paraframe

researching attention markets and crypto security

[paraframe @prfa]

qUSB is the first full self-custody cold wallet for your $SOL that you can make from any USB stick, and it's quantum-proof

No chip, no vendor. It signs with hashes instead of curves, and an open-source Solana program checks every signature on-chain

$qUSB fees pay the dev to build it

https://t.co/yMjvnvNCHl
$qUSB
CA: 9NDY4jY5gqcNfDrZsKujtnuvH12pPG5FUGS5QmwZpump

@solana @toly @solana_devs

[paraframe @prfa]

@OS4T0 Yes I paid dex and they just sold after it, what’s wrong with me here lol

[paraframe @prfa]

i'm declaring war on cold wallet companies

you paid them for ONE job, keep your coins safe. look what they did instead

LEDGER

2020: customer database hacked. about 1 million emails, plus names, home addresses and phone numbers of about 272,000 buyers dumped on a public forum. basically a list of people who own crypto and where they live

2023: they launch Recover. your seed split in 3 and handed to 3 companies, unlocked with your ID and a selfie. people asked how that's even possible and their support account wrote this:

"Technically speaking it is and always has been possible to write firmware that facilitates key extraction. You have always trusted Ledger not to deploy such firmware whether you knew it or not."

then they deleted the tweet lol

dec 2023: an ex employee got phished and still had publishing access. malicious code went out through Ledger's Connect Kit straight into dapps. more than $600,000 drained (ZachXBT's estimate)

2025: Nano S owners told no more app updates. the offer was 20% off a new one

2025: their multisig app takes $10 per transaction, or 0.05% on token transfers, on top of gas

jan 2026: names, addresses, emails and phones exposed AGAIN, this time through their payment processor

TREZOR

jan 2024: support portal breached, contact details of up to 66,000 users may have been exposed. 41 confirmed phishing cases

mar 2025: Ledger's own lab got past the Safe 3's genuine-device check. asked if a firmware update can fix it, Trezor said "Unfortunately not."

aug 2026: shipping partner breached. names, emails, phones and shipping addresses of 81,000 customers

sep 2026: fake "critical security alert" emails sent from Trezor's real [email protected] address. their words: "Our third-party e-mail provider has been breached."

TANGEM

dec 2024: the app wrote private keys into log files that could end up with support. Tangem says fewer than 0.1% of users were affected and no funds were lost

COLDCARD

jul 2026: a firmware random-number flaw let attackers recreate seeds. 1,082 BTC, about $70 million, gone from 1,196 addresses in 41 minutes. and updating the firmware doesn't save a seed that was already made

SAFEPAL

aug 2026: a plug-in flaw exposed the data of about 39,798 customers

and since february scammers are mailing paper letters to people's homes pretending to be Ledger and Trezor, with a QR code that asks for your 24 words

the math didn't break in a single one of these. it was the company sitting in the middle every time. the shop that knows your address, the firmware you can't read, the chip you have to trust, the partner that gets breached

and now the new one. Trezor sells a $249 wallet they call "quantum-ready". their own site says:

"A quantum-ready device does not protect your assets from quantum computers at this time. Blockchains must first upgrade to post-quantum cryptography."

i didn't want to wait for the chain so i built the opposite

qUSB

a cold wallet you make from any USB stick you already have in a drawer

- no company and no shop. nobody has your name or address because nobody ships you anything
- no chip and no closed firmware, all the code is open
- no curve. it signs with hash-based signatures checked on-chain by a small open Solana program, so your SOL sits behind that today

and yeah it has limits, i'd rather tell you myself than in a breach notice. it's v1 and not audited so start small. there's no secure chip so the computer you sign on has to be clean. fees still use a normal Solana key. the program is still upgradeable by my key. full threat model is in the repo

i've been building open source before this. SAM was mine and it went to a $4M ATH. qUSB is the next one and it stays open source

no VC, no hardware to sell you. $qUSB fees pay the dev and the team to build it. you support $qUSB, i keep building this

