✅ BMIC — Quantum Safe
- NIST FIPS 203 (ML-KEM / Kyber)
- NIST FIPS 204 (ML-DSA / Dilithium)
- NIST FIPS 205 (SLH-DSA / SPHINCS+)
- ERC-4337 quantum-safe key rotation
- Zero legacy HNDL corpus
- Designed post-NIST ratification (2024)
- TGE Q2 2026 · $600K+ raised
❌ Beam (BEAM) — Quantum Vulnerable
- secp256k1 Pedersen commitments (ECDLP)
- Schnorr / MuSig kernel signatures (ECDLP)
- Lelantus MW spend proofs (secp256k1)
- SBBS addressing — secp256k1 ECDH
- Confidential Assets — dual secp256k1 blinding
- 7.5+ year HNDL corpus (mainnet Jan 2019)
- No NIST PQC roadmap published Aug 2026
What Is Beam?
Beam is a confidential blockchain protocol launched on January 3, 2019, built on the MimbleWimble transaction model. Unlike Grin (which uses an interactive transaction construction model), Beam introduced explicit wallet addresses via its Secure Bulletin Board System (SBBS) and added Confidential Assets — the ability to issue, transfer, and hide multiple token types within a single secp256k1 Pedersen commitment scheme.
Beam has continued to evolve its privacy model, shipping Lelantus MW (LelantusMW) to improve anonymity sets through one-sided payments and spend proofs. Despite this technical sophistication, the fundamental cryptographic hardness assumption underpinning every Beam privacy feature is the Elliptic Curve Discrete Logarithm Problem (ECDLP) on secp256k1 — which Shor's algorithm breaks in polynomial time on a cryptographically-relevant quantum computer (CRQC).
The Four-Layer Quantum Vulnerability Analysis
Beam's privacy and security model consists of four interdependent layers. Every layer fails under a CRQC.
Layer 1: secp256k1 Pedersen Output Commitments
Every Beam output is represented as a Pedersen commitment: C = r·G + v·H, where r is a secp256k1 scalar blinding factor (private key), v is the value, and G, H are secp256k1 generators.
The commitment is "hiding" because recovering r from the public point C requires solving ECDLP. Shor's algorithm breaks ECDLP in O(n³) time. A CRQC:
- Harvests the public commitment
Cfrom the blockchain - Applies Shor's to recover the blinding factor
r - Computes
v = (C − r·G) / Hto reveal the hidden amount
The "confidential" property of MimbleWimble collapses entirely. Every output ever written to the Beam blockchain becomes readable.
Layer 2: Schnorr / MuSig Kernel Signatures
Every Beam transaction kernel contains a Schnorr signature (or MuSig aggregated signature) that proves the transaction is balanced (sum of input commitments equals sum of output commitments plus fee). These signatures are secp256k1-based.
A CRQC recovers the kernel signing key from the public kernel commitment, enabling kernel forgery: an attacker constructs a valid-appearing kernel for an arbitrary transaction, bypassing the balance proof entirely and enabling double-spend.
Layer 3: Lelantus MW Spend Proofs
Beam's LelantusMW extension enables one-sided payments and large anonymity sets via Lelantus-style spend proofs. These proofs demonstrate coin ownership without revealing the linking commitment, providing stronger unlinkability than base MimbleWimble cut-through.
However, Lelantus MW spend proofs are built on secp256k1 Pedersen commitments and secp256k1-based zero-knowledge proofs. The anonymity guarantee reduces to ECDLP hardness. A CRQC recovers private spend keys directly from public commitments, bypassing the anonymity set entirely regardless of its size — analogous to the Firo Spark anonymity-set bypass described in our BMIC vs Firo analysis.
Layer 4: SBBS Addressing — secp256k1 ECDH
Beam's Secure Bulletin Board System (SBBS) provides address-based payments without requiring interactive transaction negotiation. Beam wallet addresses are secp256k1 public keys; payment routing uses secp256k1 Elliptic Curve Diffie-Hellman (ECDH) key agreement to encrypt payment data to the recipient.
