# Quantum and the Race to Upgrade with Alex Pruden

The Quantus Podcast, episode 23. Released August 6, 2026. Chris Smith, CEO of Quantus, speaks with Alex Pruden, CEO and co-founder of Project Eleven.

[Watch the episode on YouTube](https://www.youtube.com/watch?v=sO2ghX6Y__M)

## About this transcript

This transcript is lightly edited for readability from YouTube's automatic captions. Filler words, false starts, repeated words, and caption errors have been removed or corrected where the intended wording is clear. Brief interjections such as "yeah" and "right" are omitted unless they change the meaning. Words bleeped in the captions are marked [expletive]. Nothing a speaker said has been corrected or reworded for accuracy. The speakers' claims are their own and have not been fact-checked here. Timestamps mark the start of each speaker turn. One name is omitted at 41:24.

Speaker attribution was established from the captions and the content of each answer. Passages where the captions left the speaker uncertain were checked by ear against the recording.

## Transcript

**[0:00] Alex:** _(Preview of a passage from 36:27.)_ I think people are actually underestimating the timeline it will take to migrate to that post-quantum cryptography. There's a two-step process. First, an ark has to be built, and then you have to get on it. People are very unused to this, because in typical software migrations, think about when you upgrade your iOS or your Android device. You turn it off, you turn it back on, and you're in the new version. You didn't do anything. That's not how it's going to be with this migration. There are as many potential ways to footgun yourself in just the migration step as there are in building the actual solution.

**[0:41] Chris:** Hello everyone, and welcome to the Quantus podcast. I'm Yuvi Lightman, your host, and we're here with a very special guest today, the legendary Alex Pruden. Why don't you introduce yourself?

**[0:53] Alex:** Wow. Hopefully I can live up to the title of legendary. I'm Alex. I'm the CEO of a company called Project Eleven. I've been at Project Eleven for about a year and a half, since founding the company in late 2024. Before that, I was the CEO of a company called Aleo, a layer 1 blockchain for privacy-preserving smart contracts, built on a concept called Zexe, which was an outgrowth of Zcash back in the day. I was there for four and a half years, between the foundation and the labs company. Since being in the industry, starting ten years ago, that was my opportunity to be at the forefront of taking a blockchain from zero to one and launching it, which is obviously what you guys are getting ready to do at Quantus. So I've been in the trenches. I've definitely felt the pain in certain moments and basked in the glory in other moments.

Prior to that, I was an investor at Andreessen Horowitz, on the first crypto fund, from 2019 to 2020. I worked on a bunch of stuff. Some stuff I loved has gone by the wayside. For example, Arweave was a file storage protocol. That was my deal, and I really loved it. Sadly, it's gone by the wayside now. I also worked on Libra, or Diem. It's been known by many names, but it was the Facebook stablecoin initiative that failed and has now been rebooted in a number of forms. So it's interesting to see.

**[2:26] Chris:** Was that connected, by the way, to Sui, or was that a different team?

**[2:30] Alex:** Sui was founded by several of the engineers at Libra. Libra was the name of the protocol. Diem was... I think it was initially called Calibra. Calibra was the Facebook wallet for Libra, and a lot of the engineers in Calibra, which later became Diem, left to found both Aptos and Sui, which were both based on a lot of those concepts. For example, the Move programming language spun out of there. So those two groups basically spun out of that.

Before my time in crypto, I was in the Army for about ten years. I actually got into Bitcoin working in the Middle East around 2015 and fell down the rabbit hole, as we all do. It's been a pretty wild ride. So it's great to be here.

**[3:20] Chris:** Well, thanks for the background. I'm really curious about Project Eleven in particular. You said late 2024. What was the impetus for that? I think that was before the Google Willow announcement. Is that right?

**[3:35] Alex:** It was around that time. I had stepped down from Aleo full-time, and I was considering what to do next. I've always been interested in cryptography personally, which is what led me to ZK in the first place. When you're studying cryptography, there's this caveat whenever you're looking at any asymmetric cryptosystem that we use today. They say, "Well, in the quantum world, all this goes out the window. But we think quantum computers are really far away, so just ignore that little footnote."

So I was sitting around wondering what to do next in my career, and the Willow paper came out right around that time. I was thinking about post-quantum cryptography. First off, at the start of this, I knew almost nothing about quantum computing, other than that it's this doomsday device that destroys ECDSA. But when that paper came out, I started to wonder what the timeline for quantum is.

Then, because I had just come off the heels of launching Aleo, which for context we intended to launch in 2022 and ultimately launched in late 2024... and this is the story of many complicated layer 1s. There's a lot in there. You get one chance to do it right. Cryptographic systems are hard, and they can't be rushed. So that was really the second realization I had: all this post-quantum cryptography that we're talking about deploying in the event of a quantum computer coming is complicated and relatively novel, and I think people are actually underestimating the timeline it will take to migrate to post-quantum cryptography for these existing systems that we're relying on.

