Yuvi Lightman | Quantus

Securing Blockchains against the Quantum Threat | Founder of @QuantusNetwork | Editor-in-Chief at @QuantumCanary_ | Author of Weaponized Schizophrenia

[Yuvi Lightman | Quantus @YuviLightman]

@mert Blockchains are really just websites

[Mathematica @mathemetica]

Fractal built by repeating simple mathematical rules, creating its symmetric shape with white circles of different sizes and blue patterns that look the same zoomed in or out.

Fractals like this model natural forms such as coastlines and lung branches, and they’re used in practice for compact multi-frequency antennas plus procedural generation of detailed landscapes in games and simulations.

[Yuvi Lightman | Quantus @YuviLightman]

@dwillems42 “No don’t use Bitcoin, just hold it, are you crazy? Why would you spend your Bitcoin? Don’t get other people to use it?” - Bankers, obviously 🙄

[Yuvi Lightman | Quantus @YuviLightman]

@RCarhartHarris I suppose with your framing the absence of evidence *is* evidence.

[Yuvi Lightman | Quantus @YuviLightman]

@iamspi_ @grok Good point

[Yuvi Lightman | Quantus @YuviLightman]

“it is not a principle of physics or of human progress, just a matter of funding. if quantum had the same level of funding that ai does, the calculus would be entirely different (the threat of attack would come much sooner)” - Dan Boneh

@grok how has funding of quantum computing changed in the last few years?

[Eric Wall @ercwl]

this is the best bitcoin podcast episode i’ve listened to all year, especially for those that are interested in quantum

a background note: i first listened @danboneh talk on the topic of quantum what must’ve been almost 10 years ago. to me, he’s the one expert who demonstrates the most knowledge depth (and humility) on the subject, and teaches me the most when he speaks

recently, dan helped come up with a way to run Shor’s algorithm with 10x fewer physical qubits than previously thought (co-author on the 2026 Google paper)

my tl;dr of the episode:

his baseline characterization of quantum computing isn’t as something that might be fundamentally impossible. that error correction would get exponentially hard in the same way that breaking elliptic curve cryptography in the classical sense gets exponentially hard with the number of bits in a key

It is hard for sure, but not ”exponentially hard”

at the same time he doesn’t personally think CRQCs powerful enough to attack bitcoin is going to happen before 2035

(sidenote: it should be obvious to anyone that the deadline to reach safety isn’t ”the date when the smart people think an attack is most likely to happen”, but way before then. the question is rather ”by when is it even at a small risk?” and optimize for that)

he gives the reason for why it is unlikely to happen before 2035: it is not a principle of physics or of human progress, just a matter of funding. if quantum had the same level of funding that ai does, the calculus would be entirely different (the threat of attack would come much sooner)

to connect what he say to what some quantum critics like @jamesob, @reardencode or @robin_linus within the bitcoin community are saying, he does have the humility to acknowledge that it is *possible* error correction doesn’t scale. nobody knows for sure until it is proven.

that is a wholly different thing than confidently rejecting outright that it will ever scale, as if it’s something you can know and base your plans on, which is effectively what @jamesob, @reardencode and @robin_linus are doing

he compares quantum computing to flight, the wright brothers, and thinks that quantum computing already had its ”kitty hawk” moment (when the wright brothers flew 37 meters in 1903) with the google willow chip in 2024 (proving scalable fault-tolerant quantum computers are possible)

”error corrected quantum computing is not a theory, it has been proven to work”

regarding the notion that no quantum computer has factored a number higher than 21, dan says that that's true, but that it's only just now that these tools are coming together. it's happening right now.

the entire podcast is a treasure trove of information and is probably the single highest signal thing you can listen to if you want to get up to speed on the latest in ”quantum computing vs Bitcoin” from someone who actually knows what he’s talking about

congrats @isabelfoxenduke on this stellar interview

[Yuvi Lightman | Quantus @YuviLightman]

@EliBenSasson I could imagine aliens teaching humans mathematics by giving them zk proofs of unexpected theorems which motivates humans to chase after the right goals but they still have to do the work

[Yuvi Lightman | Quantus @YuviLightman]

What a cool domain!

AI is accelerating everything!

https://t.co/Jbrq74GuRh

[Charles Guillemet @P3b7_]

🚨 Google Quantum result was just rediscovered and IMPROVED!

On March 31, 2026, Google Quantum AI published a paper showing that 256-bit ECDLP, the hard problem behind ECDSA and therefore behind Bitcoin, Ethereum, TLS, and most of the world's authentication, can be solved with fewer than 1,200 logical qubits and ~90M Toffoli gates. Under 20 minutes on ~500,000 physical qubits.

BUT, they didn't publish the circuits. They published a zero-knowledge proof that the circuits hit those numbers. The standard read at the time: clever responsible disclosure, elegant.

Two months later, that read needs an update. Two things happened, in opposite directions.

1. The ZKP wasn't a stylistic choice. Google was stopped from publishing.

What was speculation in April is no longer. Google did not choose to keep the circuits private. The U.S. government prevented publication. The blog post phrased it politely ("we engaged with the U.S. government"). Call it what it is: diplomatic cover for a publication block.

This is the line Scott Aaronson warned about. At some point, the people estimating the resources needed to break deployed cryptosystems would stop publishing. We just watched it happen, and the actor enforcing the silence isn't Google's PR team. It's a government.

