qHOST

The first quantum-resistant launchpad.
Launch and hold your coins behind keys it can't break.
0x449d057b556dd73335ab99b390b574e579da8b7e

[qHOST @qhostworld]

vitalik says dont panic move your funds, just cut your exposure to quantum vulnerable crypto. thats literally what we built. qHOST vaults have no elliptic curve key at all, and the auto bunker only moves your stocks if the canary dies

[vitalik.eth @VitalikButerin]

I don't recommend anyone scramble to move their funds to new wallets today. But we should take the risks to cryptography from AI-accelerated math seriously, and minimize our exposure to not just quantum-vulnerable cryptography, but also potentially AI-vulnerable cryptography.

The core new area of risk from this viewpoint is, unfortunately, ML-DSA / FHE / lattices.

(and it's also another reason, along with quantum, why ECDSA might fall even faster than expected, hence the "fresh address" recommendation)

So far most people have been in the mode of thinking "elliptic curves broken, hashes safe, lattices safe". But there is a good chance that the concrete security of lattices will take serious hits from the next two years of AI math.

The basic threat model is: factoring is something that naively takes 2^(n/2) time, but over decades smart people have found and optimized number field sieves, and degraded that to 2^O(n^(1/3)), which is why RSA keys and signatures need to be ~400 bytes (and not 64 bytes). What if there are skeletons in the closet like that, both for elliptic curves and lattices, that we are simply not smart enough to discover - but bots soon will be?

This is a major part of the reason why for the past year ethereum's lean roadmap has been going in the "hash-only" direction: no lattices, no ML-DSA, no Falcon, no lattice-based commitments inside ZK proofs, etc. Signatures in lean ethereum are all hash-based, either WOTS or SPHINCS-.

For signatures and proofs, we already know how to go hash-only. The bigger challenge is for *public-key encryption* - and this goes far beyond blockchains. Secure communication, anonymizing protocols, lots of things need public-key encryption.

And unfortunately there are long-standing mathematical theorems showing why public-key encryption cannot be done with hashes alone. You have to have some kind of trapdoor object that has at least one form of usable "structure" - either group theory (incl. isogenies) or lattices or code-based or potentially in the future even more newfangled and spooky things (local mixing?). But for anything that has structure, you should assume that AI will make at least some progress in breaking that structure. Here, one reasonable inference is that if you want to make something plausibly long-term secure, multiply the key sizes by 10.

To me that's a very plausible world and something not at all extreme to predict. If AI will bring us 50 years of math in 2 years, then that 50 years of math may very plausibly include a "naive factoring -> GNFS" level of improvement to our ability to break lattices. In that world, lattices will still exist, but they will have to be significantly bigger to guarantee the same level of safety.

And at those new larger sizes, hash-based constructions will beat lattice-based constructions on concrete efficiency in every use case where hash-based constructions are possible at all.

Theoretically, of course it's possible that hashes are broken too (eg. P = NP would imply that). But I think P = NP is very unlikely. And intuitively, it's much more likely that a mathematical object has exactly no exploitable structure (like hashes are intended to), than that a mathematical object has exactly ~3 forms of exploitable structure (for elliptic curves: associativity, Schoof, pairings) and not some secret fourth form of structure we have not yet discovered that greatly degrades its security (for elliptic curves, ECDLP and pairing security). Similar for LWE, SVP, RLWE and the zoo of lattice problems.

For this reason, we do not yet see any reason to worry and start padding the byte size of hashes (if we start to worry more, we would pad the round count first before doing anything to the byte size).

Concrete TLDR, my own personal views:

* Hash-based > lattice-based, in those situations where hash-based is possible at all
* For anything lattice-based, be much more paranoid on param sizes. Remember that blockchains are only a small portion of the cryptography story; this point goes far beyond blockchains and applies to eg. access to websites, secure messaging, Tor / VPNs ...
* For privacy protocols, strongly favor NOT putting encrypted notes onchain. Instead, send them offchain through some third-party mechanism.
* If it's not difficult for you, keeping your funds in addresses which have not yet been used to make a transaction is a good idea. If it's easy for you, do it. **But be careful about migrations; I personally have lost more money in botched migrations than I have lost in all hacks combined**.
* For multisig wallets, doing confirmations offchain is better than onchain, because this way the signatures of signer wallets do not get exposed to the public, so if ECDSA falls to AI much faster than expected, at least the multisig "gracefully degrades" to a 1-of-1 where the 1 is whoever was gathering the signatures - a much better place to be than "anyone can take the money"
https://t.co/oVjwZog2lL