And I think it's coming at an interesting time for blockchains. I feel like blockchains, digital assets and cryptocurrencies have just gotten over the hump with regard to adoption. You actually have real adoption of stablecoins, DeFi in various forms, real-world assets, prediction markets. All of that adoption that we talked about and dreamed about eight years ago has only just happened, and you've convinced everyone that this is really the future. And it's awkward, because now you have to tell everyone that there's this one thing we have to keep in mind: we have to switch over all this cryptography, which is way more complicated because of the architecture of these systems than it is for traditional systems. It's the intersection of many things that I find very fascinating, and that's what got me down the rabbit hole, contemporaneous with the Willow paper coming out in late '24.

**[6:25] Chris:** I think that Willow paper was really the starting point for a lot of people. I don't remember there being much quantum news, at least not reaching the mainstream, in 2024. And when the Willow announcement happened, the market took this hit. Bitcoin crashed a bit, QRL doubled, and Chamath was dooming on his podcast. It was interesting to see how the market has figured out that some blockchains are vulnerable and some are not. It overreacted to the news. It wasn't that the quantum computer is here now, run for your lives, but it did represent a meaningful step forward.

Then we noticed people in our circle started to come around. Jensen Huang had his boomerang. He said, "Oh, it's twenty years away," and a couple of months later he said, "Okay, maybe not, and by the way, we'll have QPUs on Nvidia chips in the next few years." And what else happened? Scott Aaronson flipped a lot of people, because he was this famous quantum skeptic. And I've noticed recently that Kostas from Sui flipped. He was a bit of a quantum skeptic, and maybe he saw something in the development of quantum that made him change his mind, or maybe he realized, "Okay, maybe we shouldn't fight this. We're going to have to do this eventually. Why don't we do it while we have some momentum?" And maybe it's affecting investors' perception of the blockchains.

I think it's interesting how the closer you get to cryptography, the messier it gets. When you first learn about it in school, it's a one-way function: it's easy this way and hard that way. That's a beautiful abstraction. Then you get a little bit closer and you realize there's actually this cemetery, all these dead bodies everywhere, of failed cryptosystems that people thought were secure and turned out not to be for various reasons. That even includes some elliptic-curve schemes. They found that torsion in the curve caused this breakage. And now we have AI accelerating everything, doing meaningful new research in mathematics. So AI is accelerating quantum.

But even without that, I feel like it was a little shortsighted for everyone to bet the farm on elliptic curves. We were never going to be able to say elliptic curves forever, Schnorr signatures forever. At the very least, you need to be able to change the keys on the lock. Even if you're a quantum skeptic, are you really going to short AI at this point and say that AI will never find a flaw in secp256k1 or the Edwards curve? Hopefully it doesn't. But it's also worth noting that everyone was using the lowest acceptable security level for a lot of these systems, so we don't have that much cushion for cryptanalysis to advance very far before it causes a real problem.

We've had quite a few months now where, from Sui, and now Ledger and NEAR, some chains are placing their bets on which post-quantum algorithm they're using. I'm curious how you see this process going. There are a lot of different trade-offs in all these things.

**[10:14] Alex:** I think this is one of the most fascinating aspects of this to me. To reiterate, before, elliptic-curve cryptography was effectively standard for everything, and it's important to note why. It is incredibly efficient: a relatively small key and small signatures, with relatively well-understood security assumptions, classically. You got a whole number of benefits. You can do all the classic authentication and signatures, but you can also do zero-knowledge cryptography off of it. You can do multiparty computation protocols, which enable thresholding. You can do pairing-based cryptography, which is exactly how Ethereum's proof-of-stake network works. It is truly the Swiss Army knife. It's perfect for everything. That's why it's important to unpack the reason everyone put all their eggs in this basket: it was such a useful primitive.

Interestingly, the reason elliptic curves even came about is the smallness of the signatures and public keys. RSA was an older cryptosystem, not quite as flexible, and one of its major disadvantages was that to get to a certain security level, you had to have quite large keys. I think RSA-4,096 is the current required implementation, and that's 4,096 bits, I think, of key size. That's quite large compared to a 256-bit key for ECDSA, ECC-256.

Now, interestingly, from a quantum perspective, that shortness of key is very relevant, and this was not widely known until very recently. The Google paper that came out a few months ago... by the way, we were cited in that paper. I don't want to take full credit, but we were one of the people they talked to when they were learning about cryptanalysis and its implications, around what happens if we look at elliptic-curve cryptography versus RSA. Historically, the physicists and the quantum people working on quantum computers were benchmarking against RSA, and it turns out that when you look at ECC, it's a much easier problem to break. That's why, ironically, the concern got pulled much closer than people had initially realized. Elliptic-curve cryptography was great for everything, and it turns out it's probably going to be the first thing to break in the quantum world, unfortunately.

