QUANTUM DECRYPT
$129K in curve-encrypted privacy pools · live

Encrypted secrets on Solana rest on math a quantum computer breaks. Watch it happen.

Decrypt your wallet
Decrypt labWatch a key break live, in your browser Most exposedPrivacy pools ranked by Shor-vulnerable value
The Cipher Sphere: an armored metal sphere with glowing cyan seams and a vault-door dial at its center
Live counterWhat's waiting to be decrypted, now Your walletWhat Q-Day would reveal about you

01 Decrypt lab

Watch the math break

Your browser builds a toy elliptic-curve key, encrypts a message to it, throws the private key away, then recovers it from the public key alone with baby-step giant-step. Four rounds: 24, 28, 32 and 36 bits. Every 4 bits makes the search 4 times longer.

Toy keys generated in your browser. No real Solana key is ever attacked.

round · waiting

The live lab runs in a Web Worker and needs JavaScript. It generates a toy key pair on a curve y² = x³ + b with a prime number of points, encrypts the text “gm from 2009” to the public key, then solves the discrete logarithm to get the private key back and decrypt.

Output is paced so you can read it. Every time shown is measured in your browser.

Time to break, measured hereMilliseconds, log scale. One dot per round.

The chart fills in as rounds finish.

Now scale it to Solana

Classical computer. Solana's curve has a prime-order group of about 2252 elements. Baby-step giant-step needs about √n steps, 2126 group operations, and Pollard's rho, the standard generic attack, costs about the same. At the speed measured in your browser that is far longer than the age of the universe.

Quantum computer. Shor's algorithm solves the same problem in polynomial time. In March 2026, Google Quantum AI and co-authors estimated that a 256-bit elliptic-curve key (Bitcoin's secp256k1) could be broken in minutes with fewer than 500,000 physical qubits, and expect other 256-bit curves to cost the same order of magnitude. No machine that size exists today.

Sources and assumptions

02 Live counter

$128,535

sits in Solana privacy pools that rely on curve cryptography

The count of encrypted Confidential Balance amounts stored on-chain is unavailable right now. The first full count of Token-2022 is running; it takes about an hour.

Updated · refreshed every minute · how this is computed

03 Most exposed

Privacy pools by Shor-vulnerable value

How each pool protects the notes it sends to recipients, and how much value sits behind that protection. A classification describes the cryptography a pool documents. It does not mean any pool is broken today.

#1 · live · legacyShor-vulnerable

Umbra V1 (Legacy)

$114,825TVL · DefiLlama

Notes are sealed with an ephemeral X25519 key exchange (ECDH) and AES-GCM; balances use the Rescue cipher keyed from X25519 or the Arcium MXE key. Proofs: Groth16 on BN254.

DocsEvidenceTVL source
#2Shor-vulnerable

Hinkal (Solana)

$8,703TVL · On-chain vaults (SOL, USDC, USDT)

Notes are encrypted with libsodium crypto_box_seal over Curve25519 (XSalsa20-Poly1305). Proofs: Groth16 on BN254. Program ids observed on-chain, not documented.

DocsEvidenceTVL source
#3Shor-vulnerable

Cloak

$4,387TVL · On-chain pool accounts (SOL, USDC, USDT)

Notes sent to a recipient are sealed in an X25519 + XSalsa20-Poly1305 envelope (opt-in) and compliance metadata is encrypted to X25519 keys; self notes use AES-256-GCM. Proofs: Groth16 on BN254.

DocsEvidenceTVL source
#4Shor-vulnerable

Veil

$620TVL · On-chain vaults (SOL, USDC, USDT)

The live app encrypts each note to the recipient's X25519 viewing key (ECDH, SHA-256 key derivation, AES-GCM); the docs name no scheme. Proofs: Groth16 on BN254.

DocsTVL source
#5Quantum-resistant

Privacy Cash

$1,770,568TVL · DefiLlama (Solana only)

No public-key note encryption: notes are AES-256-GCM encrypted to the depositor under a key derived from a wallet signature, and UTXO keys are Poseidon hashes. Proofs (Groth16 on BN254) and wallet signatures are still curve-based.

DocsEvidenceTVL source
#6Quantum-resistant

Umbra V2

$262,596TVL · DefiLlama

New notes are encrypted to recipients with ML-KEM-768 and AES-256-GCM, a post-quantum scheme. Groth16 proofs on BN254 and several signature schemes are still curve-based.

DocsEvidenceTVL source
#7Quantum-resistant

Voidify

$4,655TVL · DefiLlama

No public-key note encryption: classic notes stay with the user and Nova notes are AES-GCM encrypted under a key derived from a wallet signature. Proofs: Groth16 on BN254.

DocsTVL source
#8Quantum-resistant

Mixoor

$72TVL · DefiLlama

Commitments are Poseidon hashes and the public code shows no public-key note encryption. Medium confidence: the deployed program differs from the public repository. Proofs: Groth16 on BN254.

DocsEvidenceTVL source
#9 · live · front-endQuantum-resistant

SolCloak

Counted in Privacy Cash

A front-end for the Privacy Cash pool: the same program and the same AES-256-GCM self-encryption, so its deposits are part of Privacy Cash's figure.

Docs

04 Your wallet

Decrypt your wallet

Paste any Solana address to see what Q-Day would reveal. This reads public chain data only: nothing to connect, nothing to sign.