Project Eleven CEO Alex Pruden joins Chris Smith to discuss why elliptic-curve cryptography has no drop-in replacement, why he expects AI to shorten the working life of cryptographic algorithms, and why an upgrade protects only the holders who move to it.
This article is an edited summary of Alex Pruden’s appearance on the Quantus podcast, released on August 6, 2026. The conversation has been organized by theme, with quotations lightly edited for readability.
Watch the episode on YouTube. Follow the podcast on Spotify or Apple Podcasts.
Need the transcript for your LLM? Download the full transcript quantum-and-the-race-to-upgrade-transcript.md.
About Alex Pruden
Alex Pruden is the CEO and co-founder of Project Eleven, which builds post-quantum security infrastructure and tooling for digital assets. He previously led Aleo, a privacy-focused layer 1 blockchain, serving as its CEO and as executive director of the Aleo Network Foundation. Before that, he was an investing partner on the crypto team at Andreessen Horowitz. He served nine years in the U.S. Army as an Infantry and Special Forces officer.
Quote of the episode
“There’s a two-step process. First, an ark has to be built, and then you have to get on it.”
— Alex Pruden, CEO of Project Eleven, 36:31
Minute-by-minute episode breakdown
- 00:41: Alex’s path through the Army, Andreessen Horowitz and Aleo.
- 03:20: Why the Willow paper and a delayed mainnet led him to found Project Eleven.
- 06:25: The market’s reaction to Willow and the skeptics who changed their minds.
- 10:14: Why elliptic-curve cryptography became the default, and why it is likely to break first.
- 12:52: The trade-offs among post-quantum signatures and the end of a shared standard.
- 17:59: ML-DSA, hash-based schemes and the cost of stateful signatures.
- 21:55: Falcon, side-channel attacks and the case for lattices.
- 25:11: Trust in NIST, the NSA and national cryptographic standards.
- 28:44: Google’s withheld circuit, ECDSA.fail and AI-assisted cryptanalysis.
- 35:27: Why existing blockchains face a two-step migration.
- 39:56: When Q-Day might arrive, and why nobody may announce it.
- 48:00: Decentralization, institutions and stablecoin admin keys.
- 53:44: What blockchains do that no centralized system can.
Before crypto, Alex Pruden spent about a decade in the U.S. Army. He got into Bitcoin while working in the Middle East around 2015, and went on to invest in crypto at Andreessen Horowitz and then to lead Aleo, a privacy-focused blockchain whose launch slipped from a planned 2022 to late 2024.
That delay taught him how slowly cryptographic systems reach production. He had also noticed a caveat commonly taught in cryptography courses: the asymmetric systems in use today fail against a large quantum computer, a footnote usually dismissed because such machines seemed far away. When Google’s Willow announcement arrived in late 2024, he put the two together. Post-quantum cryptography is complicated and relatively new, and he concluded that people were underestimating how long it would take existing systems to adopt it. He founded Project Eleven that year.
His conversation with Quantus CEO Chris Smith took place shortly before Quantus launched its mainnet. It covers what replaces elliptic curves, what goes wrong between a paper and a deployment, and why the hardest part of the upgrade may be persuading owners to move.
1. Elliptic curves did almost everything, and Alex expects them to break first
Elliptic-curve cryptography became the default for blockchains because one primitive covered almost every need. Alex lists them: signatures and authentication, zero-knowledge proofs, multiparty computation for threshold signing, and pairing-based cryptography, which Ethereum’s proof-of-stake network uses. He calls it “the Swiss Army knife.”
Its efficiency came from small keys. RSA, the older public-key system, needs large keys to reach a given security level. Alex compares 4,096-bit RSA keys with the 256-bit keys of elliptic-curve cryptography.
Alex says those short keys matter in a quantum setting. Researchers long measured their machines against RSA, he says, and the elliptic-curve problem turned out to be easier to attack. That is why, in his words, the concern “got pulled much closer than people had initially realized.” Google Quantum AI’s March 2026 paper estimated that breaking 256-bit elliptic-curve cryptography on its assumed superconducting architecture would take fewer than 500,000 physical qubits. Alex says Project Eleven was among the groups the authors spoke to while preparing it. Quantus’s explainer on what makes a quantum computer cryptographically relevant covers the gap between that estimate and any machine built so far.
2. Every post-quantum option has a cost somewhere
“There is no drop-in replacement for elliptic-curve cryptography,” Alex says at 12:52.