Now, what's going to happen? You asked where the space is going. Again, this is to me one of the most fascinating aspects. There is no one-size-fits-all solution. There is no drop-in replacement for elliptic-curve cryptography. The trade-offs are, roughly speaking, performance characteristics generally: signature size, verification speed, signing speed, public-key size. Second, the novelty of the cryptographic assumptions. And the third one is implementation complexity.

I want to linger briefly on that third one, because of something you said: it all seems easy when you're first learning about cryptography. I wouldn't even say it's when you're first learning. It's often easy from an academic perspective. But when you actually have to put it into practice, and you know this from building what you guys are building, there are a billion ways it can go wrong that you never have to consider when you're writing a paper.

So there are roughly three dimensions where you've got to take trade-offs, and different chains have increasingly specialized for different use cases and are picking different points along that spectrum. What's the upshot? The upshot is that the universality we currently have with elliptic-curve cryptography in blockchains, for the most part, is going to go away. There's going to be a balkanization. In some cases, completely different families of cryptographic assumptions are going to power one chain versus another, and it's going to be completely different going forward.

**[14:23] Chris:** I think there is some benefit to the industry converging on at least one family. And of course, having crypto agility, being able to change the keys on the safe if you need to, is quite valuable, and certainly easier with newer blockchains than with the old ones. I think we're going to have to go through a grieving period with elliptic curves, because they were so magical. They were really pushing the boundary on how small the system could be. I think there's an information-theoretic bound on how small the signatures and keys could be, and elliptic curves were pretty close to it.

NEAR's MPC system, I think, is now up to around twenty signers, and there are no post-quantum systems that handle that many signers in threshold signatures. So everybody's going to take a performance hit. I saw that Charles, the CTO of Ledger, was saying that their perception was that the industry is converging around ML-DSA, which I believe was the first signature scheme to be standardized by NIST. It's got a nice balance of performance characteristics. It's not the smallest signature, but the keys aren't gigantic, it's pretty fast, and it does have okay threshold schemes, but they don't scale super well. You can't really get past six signers.

I saw that Cloudflare published a piece saying that you don't go to war with the algorithms you wish you had. You go with the algorithms you have. It was a really great piece, where they laid out all these characteristics and the whole zoo of possibilities.

The rule of thumb I try to give people, depending on how involved they want to get in this stuff: at the beginning of the quantum narrative, a lot of people were worried about Bitcoin mining. No, it's not the hashes. Hashes are generally safe. In fact, we build post-quantum systems out of hashes. Elliptic curves are really the vulnerable point. There's almost nothing in blockchain that uses RSA. Maybe some people encrypt their wallets at rest using RSA, but it's really...

**[16:51] Alex:** There are some ZK systems that use groups of unknown order, which is a similar problem to RSA. So there are some flavors of ZK that rely on similar assumptions. ZK in general is a space I was in. Aleo, the blockchain I led, is all built around elliptic-curve-based SNARKs. And by the way, you see a lot of people talk about hash-based SNARKs. I think STARKs is really just a marketing term for hash-based SNARKs. People say these are quantum secure. The reason no one deploys them directly on chain, and they always use an elliptic-curve wrapper around them, is the performance characteristics. Hash-based STARKs are bigger, and they're not constant size. This gets back to the trade-off space. The way we do ZK goes back to elliptic curves being the one-size-fits-all solution for everything. Now we're going to have to face these real performance trade-offs more concretely.

I think what you mentioned around the standardization piece is interesting. I disagree with Charles, and I think Charles is talking his book to some extent. I think Ledger devices are simply unable to do some of the operations that some of these post-quantum signatures require, so from their perspective, if everyone went with ML-DSA, they would love that. But take the two largest ecosystems, Bitcoin and Ethereum. Neither of them has indicated that they're very interested in ML-DSA. Ethereum has the nice property of account abstraction, so for custody you can do ML-DSA, or people can implement whatever they want. For the consensus layer, though, Ethereum is looking at hash-based schemes, and so is Bitcoin. They're both looking at stateful hash-based schemes, actually.

That's the difference here. For those who don't know, a stateful signature scheme requires effectively keeping track of the number of signatures that you've signed, and losing track of that number is almost as bad as losing your private key. This is a completely different assumption, or interface, that no one in digital asset custody has had to care about before, but it's just as dangerous as losing your private key. So this all has to be accounted for.

Unfortunately, the reality is that different people are going down different directions, particularly toward hash-based schemes. People like those because they appreciate the conservative security properties. They're based on very conservative assumptions. But they have big implementation complexity, the nonce stuff for the stateful schemes, or, if you want to get rid of the nonces, gigantic signatures with horrible performance characteristics.