2. The ZKP turned out to be a reward function. AI used it.

Here's the part that's almost funny.

A ZK proof that "this hidden circuit achieves these resource counts" is, when you flip it, a public verifier of any candidate circuit. Submit a circuit, get back: does it compute ECC point addition correctly, and at what cost. Pass/fail plus a number. That is exactly the shape of a reinforcement-learning reward function.

The ZKP was designed to hide the attack. What it actually published is the reward function for rediscovering it.

The research community wired the verifier into an automated AI-driven search loop. They reproduced Google's numbers. Then they improved them by 11.5%. Two months, from outside Google, no access to the circuits, using the very artifact Google released to keep them proprietary.

Both of these are true at once. Hiding the circuits worked: nobody outside Google has Google's exact circuits. And hiding the circuits did not slow the frontier; it changed who is doing the search, and arguably accelerated it, because the verifier industrialized the search loop.

Let's NOT PANIC!
Neither of these is a working CRQC. There is still no quantum computer that can run this circuit. The headline state of the world has not changed.

What has changed is the honesty of every public PQC timeline. Cryptography exists to create mathematical trust in the security of systems. Trust isn't broken when an attack runs. It is eroded when the foundation looks thinner than the public record suggests, and the public record is now demonstrably thinner than reality in two ways: by classification on one end, by AI-driven re-derivation on the other.

In security, the moment you start doubting the foundation is the moment you start rebuilding it. Not the moment you panic. The moment you plan.

This isn't a moment to rush. It's a moment to commit to a migration plan and execute against it, knowing the threat model is shaped by what governments are willing to classify, not by what researchers are allowed to publish.

Stay safe. Stay honest about your trust assumptions.

[Yuvi Lightman | Quantus @YuviLightman]

Don’t forget the mission

P2P Electronic Cash
Quantum-Secure Encrypted Cash

[Eli Ben-Sasson | Starknet.io @EliBenSasson]

Crypto's goal is to replace an existing system with something better.
It takes an enormous amount of engineering, math, and cryptography to build. Going through all that trouble only to recreate the same system with the same outcomes for users is missing the point entirely.

[Yuvi Lightman | Quantus @YuviLightman]

@n13 @InternetH0F “I control the world!”

“Sure you do, grandpa, now take your metamucil”

[Shielded Labs @ShieldedLabs]

.@brian_armstrong says it's surprising that crypto has gotten as big as it has... on a public surveillance ledger... and that it's time for crypto to transition from HTTP (full transparency) to HTTPS (privacy)

We agree

That's why we're building on Zcash

[Yuvi Lightman | Quantus @YuviLightman]

⏰⏰⏰

[Sreeram Kannan @sreeramkannan]

https://t.co/2PNyFNV6Oi

[Yuvi Lightman | Quantus @YuviLightman]

@TrustlessState @AskVenice @Lighter_xyz Check out @QuantusNetwork

[Yuvi Lightman | Quantus @YuviLightman]

…while depositors and taxpayers bear the biggest cost.

[Yuvi Lightman | Quantus @YuviLightman]

Imagine fiat currency as a memecoin:

“You stake (deposit) it to get yield (interest)”

“Where does the yield come from?”

“Oh the platform lends your money out and makes interest on the loans.”

“Sounds dangerous”

“It’s not, there’s lots of rules, for example they have this thing where they can lend out 10 times as much as you staked (fractional reserve).”

“Ok that just sounds like leverage. What happens if they default?”

“It’s fine, the devs (central bank) can always print more tokens (bailout) if it becomes a problem.”

“Ok but beyond yield, why would I want to use this token?”

“Well you can trade it with others for goods and services. Also you have to pay fees (taxes) in the token to use it.”

“Are there any alternatives?”

“Yes but…”

[Yuvi Lightman | Quantus @YuviLightman]

The benefits of fractional reserve banking are not evenly distributed, they are mostly accrued to bank executives and shareholders.

[Yuvi Lightman | Quantus @YuviLightman]

@badcryptobitch I mean someone could probably put some bad funds in uniswap in a clever way and get uniswap frozen.

[Yuvi Lightman | Quantus @YuviLightman]

@slopshipper @mert I wasn’t even talking about Zcash.

[Yuvi Lightman | Quantus @YuviLightman]

I guess we should give up on making Bitcoin quantum secure…

[Saifedean Ammous @saifedean]

Your stupid VC shitcoin was born out of a trusted setup involving Israeli soldiers. Etheeryum, which is the biggest and most decentralized shitcoin (tallest midget) was rolled back to seize $150m of the founders' coins that they couldn't secure. If the biggest most decentralized shitcoin can be rolled back for $150m, every shitcoin will never be able to credibly demonstrate that it can resist political pressure. Bitcoin can because it has no founders, no trusted setups, no premine & no stupid VCs with power over it. You could take the 1000 most influential bitcoiners and 1000 biggest hodlers and torture them for a month and all you'd get is a worthless stupid shitcoin fork like bcash while bitcoin continues to work. For all other shitcoins you don't need to do anything more than threaten a dozen nerds.

[Yuvi Lightman | Quantus @YuviLightman]

@slopshipper @mert I believe he was talking about Saifedean not me, but there’s no such thing as bad press is there, mr bot?