QuanChain

The Security Level Is In The Path. On QuanChain the security level is part of the wallet's derivation path. Wallets follow an extension of BIP-44: m / 4400' / 8421' / account' / security_level' / index. The level is one of the components, and it sets the default level for the wallet's children. That path produces the seed material, which is expanded to 64 KB for the parent's entropy pool. Child keys are then derived with HKDF-SHA256, with the path, the security level and the purpose included in its info field. The result is that keys for different security levels are cryptographically independent, even when they come from the same seed. One seed. Independent keys at every level.

It Started With A Fake Job Interview. Binance has published its incident report on the $6.3 billion theft, and it began with a fake job interview. In September, a software engineer was approached on a legitimate job-hunting platform by someone posing as a project director at a fictitious company. A fake HR representative then held a live video call, and a second interview ended with a coding assignment. Running that code installed custom malware that Binance says its endpoint security tools did not detect. By October 20, the attackers had used that machine and an internal AI tool to compromise two more employees working on the wallet infrastructure, obtaining credentials and a container deployment token. On October 29 they used those credentials to deploy a malicious script and reach the wallet signing service. As of November 3, about $2.85 billion of the stolen assets had been frozen or intercepted. The FBI has attributed the theft to North Korea's TraderTraitor group. Notice what was attacked. Not an algorithm. A person, then a laptop, then a token. Quantum resistance does not fix that, and nobody should claim it does. It protects a different layer: the keys and signatures themselves, against a computer that does not exist yet. Both layers need to hold.

Seventeen Transaction Types. Three Channels. QuanChain defines seventeen transaction types, spread across its three channels. ⚛️Channel 1 carries thirteen. Wallets: Transfer, WalletRegistration, SpendAndRotate (the default for every wallet send), ReturnToParent for consolidation, RecoveryTransaction for emergency recovery with the parent key, and Migration, which is now superseded by SpendAndRotate with a level change. The network: Stake, Unstake, Delegate, Undelegate, GovernanceVote, GovernanceProposal, and AnchorSubmit for validators only. ⚛️Channel 2 carries ContractDeploy and ContractCall. ⚛️Channel 3 carries DataStore and DataPin. Pinning prevents garbage collection. Unstaking and undelegating start a 14 day unbonding period. Seventeen is a long list. The default is one.

Every Block Records The Quantum Threat. Every QuanChain block header carries the same fields on all three channels. ⚛️ Link. A Blake3 parent hash chains each block to the last. ⚛️ Prove. A Merkle root of the transactions, and a state root. ⚛️ Sign. The validator's security level, and a signature sized to that level. ⚛️ Record. The oracle's current quantum threat level. Each channel adds its own extensions to the common header. The threat level is not something you look up elsewhere. It is written into the permanent record of every block.

Foxconn Wants To Build The Quantum Computers. Foxconn's chairman, Young Liu, told CNBC the company wants to become the world's largest quantum computer manufacturer, without owning the underlying technology. The plan is to build machines for the companies that develop it. Liu said they are at least two years from being commercially viable, and that quantum computers would not replace CPUs and GPUs but would sit alongside them in hybrid workflows. Component costs are substantial even before a complete machine is assembled. My read, not Foxconn's: when the world's largest contract manufacturer starts planning for quantum production, the hardware race is moving from labs toward manufacturing. Nobody knows how fast that changes the cost of an attack. That is why QuanChain's oracle tracks the cost per logical qubit-hour, and why wallets upgrade at their next spend as it moves. The cost of a quantum computer is not a constant. The security design should not assume it is.

Seventeen Transaction Types. Three Channels. QuanChain defines seventeen transaction types, spread across its three channels. ⚛️ Channel 1 carries thirteen. Wallets: Transfer, WalletRegistration, SpendAndRotate (the default for every wallet send), ReturnToParent for consolidation, RecoveryTransaction for emergency recovery with the parent key, and Migration, which is now superseded by SpendAndRotate with a level change. The network: Stake, Unstake, Delegate, Undelegate, GovernanceVote, GovernanceProposal, and AnchorSubmit for validators only. ⚛️ Channel 2 carries ContractDeploy and ContractCall. ⚛️ Channel 3 carries DataStore and DataPin. Pinning prevents garbage collection. Unstaking and undelegating start a 14 day unbonding period. 17 is a long list. The default is one.

Every Transaction Passes These Checks. Every QuanChain transaction carries a security_level field, and every validator enforces the same checks. Signature. It must match the declared security level and the expected size for that level. Both parts of a hybrid or composite signature must verify independently. Level. It must be between 1 and 20. Reserved levels 16 to 19 are rejected until governance activates them. Level 20 is accepted only for wallet registration and recovery. Rotation. A SpendAndRotate must include a valid Merkle derivation proof for the new child, and a forwarding rule that points from the current active child to the new one. Migration to a higher level is handled through the same SpendAndRotate path, with no special migration transaction needed for routine upgrades. The rules are short. That is the point.