@Ledger @Trezor @Tangem @COLDCARDwallet @iSafePal tell me which line is wrong

if one of them ever leaked your address, repost this

https://t.co/yMjvnvNCHl
https://t.co/vk7lJ4Nwad

$qUSB
CA: 9NDY4jY5gqcNfDrZsKujtnuvH12pPG5FUGS5QmwZpump

[paraframe @prfa]

i swear you guys are just bunch of retards with the attention span of the goldfish

[paraframe @prfa]

they asked me to pay dex

[paraframe @prfa]

Now who’s gonna refund me my 300 bucks

Could’ve buy second codex subscription instead 🤡

[paraframe @prfa]

since you guys ask that much

[paraframe @prfa]

sources so nobody has to take my word

Ledger 2020: https://t.co/uiLvdn60SV
Ledger Recover quote: CoinDesk, 23 and 24 May 2023
Connect Kit: https://t.co/efrzDSQffg
Trezor Safe 3: https://t.co/ilSwQP9qhm
Coldcard: https://t.co/C4MklUsNif
SafePal: https://t.co/cTjyWsMEhw
Trezor 2024 and 2026, Ledger 2026: BleepingComputer
Tangem: https://t.co/VfExGigvQ1 blog, 30 Dec 2024

[paraframe @prfa]

i'm declaring war on cold wallet companies

you paid them for ONE job, keep your coins safe. look what they did instead

LEDGER

2020: customer database hacked. about 1 million emails, plus names, home addresses and phone numbers of about 272,000 buyers dumped on a public forum. basically a list of people who own crypto and where they live

2023: they launch Recover. your seed split in 3 and handed to 3 companies, unlocked with your ID and a selfie. people asked how that's even possible and their support account wrote this:

"Technically speaking it is and always has been possible to write firmware that facilitates key extraction. You have always trusted Ledger not to deploy such firmware whether you knew it or not."

then they deleted the tweet lol

dec 2023: an ex employee got phished and still had publishing access. malicious code went out through Ledger's Connect Kit straight into dapps. more than $600,000 drained (ZachXBT's estimate)

2025: Nano S owners told no more app updates. the offer was 20% off a new one

2025: their multisig app takes $10 per transaction, or 0.05% on token transfers, on top of gas

jan 2026: names, addresses, emails and phones exposed AGAIN, this time through their payment processor

TREZOR

jan 2024: support portal breached, contact details of up to 66,000 users may have been exposed. 41 confirmed phishing cases

mar 2025: Ledger's own lab got past the Safe 3's genuine-device check. asked if a firmware update can fix it, Trezor said "Unfortunately not."

aug 2026: shipping partner breached. names, emails, phones and shipping addresses of 81,000 customers

sep 2026: fake "critical security alert" emails sent from Trezor's real [email protected] address. their words: "Our third-party e-mail provider has been breached."

TANGEM

dec 2024: the app wrote private keys into log files that could end up with support. Tangem says fewer than 0.1% of users were affected and no funds were lost

COLDCARD

jul 2026: a firmware random-number flaw let attackers recreate seeds. 1,082 BTC, about $70 million, gone from 1,196 addresses in 41 minutes. and updating the firmware doesn't save a seed that was already made

SAFEPAL

aug 2026: a plug-in flaw exposed the data of about 39,798 customers

and since february scammers are mailing paper letters to people's homes pretending to be Ledger and Trezor, with a QR code that asks for your 24 words

the math didn't break in a single one of these. it was the company sitting in the middle every time. the shop that knows your address, the firmware you can't read, the chip you have to trust, the partner that gets breached

and now the new one. Trezor sells a $249 wallet they call "quantum-ready". their own site says:

"A quantum-ready device does not protect your assets from quantum computers at this time. Blockchains must first upgrade to post-quantum cryptography."