He sorts the trade-offs into three groups. The first is performance: signature size, public-key size, and the speed of signing and verifying. The second is how new a scheme’s security assumptions are. The third is implementation complexity, the distance between a scheme that works in an academic paper and one that holds up in deployment.
Alex says blockchains are already weighing the three differently. He expects the shared foundation blockchains have today to give way to what he calls “a balkanization,” with chains secured by entirely different families of cryptographic assumptions.
Chris would prefer the industry to converge on at least one family. He cites a July 2026 Cloudflare post arguing that ML-DSA will have to do for now. ML-DSA is the lattice-based signature scheme NIST standardized in 2024 as FIPS 204. The post quotes the engineer Eric Rescorla: “You go to war with the algorithms you have, not the ones you wish you had.”
3. A stateful signature makes a counter as critical as the key
Alex does not see the industry settling on ML-DSA yet. By his account, the work he sees around Bitcoin and around Ethereum’s consensus layer is looking at hash-based signatures, and specifically stateful ones.
A stateful hash-based scheme signs safely only if the signer tracks how many signatures a key has already produced.
“Losing track of that number is almost as bad as losing your private key,” he says at 18:57.
Hash-based schemes appeal to cautious designers because their security rests on well-studied assumptions about hash functions. The trade-off is that either the signer manages state, or the scheme drops state and produces much larger signatures.
Chris looks at it from the holder’s side. Most people struggle to back up a seed phrase once, he says, and today that one backup covers every address in a wallet. A scheme that required fresh backups or extra information after every transaction would, in his view, fail on usability alone.
Alex applies the same test to SHRINCS, the Blockstream proposal he calls the leading candidate for Bitcoin. It pairs a compact stateful mode with a larger stateless fallback for when state is lost, for example after a wallet is restored from a seed backup. Alex calls the design elegant, then questions the incentive. He doubts holders will choose the stateful path if it adds any chance of mishandling state. In that case, he argues, the compact signatures go unused while the added complexity remains.
He has watched teams work through the options in a predictable order: an unusual scheme first, then a retreat to conservative hash-based designs, and finally a return to the standard. “You know what? ML-DSA isn’t that bad,” they conclude, as he tells it at 21:49.
4. A secure scheme still has to be implemented safely
Quantus went through part of that sequence itself. Chris says the team first explored Falcon, another NIST-selected lattice signature, until Thomas Pornin, one of Falcon’s authors, asked whether they realized what they were getting into.
That work was the first time Chris read code written to run in constant time. Its arithmetic looked backwards to him until he saw the purpose: the compiled program contains no branches whose timing could reveal a secret. Timing is one kind of side channel, a way of learning a secret by observing how a device behaves while it computes. Others involve its power use or electromagnetic emissions. Alex contrasts an attacker who would have to get inside a data center with an antenna against keys held on end-user devices, which people carry in their pockets.
He also answers a common objection to ML-DSA: that lattice cryptography is too new to trust. Lattices have been studied for cryptographic use for close to three decades, he says, and no hash-based scheme exists for key exchange. When a wallet connects to a node over TLS, the protocol that secures the connection, the key exchange is increasingly lattice-based.
“You’re already onboarding some lattice-based assumptions no matter what you do,” he says at 24:21.
No scheme is guaranteed to last, so Alex returns to a phrase Chris used earlier: crypto agility, the ability to change schemes again without rebuilding the system.
5. Alex expects AI to shorten every algorithm’s working life
Shor’s algorithm is the quantum procedure that would recover a private key from a public key. When Google published its resource estimates, it withheld the circuits that implement the algorithm and released a zero-knowledge proof that the circuits meet the stated costs. Google said it had engaged with the U.S. government before publishing.
ECDSA.fail followed. It is an open challenge, launched by Eigen Labs in late May 2026, to reduce the cost of point addition, one step within Shor’s algorithm on Bitcoin’s curve. The challenge scores a circuit by multiplying the logical qubits it needs by the number of costly gates it runs. According to the project’s paper, more than one hundred participants working with AI coding agents had, by late July, cut that score to more than 50% below Google’s reported figure for the same step. The paper cautions that the two were measured under different conventions. Alex stresses that the challenge addressed a single subroutine. He still treats it as evidence of how quickly cryptanalysis can now move.
“The shelf life, in my view, of any cryptographic algorithm is drastically shortened,” he says at 31:33.
His conclusion is practical. Anyone deploying cryptography in the next decade should expect to migrate away from it a decade later, and should plan for that migration from the start.
