The Quantum-Safe Promise With No Migration, No New Address, and No Math

The press release arrived on a Tuesday, in the middle of a sideways market hungry for anything that resembles a story. AmericanFortress, a name I had never encountered, announced a quantum-safe encryption scheme for Bitcoin, Ethereum, and Solana wallets. The headline promises were immaculate: no migration, no address changes, no action required from the user. Just protection, delivered like a software patch for a problem cryptography has wrestled with for decades. The numbers were clean. The mathematics was absent. I have spent twenty-seven years in this industry, and I have learned that when a project claims to have squared a circle, the first document to appear is rarely the one that matters. It is the press release. In 2017, while auditing quadratic voting prototypes at Gitcoin, I watched teams claim democratic fairness in code that could not even prevent one wallet from buying a thousand votes. In 2021, I spent two weeks fighting an NFT marketplace over a royalty mechanism that would have quietly gutted the exact creators it claimed to protect. The pattern repeats: the smoother the promise, the sharper the edge hidden underneath. This claim is smooth. So let us examine what quantum-safe actually demands, because the gap between the marketing and the math is enormous. Shor's algorithm, running on a sufficiently large fault-tolerant quantum computer, breaks the elliptic curve digital signature algorithm that underpins Bitcoin's secp256k1, Ethereum's account model, and Solana's Ed25519-based systems. If a machine capable of running Shor at scale emerges, anyone who can see your public key can derive your private key. Understand what this means in practice. It is not that your coins will be stolen the moment a quantum chip exists. It is that an adversary can record every public key and transaction today, store it, and wait. The term of art is harvest now, decrypt later. The data we broadcast today becomes the vulnerability we eat tomorrow. This makes the timeline less dramatic but far more insidious. The NIST post-quantum standardization process responded to this threat by selecting candidates: CRYSTALS-Dilithium, Falcon, and SPHINCS+. These are radically different from today's schemes. Dilithium public keys are roughly 1,300 bytes, compared to 33 bytes for a compressed secp256k1 public key. Their signatures are larger, slower, and built on entirely different hard problems. SPHINCS+, by contrast, is hash-based and stateless but produces signatures over ten times the size of Dilithium's, a non-starter for chain bloat unless block design changes. None of these standards were designed to fit into the narrow address formats of existing blockchains. Here is the inconvenient fact: a wallet address is not decorative. A Bitcoin address is a hash of a public key. An Ethereum address is the last twenty bytes of the keccak256 hash of a public key. A Solana address is derived from a different curve and key format entirely. The address is a commitment to a specific key schedule. If you change the underlying public key algorithm, the address changes. There is no known construction that preserves an identical address while switching from secp256k1 or Ed25519 to Dilithium, Falcon, or SPHINCS+, because the address is not a label. It is a fingerprint of the exact key structure that will authorize a transaction. So when AmericanFortress claims to protect existing wallets without changing addresses, they are either in possession of a cryptographic breakthrough no peer-reviewed group has achieved, or they are describing something that is not what it appears to be. What could it actually be? One plausible path is multi-party computation. You could split a private key across a distributed network of nodes, such that no single shard is sufficient to sign, and introduce additional quantum-resistant shards over time. This preserves the original address in a sense, but it is not the same wallet. It is a custody layer, a vault, a contract with its own rules, its own trust assumptions, and its own failure modes. The moment funds move into that layer, the user has migrated, whether they know it or not. The address may still look identical, but the thing protecting it is no longer the cryptography the user started with. It is a federation of shards and code that must be audited, upgraded, and trusted indefinitely. Another path is a hybrid signature scheme, where a post-quantum signature is appended to a classical one, and verification logic is upgraded through a protocol fork. This is real research territory, and several groups have proposed migration strategies that preserve old addresses by layering new keys on top of them. But notice the phrase protocol fork. That requires consensus. It requires every node, every validator, every exchange to adopt new verification rules. And it requires a spending transaction to activate the new layer, because a key can only be rotated when the user produces a signature with the old one. You cannot rotate a key that has never been used without a trusted setup, a sweep, or an action by the network. None of these qualifies as no action required. And then there is the path that worries me most: a trusted component. Perhaps AmericanFortress intends to secure wallets through a service, an API, a hardware security module, a cloud enclave, that sits between the user and the chain, substituting the user's key for a quantum-resistant one behind the scenes. That would technically allow the user to keep their address. It would also mean the user's funds are no longer controlled by a private key at all. They are controlled by an account with AmericanFortress. When I consult on policy work, I am always struck by how easily the word protection becomes the word custody when the math gets hard. I spent part of 2025 translating these exact concepts into briefs for the ETF regulatory conversation, and the lesson I carried out of that room was simple: if a user cannot verify the mechanism, the mechanism is not theirs. Now let us think about what a genuine quantum threat actually endangers, because the framing in this announcement is wrong in a way that is itself informative. The most exposed assets in the ecosystem are not the average wallet sitting untouched in a hardware device. They are the coins at pay-to-public-key addresses from Bitcoin's earliest days, where the public key is visible directly on the chain. They are the outputs at reused addresses, where a holder has already spent once and exposed their public key to network observers. They are legacy multisig structures, brain-wallet stashes, and any funds whose key material has ever touched a networked device. A scheme promising blanket protection for wallets fails to distinguish between an unspent output whose key has never