i didn't want to wait for the chain so i built the opposite

qUSB

a cold wallet you make from any USB stick you already have in a drawer

- no company and no shop. nobody has your name or address because nobody ships you anything
- no chip and no closed firmware, all the code is open
- no curve. it signs with hash-based signatures checked on-chain by a small open Solana program, so your SOL sits behind that today

and yeah it has limits, i'd rather tell you myself than in a breach notice. it's v1 and not audited so start small. there's no secure chip so the computer you sign on has to be clean. fees still use a normal Solana key. the program is still upgradeable by my key. full threat model is in the repo

i've been building open source before this. SAM was mine and it went to a $4M ATH. qUSB is the next one and it stays open source

no VC, no hardware to sell you. $qUSB fees pay the dev and the team to build it. you support $qUSB, i keep building this

@Ledger @Trezor @Tangem @COLDCARDwallet @iSafePal tell me which line is wrong

if one of them ever leaked your address, repost this

https://t.co/yMjvnvNCHl
https://t.co/vk7lJ4Nwad

$qUSB
CA: 9NDY4jY5gqcNfDrZsKujtnuvH12pPG5FUGS5QmwZpump

[paraframe @prfa]

qUSB is the first full self-custody cold wallet for your $SOL that you can make from any USB stick, and it's quantum-proof

No chip, no vendor. It signs with hashes instead of curves, and an open-source Solana program checks every signature on-chain

$qUSB fees pay the dev to build it

https://t.co/yMjvnvNCHl
$qUSB
CA: 9NDY4jY5gqcNfDrZsKujtnuvH12pPG5FUGS5QmwZpump

@solana @toly @solana_devs

[paraframe @prfa]

@cobramotion anyone still uses that piece of shit?

[paraframe @prfa]

qUSB is the first full self-custody cold wallet for your $SOL that you can make from any USB stick, and it's quantum-proof

No chip, no vendor. It signs with hashes instead of curves, and an open-source Solana program checks every signature on-chain

$qUSB fees pay the dev to build it

https://t.co/yMjvnvNCHl
$qUSB
CA: 9NDY4jY5gqcNfDrZsKujtnuvH12pPG5FUGS5QmwZpump

@solana @toly @solana_devs

[paraframe @prfa]

gm, busy morning, got a few direct messages from security researchers, fixed most of whats open

v0.1.1 live

will post new explainer in half an hour

[paraframe @prfa]

@sanchezzzr1ck brother token is out for 40 minutes

[paraframe @prfa]

I built a cold wallet you can make out of any USB stick. It's called qUSB, and it's quantum-proof

https://t.co/yMjvnvNCHl
$qUSB

here's the problem in plain words

every Solana wallet today is protected by the same kind of math: elliptic curves, that includes Phantom, Backpack, your Ledger, all of them, y our public address is out in the open, and right now nobody can work backwards from it to your private key, normal computers would need longer than the universe has existed

big enough quantum computer changes that

there's a known algorithm, Shor's, that does exactly this: public key in, private key out, obody can tell you the date that machine shows up, ut when it does, every wallet built on curves is open, and moving your coins after the fact won't help if someone gets there first

so I built a wallet that doesn't use curves at all

qUSB signs with hashes instead, using Winternitz one-time signatures over SHA-256, hash-based signatures are the boring, well-understood kind of post-quantum crypto

quantum computer has no shortcut against them, with no curve, there's nothing for Shor to break

how it works:

1. take any USB stick from your drawer. No special hardware, no chip, no company
2. flash it with qUSB. It holds an encrypted keystore and the wallet program
3. run qusb init. You get 24 words and set a passphrase, and your keys are encrypted on the stick
4. qusb receive gives you a vault address. Send SOL to it from any wallet or exchange
5. to spend, you sign offline with the stick, then broadcast from any online computer, signed message is locked to one recipient and one amount, so the online machine can't redirect your funds

the vaults live on Solana, small open-source program called qvault checks the hash-based signature on-chain before any SOL moves, there's no admin key and no backdoor over your funds

lose the stick? everything comes back from your 24 words, someone steals the stick? without your passphrase they get encrypted noise

What it doesn't do (I'd rather you hear it from me):

- It's v1 and not audited yet
- each vault key signs exactly once, wallet handles this and moves your change to the next vault
- Fees and SPL tokens still use a normal Solana key, as every wallet today, keep only fee money there
- If the computer you sign on has malware, it can see your keys while you sign, use a machine you trust

the full threat model is in the repo

why a token?

