The privacy cabal has gone all in on quantum
文章目录
I started digging into this properly when it was around $20. Since then, the price has risen to $60 as I write this, so the numbers below are today's.
We've seen this before
This time last year Zcash was a $50 coin that most of crypto had written off. Then Naval posted that it was insurance against Bitcoin, and within a fortnight Balaji and Mert had backed him in public, Arjun Khemani had basically turned his account into a Zcash account, and NEAR was running billions of it through Intents. It's $1,500 today.
Twelve months on, the same people have turned up on the cap table of a proof-of-work chain that went live three weeks ago. NEAR announced it before it could even be traded, Zcash is sponsoring its conference in Singapore on 8 October, and Zooko is speaking there. History doesn't always repeat itself, but it rhymes. This looks like the same playbook.
What Quantus is
Quantus is a proof-of-work chain that went live on 9 September 2026 with Bitcoin's monetary policy and different cryptography. There are 21 million coins, the block reward shrinks as supply grows (it's set at 21,000,000 minus current supply, divided by 50 million, which is about 0.31 QTC every 12 seconds right now), and the signatures are ML-DSA, the lattice-based scheme NIST finalised as FIPS 204 in August 2024. It also has private addresses, called wormhole addresses, which work like shielded Zcash.
Lattice signatures matter because Bitcoin's keys rest on elliptic curve maths, which a big enough quantum computer solves with Shor's algorithm, so anyone with one can work out your private key from your public key. There's no known quantum shortcut for lattice problems, which is why NIST picked them and why the US government is ordering its own agencies onto them. The catch is size, an ML-DSA signature is a few kilobytes against Bitcoin's 64 bytes, which is fine if you design a chain around it from the start and a proper fight over block space if you're trying to bolt it onto one.
The team is small. Christopher Smith, who posts as @YuviLightman, has about 1,200 commits in the chain repo and wrote the HD wallet scheme for lattice keys the wallets use. Nikolaus Heger, ex-Apple, wrote the wallet app and the NEAR swap client. Twenty-seven percent of the supply was minted at genesis to investors, founders, team and company, and the vesting code locks it for a year and then releases it over three.
Who's behind it
Quantus raised $2.42 million in two rounds, $1.65 million at a $40 million valuation and then $770,000 at $100 million led by Balaji, according to the launch page that was live until 1 September and is still in the website repo. The investors file names Balaji, Babak Nivi (Naval's AngelList co-founder) and Mert. The advisors file names Arjun Khemani, Tom Howard, and Raghav Gulati, who ran CoinList until last year and now invests at Ravikant Capital. On launch night Raghav called it "the most legit team competing for the hardest prize in crypto, a better store of value". $2.42 million sounds small until you realise it means nobody on that list is sitting on a nine-figure position they need to dump on you.
Naval himself hasn't said anything about it. He reposted a Quantus post once, on 16 June, and deleted the repost later, and that's the whole of his public record on it. His fund is in, his co-founder is in, and the people who were loudest on Zcash are in, which is about as close as you get to Naval being in without Naval saying so.
Quantus is hosting QDay in Singapore during Token2049 week. Zcash, Quip, Vizor, Keystone and Project Eleven are sponsoring, and the speaker cards it has posted so far include Balaji, Zooko, Illia, Sebastien Guillemot from Midnight, Haseeb from Dragonfly, Hunter Horsley from Bitwise, Bankless and The Rollup. The State of Quantum report that goes with it was co-written by people from Quip, Gnosis Guild, Midnight, Keystone and The Quantum Insider, which for a chain that's three weeks old is a lot of the post-quantum industry deciding to support it.
The NEAR pipeline
Right now you can only buy QTC on SafeTrade, which did about half a million dollars of volume today and a fifth of that a week ago. That changes when it goes live on NEAR Intents, and the groundwork for that is already in the code. The genesis config has a 42,000 QTC grant to an "intents" address vesting from day one. The docs repo has a NEAR integration deep-dive dated 11 September. NEAR's own account announced it on 17 September and Illia followed the next day, which is the first time NEAR has announced an asset before it was tradeable. The mobile app already has a swap client behind a feature flag, and its own docs say the only thing left is "a conversation with the NEAR Intents team, not a code change here".
On 22 September Nikolaus Heger, who wrote it, pushed a commit updating the demo's placeholder prices, and three days later the treasury's 1% liquidity tranche, 210,000 QTC, finished its 16-day vest and is sitting in a wallet waiting for a solver.
Intents crossed $30 billion in all-time volume this month, did $300 million in a single day on 18 September, put $2 billion of Zcash through in a few months, and just got picked as the swap engine for Brave's wallet. It's where Zcash's retail flow already lives, and it's the same crowd.
Float, FDV and what it costs to mine one
The pushback I hear most is FDV. At $60 the fully diluted value is $1.26 billion, and for a lot of people that's the number. I think it's the wrong number for a proof-of-work coin. Here's the supply as it stands on 28 September:
73% of the coins don't exist and won't for a very long time, 26% are locked by code until September 2027, and the float that's actually tradeable is about 39,000 coins, or $2.3 million circulating marketcap at $60. Bitcoin at a dollar had a $21 million FDV and nobody quoted it; Kaspa was never priced on the coins it hadn't mined either. FDV tells you what the market thinks a coin is worth once it's fully out, and for a chain three weeks in that's not a question anyone can answer. What sets the price this month is the tradeable float, and it's tiny.