**[19:45] Chris:** If you work in crypto for a little while, you realize how difficult it is just to get people to back up a seed phrase. This is why custodians exist. It actually is a pain in the ass to manage your own keys. You back up a seed phrase once, and then you can use it for all time. With HD wallets, you can make many different address types from it. But if you have to re-back up your coins every time you make a transaction, or there's extra information that's required, in my opinion that's just a deal breaker for usability, because there are so many things that can go wrong.

**[20:28] Alex:** Just to jump in quickly there, I'll get on my soapbox and criticize the leading proposal for Bitcoin, which is Blockstream's SHRINCS proposal. On its face, it's a very elegant solution. It's a stateful scheme, but if you're ever worried you lost track of the state, you can switch back to the stateless scheme, which is big. So theoretically, you have a way to keep smaller signatures. But the problem is that the key holders have no incentive to ever risk going the stateful path. Why? Because even the smallest chance you'd screw it up, why would you risk it? So you're always going to default to the stateful path. So why even include all this extra complexity? Again, in an academic setting things can make sense, but in the real world, with real incentives and engineering challenges associated with costs, certain things make less sense.

This is why, going back to ML-DSA, I honestly like ML-DSA as a scheme. We actually see this arc in some teams we talk to. First they say, "We want to do something really crazy." I won't name schemes, because everyone has their favorite, but some people want to do really crazy stuff. Then they say, "Never mind, we want to be really conservative," and they get to hashes. Then they ultimately come all the way back and say, "You know what? ML-DSA isn't that bad." And I'm like, "Yep, it's not."

**[21:55] Chris:** We started out looking at Falcon, and we went pretty far with that before we talked to Thomas Pornin, one of the authors of the Falcon standard. He said, "Are you sure you want to do this? Do you realize what you're getting into?" When the author of the standard himself says this isn't really fit for blockchains... Then we looked at it and realized he was right.

Whenever I want to blow someone's mind who's not a cryptographer, I tell them about side-channel attacks. People are like, "What the [expletive]? Are you serious? You can point an antenna at my device and extract information about the computation it's running?"

I had read about constant time before, but I had never read code that was intended to be constant time until we started doing the Falcon stuff. I was thinking, why is he doing arithmetic in this backwards, [expletive]-up way? What is wrong with these people? Then finally I realized it's so that there are no branches when you compile it into machine code.

**[23:01] Alex:** Exactly. In the rarefied world of academic cryptography, you don't think about it, but in the practical world you have to worry about these side-channel attacks. In a lot of instances, where you're running things on servers in data centers, you can maybe be forgiven for caring less about that. Is the attack model that someone, Alex, has to break into the data center and point an antenna? Maybe that's complicated. But in a world where we're dealing with keys on end-user devices, this is definitely a problem, because I'm carrying my phone in my pocket. So you definitely have to think about it.

By the way, the other thing on the ML-DSA side is one of the funny arguments I get into with people sometimes. People say, "We can't trust lattices. They're untrusted. We don't know." Look, lattices have been around for the better part of three decades, in thinking about them for cryptographic purposes, and obviously the idea has been around long before that. People say, "We've got to use hashes. It's the only thing we can trust." Then I say, okay, well, there's no hash-based key exchange scheme. Think about the model here. I'm going to send a transaction. What's the first thing you're going to do? You're going to connect from your client to some server that's running a node. How are you going to connect securely? You're going to use TLS. What is TLS going to use? A lattice-based key exchange scheme. You're already onboarding some lattice-based assumptions no matter what you do. So you might as well accept that this is how it's going to be.

But a word you said earlier is really important, and people should remember it: crypto agility. It's true that no scheme is bulletproof. Theoretically, there's always a chance things could break down the road, lattices or otherwise. Even hash functions could turn out to be insecure for some reason, any specific instance. Ultimately, the world needs to be ready to migrate away from schemes that get broken. But it's also important to note that everyone is doing all this weird, crazy research that might bear fruit, and ultimately we may want to migrate to that at some point without breaking everything all over again. I think that's just the model the world is going to.

**[25:11] Chris:** It's interesting. Have you been following Daniel Bernstein and the IETF stuff? It's been pretty fascinating to watch. He's really making a lot of noise, and I think he has some good points. He also has a dog in the race, so to speak. I think he's an author of one of the competing PQC schemes. But he's also a legend in the cryptographic world. He's pointing out that the NSA seems to be pushing for TLS to be pure lattice and not hybrid, and he's asking why that is. Do they know something we don't? In general, you can probably assume that they know a lot of things we don't.

**[25:54] Alex:** Yes. They've been caught red-handed multiple times.

**[25:58] Chris:** That's right. So if you look at NIST's history, there are all kinds of reasons to be a bit doubtful of NIST. However, it's worth saying in defense of these systems that it was an international competition that determined these PQC algorithms. So it would take quite a big delta in knowledge between, say, the American spy agency and literally every cryptographer in the world, or some kind of collusion, to slip these things past. But there's that whole thing from the Snowden revelations about the side-channel attacks on AES, or generating random numbers from an elliptic curve.

