosed in the paper itself: addresses whose public keys are already exposed on-chain remain quantum-vulnerable until networks enforce post-quantum verification. ZK-PoSP is a vaccine for the not-yet-exposed, not an antidote for the already-exposed, and the $470 billion in the Bloomberg estimate sits mostly in the second category. Positioned honestly, the scheme protects the future of every HD wallet and complements, rather than replaces, the chain-level enforcement work that projects like the Ethereum Foundation’s are doing. The company, to its credit, frames it as complementary too.
What to Watch
Four markers will separate a paradigm shift from a well-written pre-print. Watch the cryptographers, not the announcement. The paper is on ePrint, which means the review process now happens in public. Independent analysis from academic cryptographers and wallet-security teams over the coming months, and any replication of the benchmark tables, is the single strongest signal. Silence would say as much as criticism.
Watch for the first chain integration. The licensing model means the proof of adoption is a named network shipping proof verification in a node release, testnet first. One mid-size chain doing this credibly would matter more than ten partnership announcements. Watch the Ethereum Foundation’s posture. The company claims a 21x efficiency edge over the EF’s migration approach; the EF’s researchers are unusually public and unusually direct. Engagement, rebuttal or incorporation of seed-provenance ideas into pq.ethereum.org’s roadmap would each be informative in different ways.
Watch the signing time trajectory. Twelve seconds is the number the company itself flags as the improvement frontier. If hardware acceleration brings it under a second within a year, the addressable market widens from institutional settlement to everyday wallets, and the commercial story changes shape entirely.
Don’t forget to like and share the story!
Vested Interest Disclosure: HackerNoon has reviewed the report for quality, but the claims herein belong to the author. All market data is independently sourced and hyperlinked. Do your own research. #DYOR.
Be the first to comment