MD Method & sources

How this works

What every number on the site is, where it comes from, and the sources behind each cryptographic claim. Checked on October 21, 2026.

Why curve cryptography falls to Shor

Solana wallets, Confidential Balances and most privacy-pool note encryption rest on the elliptic-curve discrete logarithm problem: given a public point Q = x·G, find the secret x.

• Your address is your public key. “The address of a normal account in Solana is a Base58-encoded string of a 256-bit ed25519 public key” (Solana exchange guide; see also account structure). Program-derived addresses are the exception: they are “guaranteed to not lie on the Ed25519 curve, which means no private key exists for them” (Solana docs, PDAs).
• Classical cost. Curve25519's prime-order subgroup, which ristretto255 shares, has order 2²⁵² + 27742317777372353535851937790883648493 (RFC 7748 §4.1, RFC 9496). The rho method “breaks ECDLP using, on average, approximately 0.886 sqrt(ℓ) additions”; SafeCurves lists Curve25519 at 2^125.8 (SafeCurves: rho). Bernstein's Curve25519 paper notes that every known attack costs more than brute-forcing a 128-bit key (Curve25519, 2006).
• Quantum cost. Shor's algorithm computes discrete logarithms in polynomial time. In March 2026, Babbush, Zalcman, Gidney et al. (Google Quantum AI, UC Berkeley, Ethereum Foundation and Stanford) estimated that the 256-bit ECDLP on secp256k1 needs “≤ 1200 logical qubits and ≤ 90 million Toffoli gates”, and that “on superconducting architectures with 10⁻³ physical error rates and planar connectivity, those circuits can execute in minutes using fewer than half a million physical qubits” (arXiv:2603.28846; Google Research blog, March 31, 2026). The estimate is for secp256k1, not Solana's Curve25519. The authors say the estimates “do not apply unchanged to all elliptic curves”, but they expect other curves with a 256-bit modulus and group order to cost “the same order of magnitude”. The paper names Solana among chains that “use public keys directly as account addresses”.
• Earlier estimates for comparison: Roetteler, Naehrig, Svore and Lauter 2017 (arXiv:1706.06752); Häner et al. 2020 (arXiv:2001.09580); Litinski 2023, “50 million Toffoli gates” (arXiv:2306.08585). For RSA: Gidney 2025, “How to factor 2048 bit RSA integers with less than a million noisy qubits” (arXiv:2505.15917).
• Estimates keep falling (the Q-Day clock). RSA-2048: 20 million noisy qubits in 2019 (Gidney & Ekerå, arXiv:1905.09749), and fewer than a million in 2025 (Gidney, arXiv:2505.15917). 256-bit elliptic curves: Babbush et al. (2026) report “nearly a 20 fold reduction” against the previous best (Litinski, 2023, about 9 million physical qubits), landing under 500,000. The largest superconducting processor built is IBM's 1,121-qubit Condor (IBM, 2023). Raw qubit counts are not directly comparable with error-corrected requirements, but they show the gap.
• What does survive. Symmetric ciphers and hashes are not broken by Shor. NIST: “AES 128 will remain secure for decades to come” (NIST PQC FAQ). The replacements for curve signatures and key exchange are standardized: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), all final on August 13, 2024. NIST's transition plan (IR 8547, still an initial public draft from November 2024) lists EdDSA as “disallowed after 2035”.

Solana Confidential Balances

• Encryption. “For public key encryption, the program uses the twisted ElGamal encryption scheme” and “for symmetric encryption, it uses AES-GCM-SIV”, stored as the decryptable balance (Confidential Balances: encryption). The ElGamal public key is a Ristretto point (zk-sdk source); the symmetric cipher is AES-128-GCM-SIV (zk-sdk docs).
• What one account stores. The ConfidentialTransferAccount extension (type 5, 295 bytes) holds three twisted ElGamal ciphertexts (pending balance low and high, available balance) and one AES ciphertext, the decryptable available balance (token-2022 source). A mint may also set an auditor ElGamal key under which “every transfer additionally encrypts its amount” (integration guide).
• Why the amounts are exposed. Each account stores its ElGamal public key next to its ciphertexts, so Shor's algorithm can recover the ElGamal secret key from it directly. The AES-128 copy of the balance resists quantum attack on its own, but the available balance is also stored as an ElGamal ciphertext. Keys derived from a wallet signature (“the owner signs a canonical, domain-separated message and the keys are derived from that signature”, integration guide) are a different matter. Shor yields the ed25519 signing scalar but not the RFC 8032 nonce prefix, so the exact deterministic signature cannot be reproduced from the address alone (RFC 8032; the argument is made in the Umbra V2 / Nimbus docs).
• Status history. Enabled with SIMD-0153 in January 2025. In April 2025 a bug was patched without disabling the program (post-mortem, May 2, 2025). In June 2025 a second Fiat-Shamir bug was reported, and the program was disabled by feature activation on June 19, 2025, at epoch 805 (post-mortem, June 25, 2025). After audits, the feature zkexuyPRdyTVbZqEAREueqL2xvvoBhRgth9xGSc1tMN re-enabled it at slot 424,224,000 (epoch 982, June 4, 2026), and Token-2022 confidential transfers returned on June 17, 2026 (token-2022 #657; Agave source).

Privacy pools: how each one is classified

For each pool we read its documentation and code to answer one question: how is a note encrypted to its recipient? Each pool gets one of three classifications:

• Shor-vulnerable curve-encrypted: the recipient encryption uses elliptic-curve key agreement or ElGamal.
• Quantum-resistant hash-only: there is no public-key encryption of notes, only hash commitments and symmetric encryption.
• Quantum-resistant post-quantum encrypted: notes are encrypted to recipients with a post-quantum scheme (ML-KEM). This fourth case was added because one pool, Umbra V2, fits neither of the first two.
• Unknown: there is no public evidence either way.