I want qUSB to be the first serious open-source software with no financial dependency on anyone, no VC, no sales team, no paid marketing
$qUSB is how it gets funded: the creator fees pay me and it

that's it, he token gives no claim on anything, and the code stays open source whatever happens

If you've used SAM, you know I ship open source. This is the next one

code: https://t.co/vk7lJ4Nwad
qvault program: CnfS7soDNtZaJgshcU38tvDuK2zZZwFPAedRUdRm

read the code, plug it in

CA: 9NDY4jY5gqcNfDrZsKujtnuvH12pPG5FUGS5QmwZpump

[paraframe @prfa]

quick note for anyone here for the pump:

I don't launch often, only when I've got something worth building, last time was $SAM, ot hit almost $4M at its peak, and I worked on it nonstop for 3–4 months with no supply, just the creator fees

I'm saying this for those of you who care about the token more than the tech, that's fine, because there's no tech without the token

the token makes the fees, and the fees pay for me to build, simple as that

$qUSB 9NDY4jY5gqcNfDrZsKujtnuvH12pPG5FUGS5QmwZpump

[paraframe @prfa]

I built a cold wallet you can make out of any USB stick. It's called qUSB, and it's quantum-proof

https://t.co/yMjvnvNCHl
$qUSB

here's the problem in plain words

every Solana wallet today is protected by the same kind of math: elliptic curves, that includes Phantom, Backpack, your Ledger, all of them, y our public address is out in the open, and right now nobody can work backwards from it to your private key, normal computers would need longer than the universe has existed

big enough quantum computer changes that

there's a known algorithm, Shor's, that does exactly this: public key in, private key out, obody can tell you the date that machine shows up, ut when it does, every wallet built on curves is open, and moving your coins after the fact won't help if someone gets there first

so I built a wallet that doesn't use curves at all

qUSB signs with hashes instead, using Winternitz one-time signatures over SHA-256, hash-based signatures are the boring, well-understood kind of post-quantum crypto

quantum computer has no shortcut against them, with no curve, there's nothing for Shor to break

how it works:

1. take any USB stick from your drawer. No special hardware, no chip, no company
2. flash it with qUSB. It holds an encrypted keystore and the wallet program
3. run qusb init. You get 24 words and set a passphrase, and your keys are encrypted on the stick
4. qusb receive gives you a vault address. Send SOL to it from any wallet or exchange
5. to spend, you sign offline with the stick, then broadcast from any online computer, signed message is locked to one recipient and one amount, so the online machine can't redirect your funds

the vaults live on Solana, small open-source program called qvault checks the hash-based signature on-chain before any SOL moves, there's no admin key and no backdoor over your funds

lose the stick? everything comes back from your 24 words, someone steals the stick? without your passphrase they get encrypted noise

What it doesn't do (I'd rather you hear it from me):

- It's v1 and not audited yet
- each vault key signs exactly once, wallet handles this and moves your change to the next vault
- Fees and SPL tokens still use a normal Solana key, as every wallet today, keep only fee money there
- If the computer you sign on has malware, it can see your keys while you sign, use a machine you trust

the full threat model is in the repo

why a token?

I want qUSB to be the first serious open-source software with no financial dependency on anyone, no VC, no sales team, no paid marketing
$qUSB is how it gets funded: the creator fees pay me and it

that's it, he token gives no claim on anything, and the code stays open source whatever happens

If you've used SAM, you know I ship open source. This is the next one

code: https://t.co/vk7lJ4Nwad
qvault program: CnfS7soDNtZaJgshcU38tvDuK2zZZwFPAedRUdRm

read the code, plug it in

CA: 9NDY4jY5gqcNfDrZsKujtnuvH12pPG5FUGS5QmwZpump

[paraframe @prfa]

Locked my dev supply for a week while we work out how to fold it into the project properly.