**[26:43] Alex:** Well, the legacy of blockchains is this. I don't think any blockchain that I know of actually uses the NIST-standard elliptic curve, X25519. They don't use it because the constants for that curve were just... someone walked out one day and said, "Here are the constants. They're secure." Look, they may be, but people have long suspected that there's something weird about them. This was exactly why Satoshi chose the k1 curve and not the 25519 curve: the constants were generated in a way that everyone was confident there was nothing up their sleeve.

By the way, on this concept of NIST as a standards body that speaks for the world of cryptography: in the early 2000s, when elliptic-curve cryptography was being standardized, we were very much in a Pax Americana world, and in general, certainly the Western world was very aligned around following this. I think we're not in that world anymore. There are a lot of countries that, rightly or wrongly, view the United States with distrust, and inevitably there are going to be completely different standards that emerge from different countries. South Korea is a good example. South Korea has its own entire suite of post-quantum standards for its cryptography that's not NIST-based. I think that trend is only going to continue.

**[28:19] Chris:** Right, and that just adds to this balkanization effect you mentioned. Now everybody's speaking different languages. It's the Tower of Babel all over again. So what's your view on ECDSA.fail? I think this is one of the most interesting things happening right now. It's a convergence of narratives. What do you think of it?

**[28:44] Alex:** Quick context for listeners who may not be aware: we're going to talk about this website, ECDSA.fail, which is focused on optimizing a part of Shor's algorithm. Shor's algorithm is the algorithm you run on a quantum computer to recover a private key from a public key in an elliptic-curve or RSA setting. Google released their paper this year, which I mentioned a few minutes ago, where they said ECDSA is a lot easier to break, and by the way, here are forty pages on how this affects blockchains.

Interestingly, one of the telling things in that paper was that they did not publish the circuit. Quantum algorithms are often represented as circuits, an abstract notion of circuits with qubits arrayed across the computation, doing different things at different steps. If you imagine the entire computation of Shor's algorithm laid out in a line, that's what the circuit is. Typically, in papers with Shor's algorithm resource estimates, these circuits are published so people can evaluate their trade-offs, because some circuits require a lot of qubits and fewer steps, and some require more steps and fewer qubits.

In the Google paper, they chose not to publish the circuit directly, and their justification was that it was too dangerous to do so, implicitly because they viewed us as too close to the mark where this might actually become real. So they published a zero-knowledge proof that the circuit correctly compiled. They proved they had a circuit that was legit without publishing it. Funnily enough, though, they didn't do a great job, because someone reverse-engineered the circuit from the actual repository associated with the paper. And then ECDSA.fail, which you're referencing, was basically an autoresearch, AI-assisted research site, saying, "Here's Google's circuit. See if you can do better on any one of a number of metrics."

To be clear, there are multiple parts of Shor's algorithm. This targeted a single subroutine, but people got that subroutine down, I think, 40% lower than what Google had. You mentioned earlier AI and its impact on security and cryptography. I think this is just an example of how AI is going to disrupt the status quo of "we have this unbreakable foundation we can rest on forever." You have new computational primitives that are quantum, which enable new algorithms that were never possible before. You have AI that's constantly finding new ways to apply these algorithms. It basically means the shelf life, in my view, of any cryptographic algorithm is drastically shortened, which means there's a virtual guarantee that anyone who deploys cryptography in the next decade is going to need to migrate away from that cryptography a decade later. And that means you should just plan for that now.

**[31:53] Chris:** Exactly. And it's interesting that it came out that some part of the US government tapped Google on the shoulder and told them not to publish that. And it took the ECDSA.fail people about three days to catch up to Google. Then shortly after that, there was the Trump executive order accelerating the government's timeline for migrating to PQC. It seemed to demonstrate that even the government was caught off guard by how fast AI was going to accelerate quantum research.

**[32:33] Alex:** Oh, yeah. One of our advisers is at Caltech and works at Oratomic, which is another big quantum startup, and that team has talked a lot about this publicly: how much they're able to use AI in optimizing error correction and doing various things. AI has an accelerating effect on science generally, and in this specific area I definitely think it has advanced things. But independent of AI, I think quantum has advanced very quickly.

I think the reaction from Google, from Trump, and from the various countries that have now passed these regulations should be read as this: people had quantum in their heads as an indefinite timeline, always twenty years away, and now people are actually being forced to consider a world in which the timeline has become definite, and they have to put real plans in place to migrate.

Ironically, the crypto and blockchain space, which is arguably the most vulnerable in terms of value, is in a funny spot. You mentioned a couple of teams that are leaning forward on this. I think Ethereum has done some work. Zcash recently announced their Ironwood upgrade with a post-quantum recovery mechanism. So people are starting to do stuff. But by and large, the reaction to all this quantum stuff, and this has certainly been true in Bitcoin, is an outright rejection of the premise that quantum computers can exist, which is ironic in my opinion. But that's unfortunately where we are.