Cost of production is the other half. The network is running at 10.4 TH/s, down from 23 at launch, minting about 2,230 QTC a day. An RTX 5090 does 1.3 GH/s at 500 watts, which works out at about a quarter of a coin a day. At residential power that's $2 to $7 of electricity per coin, or about $15 all in if you're paying the card off over two years. Renting the same card on a cloud service costs $35 to $45 per coin, which is why the rented hashrate left when the price was $20 and the people who kept mining were the ones with cheap power. At $60 renting is back in the money, so I expect the hashrate to climb from here. The Kryptex pool alone has 2,900 miners on it and now offers to pay miners in USDT instead of QTC.
The quantum case
Quantum computers are bad at hash functions, which Adam Back keeps having to point out, so mining is fine and the problem is the signature. Your public key is hidden until you spend, and once it's onchain a big enough machine can derive the private key from it with Shor's algorithm. Glassnode counts 6.04 million BTC sitting in addresses that have already exposed their key, about 30% of supply, including up to 1.1 million that are Satoshi's and can never be moved to safety because nobody has the keys.
Nobody can break a 256-bit key today; the largest public break is 15 bits. What's moving is the estimate of what it takes. In 2019 the figure for RSA was 20 million physical qubits; in May 2025 Google's Craig Gidney cut that to under a million; in March 2026 Google's quantum team put Bitcoin's curve at under 1,200 logical qubits and fewer than 500,000 physical ones, and gave itself until 2029 to migrate its own systems. IonQ's roadmap says 800 logical qubits next year. NIST's draft deprecates elliptic curve signatures after 2030, the White House gave federal systems until 2031 in June, and Coinbase's chief cryptographer said last week custody will support whatever scheme Bitcoin picks. None of that means the machine arrives next year, it means the people who are paid to plan for it have started planning.
Bitcoin's fix has two halves and only one is code. The first is a new address type, BIP-360, first posted in June 2024, still a draft, and only able to protect coins that move to it. The second is what to do with the six million that never move, and that's where it stops being engineering. CZ said in March that if Satoshi's coins don't move "it might be better to lock (or effectively burn) those addresses so that they don't go to the first hacker who cracks it", and a large part of Bitcoin called that confiscation. Saylor's version is that lost coins stay frozen and supply comes down, which makes the same freeze a bull case. Jameson Lopp, who co-wrote the BIP-361 roadmap that would void old signatures five years after activation, says it's "far more nuanced than just 'freeze or don't freeze'" and is really about which property rights get violated. Chaincode worked out that moving every coin at full blockspace would take 76 to 142 days, and nobody gets full blockspace.
When everyone agrees, Bitcoin moves in hours, the 2010 overflow bug was patched in five hours, and when they don't it takes years. Every change that needed an actual decision has taken years.
Taproot is the best case, a feature nobody objected to, and it still took nearly two years. The block size war is the honest comparison, because it was a fight over what Bitcoin is for and it ended with the losing side leaving. A relay policy tweak shipped in six months last year and still spawned a failed fork. A change that decides whether six million coins get frozen is going to take a lot longer than a relay policy did.
It doesn't need to replace Bitcoin
Naval's line is the frame for this, so here it is again: "Bitcoin is insurance against fiat. ZCash is insurance against Bitcoin."
Zcash never replaced Bitcoin and nobody serious thought it would. It became the thing you hold against the one property Bitcoin can't add, which is privacy, and that was enough for a $25 billion market. I'm extending his frame here: Zcash was sold as insurance against Bitcoin's transparency, and Quantus is being sold as insurance against Bitcoin's quantum exposure.
The objection I hear most goes like this:
"why would anyone want a quantum-resistant chain other than Bitcoin, because if quantum breaks Bitcoin the whole of crypto goes to zero, and when Bitcoin adds quantum-safe signatures, why hold Quantus at all".
Neither half holds up. If a quantum computer ever breaks Bitcoin then yes, everything goes to zero that day, but nobody is pricing that day. What gets priced is the years leading up to it, while people argue about whether it's coming and what to do about it, and that's the window Quantus is trading in. Zcash didn't need Bitcoin to lose anything to go up 30x, it needed people to want the hedge.
The second half assumes that once Bitcoin adds new signatures the problem is solved. It isn't, because new signatures only protect coins that move to them. The six million exposed coins stay exposed until the network decides what to do with them, and the network has been arguing about that for eighteen months. The two things that got Bitcoiners excited recently, StarkWare's quantum-safe vault and the post-quantum Lightning work, have the same limit. They protect coins going forward. They do nothing for the coins already sitting in the open.
I'll be straight about one thing. The team does describe Quantus as a better store of value, and that echos what Raghav said at launch. Whether it ever competes for that is a 2030s question, and the only one that matters for the trade is whether people bid the hedge while Bitcoin is still arguing with itself, which is a this-quarter question. Bitcoin and Zcash have coexisted for nine years on exactly this logic, and the people who wrote cheques for Quantus are the people who made that logic pay.
This is a trade
To be clear, I'm not calling Quantus the next Bitcoin, and I'm not saying it's a better store of value than Bitcoin. That's a different argument and I'm not making it.
Quantum is a real threat and this is a chain built for it. The people who got the Zcash trade right are on the cap table. NEAR has announced a listing that isn't live yet, and in ten days the whole industry will be in one room in Singapore. The circulating market cap is about $2 million, and when NEAR switches the listing on, that $2 million meets a pipe that did $300 million of volume in a single day this month.
I don't know where Quantus will be a year from now, and for this trade I don't need to. Everything that matters is still ahead of it and I think it's one of the best setups in the market right now.