FBI: North Korea Took 6.3 Billion From Binance. On October 29, about $6.3 billion left Binance wallets across ten blockchains, most of it in about 20 minutes. It is the largest crypto theft on record. TRM Labs and Chainalysis pointed to North Korea's TraderTraitor group. On October 31 the FBI said North Korea was responsible and that the attackers laundered the proceeds by converting them into Ethereum. Binance says it has covered up to 90% of affected assets from its own funds, which is not the same as recovering them. Roughly $2.5 to $3 billion has been frozen so far, depending on who is counting. The cause is still unclear. Binance has not published a root cause, and it has said an early finding may involve a compromised engineer's laptop. TRM's assessment points to the hot wallet signing infrastructure. This was not a quantum attack, and nothing about it would have been different with a post-quantum signature. A compromised signing path signs whatever it is told to, with any algorithm. That is the point worth holding onto. Quantum resistance is one layer. It does not replace operational security & operational security does not replace it. Today's biggest losses are classical. Tomorrow's risk is the exposed public key. QuanChain is built for the second problem & takes the first one seriously too.

Stake Without Running A Validator. Not everyone wants to run a validator. On QuanChain, they don't have to. Delegate. Any holder can delegate stake to a validator of their choice, starting from 100 QCH. Share. Delegators share in both the rewards and the slashing of their chosen validator, proportional to their delegation amount minus the validator's commission. Commission. Validators can charge between 0% and 20%. Unbond. Unbonding takes 14 days. Each validator can have up to 10,000 delegators. You earn with the validator, and you are slashed with the validator. Choose accordingly.

Four Steps From Threat To Upgrade. What actually happens on QuanChain when the quantum threat level rises? Detect. The oracle's LQCp/h reading crosses a threshold and sets a new threat level. Attest. The oracle publishes the level to validators over gossip, and at least two thirds of validators must attest to the change. Boundary. At the next epoch boundary, the new minimum security level takes effect. Upgrade. Wallets below the new minimum are upgraded automatically at their next SpendAndRotate. After one full epoch of grace, transactions from wallets still below the minimum are rejected. The minimum rises by validator attestation, not by decree.

NIST Finalizes The Migration Roadmap. NIST has released its final post-quantum migration report, NISTIR 8547, "Transition to Post-Quantum Cryptography Standards," on October 27. It supports the dates already set by Executive Order 14412: key establishment migrated by 2030 and digital signatures by 2031 for federal high-value and high-impact systems. National Security Memorandum 10 keeps the broader federal target at 2035. The advice is practical. Look across the whole cryptographic supply chain, not just your own systems. Hybrid approaches that combine conventional and post-quantum cryptography are accepted. And data that has to stay secure for a long time comes first, because of harvest now, decrypt later. The report also describes how quantum-vulnerable algorithms in NIST's existing standards may be disallowed in federal systems after a certain date. Every one of these steps assumes an organization that can inventory what it has and move on a schedule. That is what the audits earlier this month showed is hard. QuanChain's design takes a different approach: value at rest sits behind an address hash, and wallets upgrade to stronger security levels at their next spend. The standard is now final. The question is who can actually follow it.

Every Transaction Passes These Checks. Every QuanChain transaction carries a security_level field, and every validator enforces the same checks. ⚛️ Signature. It must match the declared security level and the expected size for that level. Both parts of a hybrid or composite signature must verify independently. ⚛️ Level. It must be between 1 and 20. Reserved levels 16 to 19 are rejected until governance activates them. Level 20 is accepted only for wallet registration and recovery. ⚛️ Rotation. A SpendAndRotate must include a valid Merkle derivation proof for the new child, and a forwarding rule that points from the current active child to the new one. ⚛️ Migration to a higher level is handled through the same SpendAndRotate path, with no special migration transaction needed for routine upgrades. The rules are short. That is the point.

30,000 Qubits Could Derive A Bitcoin Key In An Hour. Researchers at Paris-based Alice & Bob estimate that about 30,000 physical qubits could derive a Bitcoin private key from its public key in just over an hour, using Shor's algorithm on their cat-qubit hardware. Google's March estimate was under 500,000 qubits, so this is roughly 17 times lower. The two studies use different hardware assumptions. The caveats matter. No machine like this exists, and coverage expects fault-tolerant hardware at this scale to be several years away. The figures are the researchers' own, reported secondhand & the report does not detail assumptions like error rates. The researchers urge Bitcoin developers to start the move to quantum-resistant security now. Notice what every one of these attacks needs first: the public key. Roughly 6 to 7 million BTC, about 30% of supply, sits where it is already visible. On QuanChain, value at rest sits behind an address hash, not a public key. The key is revealed only at the moment of spending, and by then the funds have already moved to the next child wallet. The qubit estimates keep falling. The design question is whether anything is left to attack.