Little explainer about $qUSB is attached

[paraframe @prfa]

🔐 Just locked 29,850,746 $qUSB tokens with @Streamflow_Fi
It's on-chain. You can check the amount, time-period and recipients.

Check it out👇
https://t.co/uylaJaWlog

[paraframe @prfa]

why I built qUSB, in plain words

your crypto wallet is protected by math that a big enough quantum computer can break, on Solana it's worse than most: your address IS your public key, the exact thing that machine needs. It's been public since the day you made your wallet

nobody knows the exact year that machine arrives, ut the estimates keep shrinking, the hardware keeps improving, and governments already have deadlines to move off this math

and a blockchain can't be fixed after the fact. When that day comes, whoever gets there first goes through the public keys, and yours is already on the list

qUSB moves your SOL behind different math, hash-based signatures, which a quantum computer has no shortcut for, program on Solana checks that signature before anything moves

and you don't buy a device, any USB stick from your drawer becomes the wallet, no company, no chip, fully open source

https://t.co/yMjvnvNCHl

[paraframe @prfa]

I built a cold wallet you can make out of any USB stick. It's called qUSB, and it's quantum-proof

https://t.co/yMjvnvNCHl
$qUSB

here's the problem in plain words

every Solana wallet today is protected by the same kind of math: elliptic curves, that includes Phantom, Backpack, your Ledger, all of them, y our public address is out in the open, and right now nobody can work backwards from it to your private key, normal computers would need longer than the universe has existed

big enough quantum computer changes that

there's a known algorithm, Shor's, that does exactly this: public key in, private key out, obody can tell you the date that machine shows up, ut when it does, every wallet built on curves is open, and moving your coins after the fact won't help if someone gets there first

so I built a wallet that doesn't use curves at all

qUSB signs with hashes instead, using Winternitz one-time signatures over SHA-256, hash-based signatures are the boring, well-understood kind of post-quantum crypto

quantum computer has no shortcut against them, with no curve, there's nothing for Shor to break

how it works:

1. take any USB stick from your drawer. No special hardware, no chip, no company
2. flash it with qUSB. It holds an encrypted keystore and the wallet program
3. run qusb init. You get 24 words and set a passphrase, and your keys are encrypted on the stick
4. qusb receive gives you a vault address. Send SOL to it from any wallet or exchange
5. to spend, you sign offline with the stick, then broadcast from any online computer, signed message is locked to one recipient and one amount, so the online machine can't redirect your funds

the vaults live on Solana, small open-source program called qvault checks the hash-based signature on-chain before any SOL moves, there's no admin key and no backdoor over your funds

lose the stick? everything comes back from your 24 words, someone steals the stick? without your passphrase they get encrypted noise

What it doesn't do (I'd rather you hear it from me):

- It's v1 and not audited yet
- each vault key signs exactly once, wallet handles this and moves your change to the next vault
- Fees and SPL tokens still use a normal Solana key, as every wallet today, keep only fee money there
- If the computer you sign on has malware, it can see your keys while you sign, use a machine you trust

the full threat model is in the repo

why a token?

I want qUSB to be the first serious open-source software with no financial dependency on anyone, no VC, no sales team, no paid marketing
$qUSB is how it gets funded: the creator fees pay me and it

that's it, he token gives no claim on anything, and the code stays open source whatever happens

If you've used SAM, you know I ship open source. This is the next one

code: https://t.co/vk7lJ4Nwad
qvault program: CnfS7soDNtZaJgshcU38tvDuK2zZZwFPAedRUdRm

read the code, plug it in

CA: 9NDY4jY5gqcNfDrZsKujtnuvH12pPG5FUGS5QmwZpump

[paraframe @prfa]

@JosephFahd5366 will share soon

[paraframe @prfa]

gm