**[34:13] Chris:** It's interesting seeing the personality traits that crypto attracted, the maverick and rebellious. But crypto as an industry also pushed cryptography forward tremendously. ZK was a pure fantasy, a theoretical math thing, before Zcash. I think this was the first real commercialization of cryptographic research that ever existed, as far as I'm aware. But it also attracted people who think, "The institutions don't know. We know better. We can do this ourselves," which is a cool thing. But I was a little shocked to see Adam Back insulting anyone who brought up quantum as a concern.

**[35:11] Alex:** Well, now Adam's adopting it. He's saying, "We're actually building all this post-quantum stuff." Obviously there's an angle. A lot of guys like that have angles. But I think, unfortunately, a lot of folks have just not been paying attention.

To be charitable, there is one challenge that's worth highlighting, which is tricky. This is a decentralized architecture. Take you as an example. You guys are building a protocol. You're not going to own all of the assets on that protocol. In fact, that's the opposite of the idea. Ideally, you're building a protocol that enables people to be owners themselves, with no intermediary. That's the whole point. But to be quantum secure, you actually need people to adopt the post-quantum options you're giving them. Now, in Quantus's case, it's all baked in as a default, so you don't have this problem. But for blockchains that already exist, take Bitcoin, there is a problem. Bitcoin is maybe a funny one, because there's not really a foundation associated with it, but the core devs, such as they are, can ship a post-quantum signature option, and that doesn't automatically translate to Bitcoin being post-quantum secure.

I think this is something a lot of people fail to fully register in their minds. There's a two-step process. First, a ship has to be built, an ark has to be built, and then you have to get on it, which requires something from the user. I think people are very unused to this, because in typical software migrations, think about when you upgrade your iOS or your Android device. You turn it off, you turn it back on, and you're in the new version. You didn't really do anything. That's not how it's going to be with these migrations. And there are as many potential ways to footgun yourself in just the migration step as there are in building the actual solution.

The other thing is that once you get past Q-Day, all migration gets way more complicated. What does a migration look like? You're basically going to send a transaction to a new address type, more or less. But if I can forge your signature from the old address type, what does ownership mean anymore? This is the philosophical thing that elliptic-curve cryptography, and public-key cryptography generally, gives blockchains: a concept of ownership, digitally. That's what guarantees it. When that goes away or is compromised, if the quantum computer owner in some sense owns all assets that are classically secured, ownership ceases to have meaning. That's the other piece I think people don't fully appreciate.

**[38:03] Chris:** The migration is a huge piece of it. We've talked to some capital allocators in the space, and I think this gets put on the shelf. But if you zoom in and look at it, it's actually quite hairy, especially since Bitcoin has a small block size and the post-quantum signatures are much bigger. And of course, in general, you'd like to not make your users think about cryptography. "By the way, there's this thing called cryptography, and it's actually kind of shaky. We have to move it to another one. Sorry, guys."

**[38:45] Alex:** That's a huge point in favor of you guys, and the way you're doing it, starting from the ground up. Yes, you have to go to something new, and there may not be as many established applications or as much liquidity as on Ethereum or other ecosystems, but you never have to migrate, or at least you don't have to migrate immediately. Look at all the people launching stablecoins now on rails that are inevitably going to be obsolete soon. By the way, all these stablecoin issuers are centralized. So there's a giant pot of money sitting on chain. What is that to a quantum adversary? A big, fat payday waiting to happen. So it's inevitable that people will start to realize, A, that a migration is complicated, and B, that post-quantum cryptography is going to be a must-have feature for anyone serious about deploying applications.

**[39:39] Chris:** I like to say that in the future, they're not going to call it post-quantum cryptography. It's just going to be cryptography, and everything else will be pre-quantum. You'll learn about it if you get a PhD in cryptographic history, or it'll be obscure history in a museum somewhere.

People always ask me when I think Q-Day is going to happen, and I don't like to pick numbers, because predicting technological development is inherently difficult. It's nonlinear, it's stochastic. But also, we may not get the announcement when it happens. What's your view on this? Do you want to pick a date?

**[40:16] Alex:** First off, I think it's worth reiterating what you just said, because it's very important: we may not get an announcement. You mentioned something earlier that a lot of people aren't aware of, which is that the Google paper was subject to extreme scrutiny as it was. They even withheld the circuit, and there were folks very high at Google, in touch with the government, who were putting pressure on the authors not to publish that paper. And that paper is just a resource estimate. It's not describing how you build the thing. So I think we can infer that going forward, it's unlikely that we'll get some kind of public warning that this is happening, even from our own governments. Even if you trust the US government or whoever made it, if they reveal this capability, they no longer have this asset. There's just no incentive for anyone to reveal it. So there's a lot of uncertainty inherent here, because we're not going to get many more signals.