Chris connects the same events to policy. On June 22, 2026, a U.S. executive order moved federal post-quantum deadlines for certain high-value systems to 2030 or 2031, ahead of the earlier 2035 target. To Chris, it suggested the government had been surprised by how quickly AI was speeding up quantum research. Alex reads the wider reaction the same way. People used to treat quantum risk as always twenty years away, he says. Governments and companies are now writing plans with dates.
6. Plan for a Q-Day that nobody announces
Chris avoids predicting a date for Q-Day. Technological progress is nonlinear, he says, and the world may not be told when the moment arrives. Alex agrees. A government or lab that built a cryptographically relevant machine would lose its advantage by revealing it, so he expects few public signals as the threshold approaches.
Alex respects skeptics who want stronger experimental evidence. One Bitcoin community member he debated wants to see long-lived logical qubits first. After two decades of false starts, Alex calls that “a very rational position to hold.” His concern is that progress near the threshold will go quiet, followed by a sudden change.
Asked for a date anyway, he refers to the models behind Project Eleven’s 2026 report: an annual expert survey, the hardware companies’ published roadmaps, and the company’s own projections. In the conversation, he puts his own base case at 2032: a cryptographically relevant quantum computer is more likely than not to exist by then, with “a reasonable chance that by 2030 we’re already there.”
He measures those dates against Mosca’s inequality. If the time an asset must stay secure plus the time a migration takes exceeds the time until a capable quantum computer exists, the migration is already late. Six years, Alex argues, leaves little room once design, review and adoption are counted. Google has set 2029 as its own deadline for post-quantum migration, and Chris notes that Cloudflare has the same target. Alex reads Google’s commitment as significant because Google wrote the paper and is paying the engineering cost.
“This uncertainty is ultimately what demands, I think, conservatism,” he says at 46:11. By conservatism he means preparation that starts now, an assumption that progress will come faster than expected, and an acceptance that the next scheme may not be the last.
7. A migration has two steps, and the second belongs to the user
The upgrade problem is sharpest in decentralized blockchains. Bitcoin’s developers can ship a post-quantum signature option, Alex says, but shipping it does not make Bitcoin post-quantum secure. Holders still have to act. He compares it with a phone update, where users restart the device and are on the new version. In the Bitcoin migration he describes, holders would have to move their coins to addresses that use the new signature scheme, and he expects as many ways to make mistakes in that step as in building the new cryptography. Chris adds a Bitcoin-specific constraint: blocks are small, and post-quantum signatures are much larger.
Once a quantum computer can derive private keys, the move itself becomes harder.
“If I can forge your signature from the old address type, what does ownership mean anymore?” Alex asks at 37:27.
Chains that launch with post-quantum signatures skip this first transition. Alex cites Quantus as an example: its signatures are post-quantum by default. (Quantus launched its mainnet on September 9, 2026, after this conversation was recorded.) Chris points to a concentrated risk on existing chains: the admin keys that control stablecoin minting. A quantum attacker who took one could mint vast sums and trade them before any legal rollback. Alex adds that such an attack would suit a nation-state, because it would be close to impossible to attribute.
He also offers a view he expects some in crypto to resist. Purely decentralized systems will find post-quantum migration slower and messier, and the larger signatures cost more as a network decentralizes. Institutions run by fiduciaries will expect reliable maintenance, and he doubts that chains abandoned by their founders will ever migrate. He expects the industry to become somewhat more centralized and more professional as a result, and argues that the task is to protect what remains distinct about blockchains.
“The one thing that blockchains enable that no centralized system could replicate is interaction between mutually distrusting parties,” he says at 53:49.
A post-quantum migration has to keep that property while asking owners to act.
Related resources
- The Quantum Threat to Blockchains 2026 Report: Project Eleven’s model for estimating Q-Day, with baseline, optimistic and pessimistic scenarios.
- Google Quantum AI’s cryptocurrency research: Resource estimates for quantum attacks on elliptic-curve cryptocurrencies, and proposed mitigations.
- ML-DSA will have to do: Cloudflare’s case for deploying ML-DSA now.
- SHRINCS: The stateful hash-based signature design Alex discusses for Bitcoin.
- What Is Q-Day?: How quantum capability, exposure and migration affect crypto security.
- Q-Day, Quantum, and the Impact on Bitcoin with Colton Dillion: The previous Conversations episode, on Bitcoin’s migration problem.