200 Bytes Becomes 60. Same Transaction. Post-quantum signatures are big. So the rest of the transaction has to be small. QuanChain's marker system shrinks a standard transaction from about 200 bytes to about 60, roughly 70% smaller. Senders. When the same sender appears again in a block, only the first occurrence carries the full address. Later ones use a 2 byte block reference or a 4 byte cache reference. Recipients. Common recipients like exchanges and popular contracts use a 1 byte index into a shared dictionary. A full address is only needed when the recipient is new and uncommon. Amounts. Common amounts, like 0.1, 1, 10, 100 and 1000 QCH, get a 1 byte code. Other amounts use variable-length encoding. Without compression, a Dilithium3 transaction would be around 3,500 bytes against about 200 for a classical one. The marker system is part of how larger signatures stay practical.

Store It Once. Find It By Its Hash. Channel 3 is QuanChain's permanent data layer, and it works by content, not by location. Data is split into 256 KB chunks. Each chunk is hashed with Blake3 to produce its content ID. Chunks are stored on the filesystem, and the indexes live in RocksDB. Same content, same hash, so duplicate data is deduplicated automatically and stored once. References are counted. Data that is unpinned and has no references is eligible for garbage collection. Pinning keeps the data you need. The hash is the address. If the bytes change, the ID changes.

Four Attacks. Four Defenses. Every public network gets attacked in four predictable ways. QuanChain has a defense built for each. ⚛️ Sybil. A minimum stake keeps fake identities expensive, and logarithmic stake scoring reduces the benefit of splitting stake across many validators. ⚛️ Eclipse. Kademlia discovery and GossipSub spread the network's surface, and the multi-topic structure means an attacker has to eclipse every relevant topic at the same time. ⚛️ DoS. Gas metering on Channel 2 stops computational attacks, minimum fees on every channel stop transaction spam, and rate limiting on the P2P layer stops connection flooding. ⚛️ Turbine. Blocks are split with Reed-Solomon erasure coding, 32 data shreds plus 32 recovery shreds, so an attacker has to suppress more than half of them to stop a block from being rebuilt. The tree is reshuffled every epoch to stop targeted attacks. Each attack meets a defense built for it.

Ask The Chain About The Threat. Quantum risk is usually a headline. On QuanChain it is a number you can query. Every node exposes the oracle over JSON-RPC. ⚛️ oracle_getQuantumThreatLevel returns the current threat level, from 0 to 6. oracle_getLQCpH returns the live reading of the cost per logical qubit-hour. ⚛️ oracle_getSecurityRecommendation takes a value and returns the security level recommended for it. oracle_getBreakCost estimates the cost to break a given algorithm. ⚛️ oracle_getHistory returns past readings between any two points. A wallet, an exchange or a researcher can ask the chain what it thinks the threat is today, and see how that answer has moved.

Five Qubits. All Running. 99.9% Accurate. RIKEN researchers report running five silicon spin qubits at the same time while keeping about 99.9% accuracy across all five. They traced a major source of error to the microwave control signals, then corrected it with a calibration between pairs of qubits instead of calibrating every combination. A single qubit alone reached well above 99.99%, and up to three running together stayed above 99.99%. The study is in Nature Physics, and the release was posted October 25. The caveats matter. These are single-qubit gates on five qubits. No two-qubit results were reported, and the remaining errors come from the higher microwave power needed to run several qubits at once. It is a step toward fault tolerance, not a threat to any cryptography today. Why it matters here: this is a third kind of hardware progress in under two weeks, after trapped-ion error correction and Google's error-reduction work. Different qubit technologies keep improving. QuanChain does not bet on one of them. Its oracle tracks the cost per logical qubit-hour & wallets move to stronger security levels at their next spend. The progress comes from every direction. The design should not depend on which one wins.

The Wallet Runs In Your Browser. The QuanChain wallet is designed to do its cryptography in the browser. Create. A 12 or 24 word BIP-39 phrase generates the parent wallet's 64 KB of entropy and its Merkle tree. Sign. Core cryptography compiles to WebAssembly: all 15 active security levels plus the Level 20 composite. Dilithium and SPHINCS+ are pure Rust, compiled to WASM. Protect. Keys sit in an encrypted keystore using ChaCha20-Poly1305. Child rotation happens automatically on every transaction, and the wallet recommends security upgrades based on your balance and the oracle's threat level. Strong cryptography should not need a different app for every level.