This is a pushback I get. I had a debate with a great guy in the Bitcoin community, and this is his whole point: "I'll believe it when I actually see some long-lived logical qubits." That's a very rational position to hold. Quantum has been around for twenty years. How many false starts has it had? A lot. This is why everyone's kicking the can on it. So it's a very reasonable position. The danger, though, is that as you approach that threshold, it's just going to go dark, and at some point it's going to be all or nothing. It's going to be a total switch.

So, my estimate. We have a whole report, which you can link in the show notes if you're interested. We've got a couple of different models that we use. One is a survey of experts that gets published every year. One is the quantum computing roadmaps published by the companies themselves. And then we have our own internal model that combines a number of different facets of quantum computing and asks, assuming a growth rate of x% in these various facets, where do we cross the line? Our base case is that the chance is greater than not that a cryptographically relevant quantum computer will exist by 2032, and I think there's a reasonable chance that by 2030 we're already there.

People say, "That's still six years away." There's a concept called Mosca's inequality, which I really like. When is the quantum computer coming? What's your window there, because it's uncertain. Then how long is your migration going to take? What's your window there? Basically, you need to avoid the overlap. So you have to buffer all that time. When you start thinking about all the things that have to happen, six years, even if you assume the base case, is really not that long. And for planning for systems that are securing, in Bitcoin's case, trillions or hundreds of billions of dollars in value, are you going to roll the dice on that? It seems very dangerous.

By the way, to some crypto people this feels like a news flash, but for the world... Google itself said, "We are going to be post-quantum secure by 2029." That's what they're doing. And this isn't cost-free to them. It's a significant investment of engineering effort and dollars, and they view it as worth it because the risk to them is not worth taking. Google is the author of this paper. I think this is a signal that we should take seriously.

**[44:01] Chris:** I think Cloudflare has the same date, 2029, as their internal target. And: let's just pick an algorithm and run with it.

If we saw what was happening with the Google paper, where AI was accelerating the research but they were also getting gag orders, we have to assume the quantum hardware labs are experiencing the same thing, even if it's harder to do open-source research there. I think IBM has one that says there's around a hundred logical qubits, but they're pairwise entangled. If that's publicly available, we should assume that somewhere, maybe not IBM, maybe another company, somebody probably has a gag order, so that the capabilities are actually higher than what we see by some factor.

**[44:49] Alex:** Let's talk about the elephant in the room here, which is where China is at. Certainly if you're in the US, you view China as an adversary, and obviously there's a lot of competition with AI and so on. It's a big black box there. In fact, China has basically created a national effort, a Los Alamos-style national effort, to come up with a quantum computer, and research only occasionally dribbles out of there. So it's very hard to even understand whether they're behind or ahead. All we can conclude is that we can't count on some lab with purely beneficent intentions deciding to invent this, tell everyone, and then withhold using it to make money. That seems like a very outside scenario to me.

**[45:51] Chris:** It's a sort of conspiracy theory. It's this sort of "the government is my daddy, he loves me so much he'll take care of me." It's kind of childish.

**[46:02] Alex:** It's very childish, and it's obviously very antithetical to the crypto ethos. It's very much the opposite end.

There's a lot of uncertainty here, and this uncertainty is ultimately what demands, I think, conservatism: conservatism in the form of preparation and planning starting now, not tomorrow, now; conservatism in the form of assuming that things are going to happen faster than you think they might; and assuming that what you go to might not be where you stay forever. It sounds simple, but this is not how cryptography has ever been done. So I think we're entering a new era, and to me that's why it's really fascinating.

**[46:49] Chris:** It's a really exciting time to be alive. I certainly wouldn't trade this for the world. In crypto, there's a broad range of players. There are the memecoin traders, leveraged to the hilt, and then you have the institutional guys. It's interesting how, with the quantum thing, the conversation was a lot easier to have with the institutional guys. They're hearing about quantum from governments and from different angles, and they're also typically allocating capital for other people, so they have to be more risk-averse.

So that's your whole realm. And on the other side of the spectrum, there are memecoin traders who are only looking at the current day's or the current week's narrative, and they're thinking, "Wow, 2029 sounds like forever away." So we have all these different players, and we have to balance their interests and motivate them somehow with some carrots and sticks.

**[48:00] Alex:** I have a take here. It's somewhat controversial for crypto, and I consider myself a cypherpunk in spirit. But I think the reality is, and this quantum thing throws it into stark relief, that purely decentralized systems are at a disadvantage in terms of adoption, and specifically in terms of migration to post-quantum cryptography. It's just way more chaotic. The other reality is that because these new post-quantum algorithms are much less performant, you're going to take a much greater performance hit as you decentralize.