[qHOST @qhostworld]

paste any wallet into https://t.co/uHjM98tsjL and see how exposed it is. no connect, no signature, just your public address

[qHOST @qhostworld]

shor's algorithm in 1994, sycamore in 2019, willow in 2024, under a million qubits in 2025. nobody knows when q-day lands, but we know which way this is going

[qHOST @qhostworld]

no private key, no elliptic curve. a vault signs by revealing points on 34 keccak hash chains, so there's nothing for shor's algorithm to attack

[qHOST @qhostworld]

nobody needs to break your wallet today. they just save every public key and wait for the hardware. a qHOST vault has no key to save

[qHOST @qhostworld]

the canary is a wallet whose key was destroyed the day it was made. if it ever moves, someone broke a key, and every armed bunker fires in the same block

[qHOST @qhostworld]

the bugs came from way more traffic than we expected, but everything's fixed now and uploads work fine. enjoy the site, launch something and see why quantum is the next big shift

[Omnia Samy @OmniaSamy18]

@qhostworld It needs to be fixed. The launch pad cannot upload images when creating new tokens!

[qHOST @qhostworld]

in 2019 breaking RSA-2048 took an estimated 20 million qubits. in 2025 that estimate dropped under 1 million, and it's not going back up

[qHOST @qhostworld]

quick walk through https://t.co/1BQYuDBkuU. vaults, canary, bunker, watchtower, all live on robinhood chain

[qHOST @qhostworld]

your public key goes on chain the first time you send anything. its sitting there right now, waiting for a big enough quantum computer

[qHOST @qhostworld]

vitalik says dont panic move your funds, just cut your exposure to quantum vulnerable crypto. thats literally what we built. qHOST vaults have no elliptic curve key at all, and the auto bunker only moves your stocks if the canary dies https://t.co/Q2essGNS5c

[vitalik.eth @VitalikButerin]

I don't recommend anyone scramble to move their funds to new wallets today. But we should take the risks to cryptography from AI-accelerated math seriously, and minimize our exposure to not just quantum-vulnerable cryptography, but also potentially AI-vulnerable cryptography.

The core new area of risk from this viewpoint is, unfortunately, ML-DSA / FHE / lattices.

(and it's also another reason, along with quantum, why ECDSA might fall even faster than expected, hence the "fresh address" recommendation)

So far most people have been in the mode of thinking "elliptic curves broken, hashes safe, lattices safe". But there is a good chance that the concrete security of lattices will take serious hits from the next two years of AI math.

The basic threat model is: factoring is something that naively takes 2^(n/2) time, but over decades smart people have found and optimized number field sieves, and degraded that to 2^O(n^(1/3)), which is why RSA keys and signatures need to be ~400 bytes (and not 64 bytes). What if there are skeletons in the closet like that, both for elliptic curves and lattices, that we are simply not smart enough to discover - but bots soon will be?

This is a major part of the reason why for the past year ethereum's lean roadmap has been going in the "hash-only" direction: no lattices, no ML-DSA, no Falcon, no lattice-based commitments inside ZK proofs, etc. Signatures in lean ethereum are all hash-based, either WOTS or SPHINCS-.

For signatures and proofs, we already know how to go hash-only. The bigger challenge is for *public-key encryption* - and this goes far beyond blockchains. Secure communication, anonymizing protocols, lots of things need public-key encryption.

And unfortunately there are long-standing mathematical theorems showing why public-key encryption cannot be done with hashes alone. You have to have some kind of trapdoor object that has at least one form of usable "structure" - either group theory (incl. isogenies) or lattices or code-based or potentially in the future even more newfangled and spooky things (local mixing?). But for anything that has structure, you should assume that AI will make at least some progress in breaking that structure. Here, one reasonable inference is that if you want to make something plausibly long-term secure, multiply the key sizes by 10.

To me that's a very plausible world and something not at all extreme to predict. If AI will bring us 50 years of math in 2 years, then that 50 years of math may very plausibly include a "naive factoring -> GNFS" level of improvement to our ability to break lattices. In that world, lattices will still exist, but they will have to be significantly bigger to guarantee the same level of safety.

And at those new larger sizes, hash-based constructions will beat lattice-based constructions on concrete efficiency in every use case where hash-based constructions are possible at all.

