QDAY

Post-quantum tools for Solana. See if your key is public, name a successor key, move funds to an address with no private key.

[QDAY @QDAY_2026]

While your wallet's key is still sound, use it to sign a dated, public record that names a successor key.

It moves nothing, and nothing on Solana acts on it today. It puts your choice on the record now, with a date no one can forge later.

https://t.co/RSwAaFZUGR

Hy1sg1tsoLcYvx67njEx2sQgK7zj4XVdkVE4rxgfpump

[QDAY @QDAY_2026]

An LMS signature is 2,508 bytes. A classic Solana transaction holds 1,232.

So QDay writes the signature into a buffer only your fee payer can write to. The last transaction verifies it, moves the funds and closes the buffer, refunding its rent.

With 4,096-byte v1 transactions, it fits in one.

[QDAY @QDAY_2026]

A vault key has 1,024 one-time leaves. Before they run out, the last one signs the next key, derived from the same 24 words, and the program swaps it in.

Same vault address, 1,024 fresh leaves, and the old key's signatures stop working.

[QDAY @QDAY_2026]

Agree on "don't rush."

On Solana you can't hide a key behind a hash, so QDay does the next best thing: an opt-in vault, signed with SHA-256 alone, that you move funds into when you choose. Your wallet keeps working.

https://t.co/0c3ggdcIcT

[Justin Drake @drakefjustin]

Today I call upon the blockchain industry to calmly begin planning for "bunker mode". My personal recommendation is to set in motion a controlled mass migration of assets to fresh addresses, i.e. addresses whose pubkeys remain hidden behind a hash.

Holders, starting with large and sophisticated ones, should consider moving the bulk of their funds to addresses that have never signed a transaction. And when they do sign one, they should also move remaining funds to a new address (possibly generated from the same seed phrase).

Don't rush. While I believe there is cause for action a rushed migration would do more harm than good. Don't panic either. Moving assets to protected addresses is a simple, preventative step which does not require new cryptography or new wallets.

IMO it is now reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case in months not years. By "break" I mean fast private key recovery (e.g. in one week) on available hardware (e.g. a large GPU cluster).

Recent days have been humbling for human mathematical intuition. Long-held, unquestioned hypotheses have fallen. This includes the n log(n) bound for integer multiplication and the 3SUM conjecture. In hindsight, May's unexpected disproof of the Erdős unit distance conjecture was our warning shot.

Yesterday's OpenAI drop made it clear that mathematical superintelligence is upon us. They say there are weeks where decades happen. We are about to live through weeks where centuries of mathematical progress happen. Could our magic 64-byte ECDSA signatures be too good to be true? Was it just security through obscurity all this time?

Elliptic curves feel especially vulnerable to superintelligence. Curves carry rich structure, with room for fancy tricks like Schoof, Frobenius, pairings. (By contrast, hashes are designed to minimise algebraic structure.)

Separately, as Ewin Tang can attest, an efficient quantum algorithm sometimes foreshadows an efficient classical one. We should be open to the possibility of a classical counterpart to Shor that breaks elliptic curves and RSA at once.

Also noteworthy is the striking under-representation of cryptographic breakthroughs among the 722 mathematical results OpenAI published. I've witnessed first-hand the US government censoring academic quantum cryptanalysis results. Backroom interventionism is my base case.

I urge large, sophisticated actors to lead by example. Project11's "risq list" (bitcoin-risq-list.projecteleven[.]com) is a great tracker of exposed BTC pubkeys. Binance, Bitbank, Robinhood, Bitfinex, and Tether have an opportunity to harden their cold storage. Next month I'll address institutions in London in a live Q&A (forum.ethereuminstitutional[.]org/london-2026).

Again, please do not rush. Wallets holding under 50 BTC enjoy partial cover from "Satoshi's shield", i.e. his 20K exposed addresses that hold 50 BTC each. Load-bearing signers like oracles and L2 security councils should consider rotating ECDSA pubkeys with every signed message and/or multi-signing with a hash-based schemes like SPHINCS.

Exiting bunker mode safely will require post-AI cryptography. My inclination is to go all-in on hash-based cryptography and avoid structured mathematical assumptions entirely, whether from curves, lattices, or isogenies. A single battle-tested hash (e.g. from the SHA or BLAKE families) yields plausible post-AI security.

The Ethereum roadmap on strawmap[.]org fully embraces hash-based cryptography with end-to-end formal verification as a response to the quantum threat. Those timelines must now be revisited and accelerated in light of mathematical superintelligence. I'll be pushing for maximum defensive acceleration.

[QDAY @QDAY_2026]

A claim is one ordinary Solana transaction: your wallet signs a memo naming an LMS public key, and the block it lands in dates it.

518 bytes. 0 lamports moved. One network fee. Whoever breaks Ed25519 later can sign a claim too, but only in a later block.

[QDAY @QDAY_2026]

How to move everything if your wallet is effected using our technology👇
1. Connect the wallet you want to empty
2. Pick one of your vaults (or any address)
3. Review every transaction, then approve once

Tokens, NFTs, then SOL last. Emptied accounts close and their rent comes back.
https://t.co/vTjEQ0Ycm9

[QDAY @QDAY_2026]

Check if you are comprimised here: https://t.co/zGSl6heeq0

[QDAY @QDAY_2026]

Before your device signs, QDay decodes the exact bytes and shows them in plain words: "This signature allows: send 2 SOL to … Nothing else."

The signature covers the cluster, the program, the vault, the leaf and every amount and destination. Change one byte and nothing moves.

https://t.co/5muSVBqDWf

[QDAY @QDAY_2026]

https://t.co/fn9YAhhTXu, May to July 2026: humans and AI agents cut the estimated quantum cost of attacking secp256k1 from 10.75 billion to 1.496 billion (logical qubits × Toffoli gates). −86%.

Hy1sg1tsoLcYvx67njEx2sQgK7zj4XVdkVE4rxgfpump

https://t.co/Ju6wgTTbWo

[QDAY @QDAY_2026]

Google Quantum AI's new circuits could solve ECDLP-256 "in minutes using fewer than 500,000 physical qubits, roughly a 20-fold reduction over previous estimates," per Anza.

No machine that size exists yet. The estimates keep falling.

Check your key: https://t.co/zGSl6hdGAs

[QDAY @QDAY_2026]

(3, 4) is not on the curve y² = x³ + 7: 4² = 16, but 3³ + 7 = 34.

A QDay vault's address is off Solana's curve in the same sense. Its 32 bytes are not a point on Ed25519, so there is no private key for it to leak.

That's what "off the curve" means.

[QDAY @QDAY_2026]

https://t.co/XcRrlzl6eN

Locked

[Metramorf @metramorf]

@QDAY_2026 lock supply?

[QDAY @QDAY_2026]

Move everything: what a wallet holds goes into a QDay vault in one go. One review lists everything that moves, and your wallet approves once.

Your wallet keeps working afterwards. It still pays the fees, so leave it enough SOL for them.

https://t.co/r9V7e45NwR