been revealed, still relatively safe due to the preimage resistance of hashing, and an exposed key, which is vulnerable today in every sense that matters. That distinction matters because it reveals something about the threat model. Quantum resistance is not a wallet feature. It is a protocol property. It lives in the consensus rules that determine which signatures are valid, in the address formats that commit to key schedules, in the standards that govern how a wallet derives and stores secrets. No overlay can fix a consensus-level vulnerability without touching the consensus. And the moment you touch the consensus, you are no longer talking about a product. You are talking about a political process. I keep returning to a phrase I developed during the Terra collapse, after watching a market's certainty dissolve into nothing over a weekend: pretend certainty is the most expensive asset in crypto. During that period, I retreated from public speaking and spent months re-reading the foundational papers I had built my career on. What I found was that every break in the industry's trust chain, Terra, FTX, every vault that turned out to be a yield farm in a trench coat, was preceded by a narrative that made complexity disappear. The projects that survived were the ones that admitted the complexity was still there. From my years in the DeFi summer trenches, when I refused to deploy liquidity mining incentives that rewarded speculation over utility and endured boardroom fights where my soft concerns were dismissed as naive, I learned that the industry's default response to a hard problem is to mint a narrative. In this sideways market, where real yield is scarce and attention is the only currency that still inflates, the narrative of the week is quantum safety. Over the past seven days, I have watched a protocol lose forty percent of its liquidity providers in a single week. In this kind of chop, teams do not fight for fundamentals; they fight for attention. Quantum safety is a perfect attention product: it is global, it is terrifying, and it cannot be disproven by anyone without a doctorate. And that is precisely the problem. A claim that cannot be falsified by its audience is not a claim. It is a prayer. So let me ask the uncomfortable questions, because someone has to. Where is the white paper? Where is the code repository? Where is the proof of the mathematical construction that preserves an address commitment while replacing the signature algorithm? Where are the names of the cryptographers who reviewed this work? Where is the audit from Trail of Bits, Quantstamp, or any firm with a reputation worth protecting? The announcement contains none of these. That alone places this project in the highest risk category I know, alongside the anonymous teams and pre-seed concepts that populate this industry's graveyard. They are not called pre-seed because they are early. They are called pre-seed because nothing has grown yet. The uncomfortable counterpoint is that I want to be wrong. I want someone to solve the problem of non-disruptive key rotation. I want a world where users do not need to migrate, where the terror of a quantum-relevant machine in some military program does not require every holder to re-key their assets with shaking hands. There is legitimate research in forward secrecy, ephemeral keys, and hierarchical deterministic schemes that could layer post-quantum material over existing pipelines. Real cryptographers are working on this right now. If AmericanFortress is contributing to that work, I will read their documentation the day it appears, with genuine openness. But there is a difference between provoking an important question and pretending the question has already been answered. This announcement provokes a useful question: what would a truly non-disruptive migration require? The answer is coordination, consensus, protocol upgrades, and years of careful engineering. It then does something harmful. It tells users that none of this is necessary, that someone else has handled it, that complacency is safe. That is not a service. It is a disservice dressed as one. Here is my contrarian view, stated plainly: the biggest obstacle to quantum readiness is not the absence of clever schemes. It is the belief that clever schemes can replace coordination. Bitcoin will not become quantum-safe through a press release. It will become quantum-safe through an agonizing, multi-year, community-wide process of proposing a migration path, arguing about it, testing it, forking it, and finally adopting it, or it will not become quantum-safe at all. The same is true for Ethereum and Solana. The cryptography is the easy part. The human part is the hard part, and no encryption scheme can solve that. In my policy work ahead of the ETF approvals, I learned that regulators respond to transparency and cringe at certainty without evidence. False certainty is not just a technical sin. It conditions users, and institutions, to ignore the real timeline of quantum risk. When a genuinely viable upgrade proposal appears, we will need everyone to pay attention. If the community has already been burned by a dozen quantum-safe press releases with no math behind them, the signals become noise, and the real alarm goes unheard. I am not saying AmericanFortress is a fraud. I am saying the burden of proof is enormous, and they have not met it. I am saying that no migration, no address change, no action required is the most seductive sentence in the history of cryptography, and a sentence that seductive demands mathematics of equal weight. So far, the mathematics has not shown up. The signals to watch are specific. A white paper with actual constructions. A public code repository with tests. A submission to the IACR ePrint archive or an accepted paper at a real conference. An audit by a firm that has something to lose. A conversation initiated by Bitcoin or Ethereum core developers, not by a marketing department. If any of these appear, I will revise my view. I hold that door open deliberately, because the industry needs more people trying to solve this problem, and I would rather be humbled than bitter. Until then, the interest chart will spike for a day, maybe two, and the users will remain exactly where they were before the announcement. The graph spikes; the soul stays quiet. I have learned never to confuse the two. The real quantum transition, when it comes, will not arrive with a promise that you do nothing. It will arrive with a proposal that asks you to do something hard, then another, then another. The ecosystem that survives quantum computing will be the one that learned to coordinate, to migrate, and to abandon comfort for safety. Anyone who tells you otherwise is selling certainty. And in this industry, certainty without proof has always been the most expensive asset of all.