Theoretically, of course it's possible that hashes are broken too (eg. P = NP would imply that). But I think P = NP is very unlikely. And intuitively, it's much more likely that a mathematical object has exactly no exploitable structure (like hashes are intended to), than that a mathematical object has exactly ~3 forms of exploitable structure (for elliptic curves: associativity, Schoof, pairings) and not some secret fourth form of structure we have not yet discovered that greatly degrades its security (for elliptic curves, ECDLP and pairing security). Similar for LWE, SVP, RLWE and the zoo of lattice problems.

For this reason, we do not yet see any reason to worry and start padding the byte size of hashes (if we start to worry more, we would pad the round count first before doing anything to the byte size).

Concrete TLDR, my own personal views:

* Hash-based > lattice-based, in those situations where hash-based is possible at all
* For anything lattice-based, be much more paranoid on param sizes. Remember that blockchains are only a small portion of the cryptography story; this point goes far beyond blockchains and applies to eg. access to websites, secure messaging, Tor / VPNs ...
* For privacy protocols, strongly favor NOT putting encrypted notes onchain. Instead, send them offchain through some third-party mechanism.
* If it's not difficult for you, keeping your funds in addresses which have not yet been used to make a transaction is a good idea. If it's easy for you, do it. **But be careful about migrations; I personally have lost more money in botched migrations than I have lost in all hacks combined**.
* For multisig wallets, doing confirmations offchain is better than onchain, because this way the signatures of signer wallets do not get exposed to the public, so if ECDSA falls to AI much faster than expected, at least the multisig "gracefully degrades" to a 1-of-1 where the 1 is whoever was gathering the signatures - a much better place to be than "anyone can take the money"
https://t.co/oVjwZog2lL

[qHOST @qhostworld]

how much could a quantum computer take from your wallet?

paste any Robinhood Chain address. no connection, no signature.
you get a score in two seconds.

post yours.

https://t.co/uHjM98tsjL

[qHOST @qhostworld]

the first coins are live on qHOST.

$QGOLD and $ORBJ, launched tonight, on Robinhood Chain.

the launchpad works. the next one could be yours.

https://t.co/4BJgLaawkk

[qHOST @qhostworld]

big update.

launching on qHOST just got stupid simple.

one signature. name, ticker, hold. your coin is live.
pay in ETH. no stock needed.
devs earn a share of every trade on their coin.
vaults are open, on chain.

we rebuilt the whole launch flow tonight, because you told us it was broken.

go launch something.

https://t.co/RX3vCY82IC

[qHOST @qhostworld]

3% on buys and sells, and here's why: we hold zero supply.

no team bag to dump means the tax is the only thing funding the build. it pays for contracts, infra and buybacks.

a dev with a bag profits by selling on you. we only get paid if people keep trading.

[qHOST @qhostworld]

honestly that’s up to the people. we’re focused on building and if people get how big quantum is going to be and how long this narrative lasts, it might get there

[Abdelaziz Ahmad @AbdelazizAc0bi]

@qhostworld do you'll think it might reach million MC?

[qHOST @qhostworld]

vaults are open.

Launcher: 0x2C151dbAa4F0C25B5fa24751b2925d6314ac22C8
QVault: 0x8dA9Aba2029d2650b84d9523d6332AE0129A7Cc0
QIdentity: 0x35349769D7f01ca5976AD6C1B34A2d2Fc9A78C44
QBunker: 0x1e66A6B2d4c6EA759895316f53bE68202C5e055E

launching a coin is now one signature. name, ticker, hold.
ETH and tokenized stocks can sit behind a hash, on Robinhood Chain.

we said we'd ship. go try it.

https://t.co/h68GP50KOq

[qHOST @qhostworld]

appreciate the idea but for now we’re keeping it focused on the product and the people using it, a community can come later if there’s real demand for it.
we don’t want to force anything on anyone

[CHRIZ VICO @Chriz_211]

@qhostworld The vaults and post-quantum identities are the part that actually needs a smaller conversation to unpack properly.

Anyone going that deep yet?

Feels like this stuff needs a based community to actually break it down instead of getting lost on the X page

What do you think?

[qHOST @qhostworld]

we intend to, appreciate the support. the bugs you guys saw earlier were from the traffic, site got hit harder than we expected. all fixed now, enjoy

[….. @PhoneConne5616]

@qhostworld Keep building

[qHOST @qhostworld]

16M $QHOST burned by the dev, 96% of the bag. team holds 0.005% of supply. check the chain 👇

https://t.co/WusHoESt9n