I think the inevitable conclusion from that fact is that these systems are going to become more centralized than Satoshi probably initially envisioned. You could argue this is a really, really bad thing, and if we lose what makes crypto different from a database, then we've obviously lost the whole war. But there are degrees of decentralization, and I think we have to accept that institutions staffed by fiduciaries are going to demand some degree of reliability, of security, of expectation around maintenance, that people have just handwaved up to this point.

I don't think Ethereum and Bitcoin are necessarily as guilty of this, because they have fairly large communities. But look at the chains that launched five or six years ago. Those teams mostly launched the chains, created the foundations, and cashed in. There are nominally some people maintaining them, but let's be real: those things are dead, and they aren't going to actually migrate. It's over. And no institution wants to bet on infrastructure where the people maintaining it are going to disappear in three years after they've made their millions. That's the unfortunate reality, and I think it means the space is going to become more professionalized. It's going to get a little less decentralized, to be sure. But what we have to do now is fight to protect the principles that make this space different from just a [expletive] credit card on a database.

**[50:32] Chris:** I've been in crypto for a while. I got into Bitcoin because it was peer-to-peer electronic cash. Then at some point it became all about digital gold, not cash. Then it became a BlackRock ETF instead of gold. And now the inheritor of peer-to-peer electronic cash is really stablecoins. The US government is going all in on stablecoins, which is pretty exciting. It's a compromise. They can still print it, and they can still freeze it, but at least you don't have to go through the humiliation ritual of opening a bank account to acquire one. So that's a nice trade-off.

But all these stablecoins are on pre-quantum blockchains. It's pre-quantum infrastructure. If you were going to rate the value of individual elliptic-curve keys, the admin keys on these stablecoins would probably be the highest-value single target. If it's going to take you a month to crack a key, maybe you need to be picky. Technically, you could unwind it through a legal process. You could take a snapshot and roll it back. But in the meantime, if somebody mints a quadrillion USDC and goes and buys everything on Uniswap, everybody's number will be very high and they'll be happy about that, but that attacker is suddenly going to own a bunch of digital assets that can't be rolled back through a legal process. Everybody would get liquidated, the pegs would break, and nobody would trust DeFi again. If somebody wanted to pull the rug on the US advancing its financial hegemony through stablecoins, these stablecoin minting keys, the admin keys, are quite a hot target.

**[52:35] Alex:** Oh, yeah, and that's a nation-state-level target. That's a perfect way for a nation-state-level adversary to disrupt the financial system of a country, and it's completely nonattributable, by the way.

**[52:47] Chris:** Right. "I don't know how they got the key. They just got a key." You don't get a memo when someone steals your key explaining how they got it. And you also don't necessarily get forewarning: "Hey, guys, I've got this thing. I'm coming to get you. Better lock down."

**[53:02] Alex:** Do you remember the Paxos thing? I think it was last year. They accidentally minted, I think it was a couple of trillion dollars' worth of USDC, and it turned out that was just a bug. But are you going to know the next time? The answer is you're not. It's going to take some forensic work, probably after the fact, to determine that it was actually an attack.

**[53:22] Chris:** Right. This is why people tried to program away the money printer. That's the original idea of Bitcoin. Our view is that this winter, we're doing some soul-searching and remembering why we got into crypto in the first place, and this is a chance to revive the fire that started it, the cypherpunk...

**[53:44] Alex:** There are very extreme versions of the cypherpunk vision out there. But the one thing that blockchains enable that no centralized system could replicate is interaction between mutually distrusting parties. You're never going to have another system that can do that. That's one of the beautiful things about Bitcoin. You can obviously get performance gains by turning that dial down, and maybe that's good for some things, but ultimately blockchains uniquely enable this. Whether or not that's the cypherpunk-maximalist version of the world is debatable. It's probably not. But there are a lot of these properties that make blockchains special, which means they're not going away. They are going to be here.

And fundamentally, there's this use of cryptography for individual ownership. You mentioned stablecoins earlier. Stablecoin issuers are already way better than people's bank accounts. You can send money anywhere, anytime, for virtually no fees. You can earn interest on these things very frictionlessly. And in a worst-case scenario where someone bans you, at least it's public. There are a lot of cases where people get bank accounts closed or frozen, it's completely opaque why, and there's zero accountability and no recourse. So there are a million reasons why, even though stablecoins are probably the least cypherpunk app on a blockchain, they're still a pretty big improvement. I think we should remember that.

**[55:20] Chris:** That's a good point. It looks like we're coming up on time here. It's been a great conversation with you, Alex. Where should people go to learn more about Project Eleven?

**[55:28] Alex:** projecteleven.com, and we have a report, if people are interested, at report.projecteleven.com. That's if you really want to get deep into quantum and blockchain and how quantum affects blockchain. I'm also on X, @apruden08. I write a lot of wonky things, sometimes interesting, though I find them all interesting. I write a lot about quantum and post-quantum, and also ZK, which is another area I'm interested in. That's probably the best place to find my [the captions end here, at 55:52].