$12.6B into quantum startups in 2025 📈 $420M, the entire post-quantum security market that year Different measures. Not a like-for-like comparison. But put them side by side and the shape of this transition is obvious. Enormous capital building the capability. A fraction of it replacing the cryptography that capability breaks. And the replacement is the harder job. Before anyone swaps an algorithm they have to find where the vulnerable cryptography actually lives. Inside vendor software. Inside hardware modules. Inside devices in the field. Inside protocols nobody has opened in fifteen years. That discovery phase alone runs for years. None of it is the cost of the algorithms. Those were published in 2024 and they're free.

"Post-quantum cryptography is too slow for blockchains" 📏 It's the most repeated objection in the space and it's measurably wrong. SPEED ML-DSA-87 verification: ~38.5 microseconds Roughly 26,000 per second, per core Not a problem SIZE ML-DSA-87 signature: ~4,600 bytes ECDSA signature: 65 Public key: 2,592 bytes vs 33 Roughly seventy times the data, on every transaction. And size is a completely different problem. Fewer transactions per block. Faster state growth. More bandwidth to propagate. More storage on archive nodes. None of that gets solved by faster chips. It gets solved by protocol design, which is why we measure it daily at @NaoXprotocol. Verification isn't the constraint. The bytes are.

What actually breaks in a bank when public-key cryptography does ⏳ 01 Payment authentication 02 Interbank communications 03 Digital certificates 04 Customer identity 05 Transaction signing 06 Custody infrastructure 07 Records that stay confidential for thirty years Most of it still runs on RSA and elliptic curve cryptography. And none of it can be switched off for an upgrade. NIST finalised the replacements in 2024. The algorithms exist. What's missing is integration, across systems that can't afford to fail, with every vendor on its own timetable. New in @Forbes Technology Council 👇 forbes.com/councils/forbeste…

AI × QUANTUM. The convergence is accelerating, and the implications for cryptography are becoming impossible to ignore. There's been a lot of discussion lately about the extraordinary potential of AI and quantum computing. But beyond the scientific breakthroughs, something equally important is happening: ⚡ AI is beginning to accelerate both the development of quantum computers and the discovery of weaknesses in the cryptography designed to protect us. The evidence is already emerging: • @GoogleDeepMind has helped advance quantum error correction through reinforcement learning, while @IBMResearch used AI to discover 465 candidate quantum error-correction codes. • @AnthropicAI demonstrated AI-assisted cryptanalysis against HAWK, a lattice-based post-quantum signature candidate. The findings were significant enough that HAWK was withdrawn from @NIST's standardisation process. An important distinction: HAWK was not a deployed standard. NIST's finalised ML-DSA and ML-KEM algorithms were not broken. But consider the wider implications. AI is helping researchers overcome engineering barriers to more powerful quantum computers, while also accelerating the mathematical research that tests our cryptographic assumptions. The security implications extend far beyond classical RSA and elliptic curve cryptography. Even post-quantum algorithms must withstand continuous scrutiny as AI-driven cryptanalysis advances. This is precisely why we built @NaoXprotocol with NIST-standardised, lattice-based post-quantum signatures (ML-DSA-87) from inception, rather than waiting for quantum computing to reach the point of breaking existing systems. The next generation of computing promises extraordinary scientific progress. I'm incredibly optimistic about what it will unlock. But advances in computational power must be matched by advances in the infrastructure protecting our digital world. The quantum era won't wait for the security industry to catch up.

Interesting take from @a16zcrypto. The debate around hash-based vs lattice-based cryptography goes beyond quantum resistance. It's about standardisation, performance, interoperability, and whether these systems can operate securely at scale. @NIST has standardised both approaches, but custom cryptographic constructions introduce additional complexity, particularly around hardware wallets, HSMs and institutional custody. At @NaoXprotocol, we chose lattice-based cryptography from inception: • ML-DSA-87 (FIPS 204) → NIST Level 5 post-quantum digital signatures • ML-KEM-768 (FIPS 203) → Post-quantum key establishment between network nodes • Native EVM precompile → High-performance signature verification without the overhead of traditional EVM bytecode execution But the broader point is critical. Quantum-resistant signatures alone don't make an entire blockchain quantum-resistant. Consensus mechanisms, key management, validator integrity and infrastructure dependencies must all be considered. The mathematics provides the foundation. The security of the entire architecture is what ultimately matters. xitter.cf/a16zcrypto/status/2111…