This covers the confidentiality of notes only. Most pools also use pairing-based zero-knowledge proofs and ed25519 signatures, which a quantum computer would affect in other ways (forging new proofs or transactions). Those are noted per pool where documented.

Not ranked: Helius Privacy (“Solana Rings”) is devnet-only, uses P-256 ECDH and has no mainnet value. Light Protocol's private transactions were discontinued, and Elusiv was sunset in 2024. PANDOR, the program that calls the ZK ElGamal Proof program most often, is a game, not a pool. Details are in docs/DISCOVERY.md.

How the live figures are computed

• Curve-encrypted value. The sum of the current TVL of every pool classified as curve-encrypted, each from the public source shown next to it, mostly DefiLlama's API (api.llama.fi/tvl/<slug>, or the Solana share from /protocol/<slug> for multi-chain pools). Cloak and Veil are not on DefiLlama, and Hinkal's Solana share is only available inside a very large DefiLlama response. All three are valued from their on-chain pool accounts; Hinkal's vault addresses are the ones DefiLlama's own adapter uses. Only SOL, USDC and USDT are counted, at DefiLlama prices, so a thinly traded token in a vault cannot inflate the figure. Veil's vault addresses were derived from the PDA seeds in its app code, not taken from its docs. A pool without a public figure is listed but left out of the total, and the page says so. public/stats.json is regenerated every minute (a scheduled Cloudflare Worker, or the Node indexer in indexer/). DefiLlama figures are re-read every minute (multi-chain pools every 5), and on-chain vault balances every 3 minutes. If a source fails, the last good figure is kept for up to 15 minutes and then shown as unavailable.
• Encrypted Confidential Balance amounts. Counted, never valued. Once a week the indexer scans all of Token-2022 with a paginated getProgramAccountsV2 (Helius). It looks for the ConfidentialTransferAccount header at position 170, where every associated token account keeps it, right after ImmutableOwner. Each hit is checked by parsing its extensions and counts as 3 ElGamal ciphertexts, plus 1 when the account holds withheld confidential fees. While a scan runs, the page shows what it has found so far and how far it has got, as a floor. An account whose confidential extension sits in an unusual position could be missed. The public Solana RPC refuses this scan; without an RPC that allows it, the page says the count is unavailable rather than guessing.
• ZK ElGamal Proof program status comes from its two feature accounts on mainnet (disable and re-enable) and its latest transaction.

The Decrypt Lab

• Each round your browser picks a random prime p ≡ 1 (mod 3) and builds a curve y² = x³ + b over F_p, the same shape as Bitcoin's secp256k1. The group order n is a prime of exactly 24, 28, 32 or 36 bits; the CM method gives the six possible orders without counting points. Curves with n = p are rejected.
• It generates a key pair (x, Q = x·G) and encrypts “gm from 2009” with hashed ElGamal: R = r·G, c = m ⊕ SHA-256(r·Q). That is the same shape as the curve-based note encryption used by privacy pools, just tiny. The private key is then discarded.
• Baby-step giant-step recovers x from Q alone in about 2√n group operations, and the message is decrypted with it. Everything runs in a Web Worker on your device, with times measured by performance.now(). The output is paced so you can read it; the times are not.
• The extrapolation takes your measured time per group operation and multiplies it by the expected baby-step giant-step work for a 2²⁵²-element group, 1.5 × 2¹²⁶ operations. That figure is compared with the age of the universe, 13.8 billion years (NASA/IPAC Planck; Planck 2018 VI). Pollard's rho needs no table, but it has the same √n cost.

The wallet check

• It is read-only. It calls getTokenAccountsByOwner (Token-2022), getSignaturesForAddress (latest 1,000) and getTransaction (latest 40) through the RPC set in config.json. Nothing is signed, sent or stored.
• Wallet key: always exposed on Solana, unless the address is a PDA, which the check detects by testing whether the address is a point on the ed25519 curve.
• Confidential Balance accounts: read from the parsed account extensions.
• Memos: a memo counts as “looks like ciphertext” when it is a single base64, base58 or hex token of at least 48 bytes with high character entropy. 32-byte values are excluded, because they are usually hashes, IDs or zero-knowledge commitments. The scheme cannot be known from the chain, so these are reported as unknown, never as decrypted.
• Pool interactions: a transaction counts when it touches a pool's program id. Each one then takes that pool's classification.
• The score. “Secrets that survive Q-Day: S of M”: M is every item found, S the ones whose protection does not depend on curve cryptography. Unknown items count toward neither.
• Demo mode (?demo=1) offers three public example wallets, shown from the indexer's hourly snapshot with its time. The indexer checks their latest 60 transactions. Any address you type is read live.

All sources

• Solana Foundation, Post Mortem: ZK ElGamal Proof Program Bug, June 2025 (June 25, 2025), and Post Mortem: ZK ElGamal Proof Program Bug (May 2, 2025).
• NIST, FIPS 203, FIPS 204, FIPS 205 (August 13, 2024); IR 8547 ipd (November 12, 2024); PQC FAQ.
• Babbush et al., Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations (arXiv:2603.28846, March 30, 2026; v2 April 15, 2026), and the Google Research blog post.
• Solana docs: Confidential Balances encryption, confidential transfer integration guide, PDAs, exchange guide.
• RFC 7748, 8032, 9496; SafeCurves.
• Each pool's own documentation, linked in the table above.

Something wrong or out of date? The figures come from stats.json and the classifications from indexer/pools.json, both plain files you can check.