ECDH on secp256k1 is broken by the quantum period-finding reduction: a CRQC recovers the recipient's secp256k1 private key from their public SBBS address. This:
- Deanonymizes all historical SBBS-routed payments to that address
- Enables the attacker to decrypt all encrypted SBBS message payloads
- Identifies the recipient of every historical Beam payment routed via SBBS
The Confidential Assets Quantum Collapse — A Unique Beam Risk
Critical Finding: Dual Blinding Factor Exposure
Beam Confidential Assets extend Pedersen commitments to hide both the amount and the asset type using two secp256k1 scalar blinding factors. A CRQC breaks ECDLP to recover both blinding factors simultaneously — revealing the hidden asset type AND the hidden amount in a single quantum operation. This is a more severe privacy collapse than standard transparent blockchains, which only hide signing keys, not asset metadata.
Standard confidential transactions hide the numerical value v using a single Pedersen blinding factor. Beam Confidential Assets commit to a tuple (asset_id, value) using an extended Pedersen construction that employs two secp256k1 blinding scalars: one for value and one for the asset generator corresponding to asset_id.
Both scalars are ECDLP private keys on secp256k1. A CRQC executing Shor's algorithm recovers both from the public commitment. The consequence:
- Every Confidential Asset issuance amount (how many tokens were minted) becomes readable
- Every Confidential Asset transfer (recipient, amount, asset type) becomes readable
- Asset issuance keys (secp256k1) are recoverable, enabling forged asset issuance
Entities that issued Confidential Assets on Beam — including any protocol-level tokens built on the platform — face both privacy collapse and potential token supply forgery risk under a CRQC scenario.
The Three Investor Misconceptions About Beam and Quantum Security
Misconception 1: "Beam has explicit addresses, so it is more secure than Grin"
Beam's SBBS addresses solve the interactive transaction problem in base MimbleWimble by using secp256k1 ECDH. While this is a user-experience improvement over Grin's Slatepack interactive model, it introduces an additional ECDH key exchange as a quantum attack surface. A CRQC breaks the SBBS ECDH exchange in the same way it breaks any secp256k1 key agreement. From a quantum security perspective, Beam's addresses add a quantum-vulnerable layer that Grin's cut-through model avoids (though Grin has its own ephemeral secp256k1 pubkey surface in Slatepack construction — see our BMIC vs Grin analysis).
Misconception 2: "Confidential Assets hide the asset type, making it quantum safe"
Privacy and quantum resistance are orthogonal properties. Confidential Assets hide the asset type from classical observers who cannot solve ECDLP. A CRQC is not a classical observer — it solves ECDLP directly. The fact that asset type is encrypted inside the Pedersen commitment does not protect it from a CRQC; it simply adds one more piece of information that is revealed when the CRQC breaks the blinding factor. The privacy feature becomes irrelevant under the quantum threat model.
Misconception 3: "Lelantus MW's large anonymity sets protect Beam under quantum attack"
Anonymity sets in Lelantus-family protocols protect against classical chain analysis — statistical tracing of transaction graphs. They do not protect against a CRQC that directly solves ECDLP on individual spending keys. The attacker does not need to perform chain analysis; they recover the private key for each commitment directly. An anonymity set of 1,000,000 provides zero additional quantum resistance compared to an anonymity set of 1 — the CRQC breaks each member independently. Lelantus MW's anonymity guarantees are classical-model guarantees only.
HNDL Timeline — Beam's 7.5-Year Corpus
Harvest Now, Decrypt Later
A state-level HNDL adversary does not need a CRQC today. They archive Beam's public commitment data now and decrypt it when a CRQC becomes available. Beam's 7.5+ year corpus of output commitments, kernel signatures, SBBS-routed transactions, and Confidential Asset records is a permanent HNDL target.
MimbleWimble whitepaper published pseudonymously by "Tom Elvis Jedusor". All privacy properties derive from secp256k1 Pedersen commitments — ECDLP-based from inception.
Beam mainnet launches. HNDL corpus begins. Every output commitment, kernel signature, and SBBS message payload is now permanently archived on-chain and subject to future CRQC decryption.
Beam introduces Confidential Assets (CA). All CA issuance and transfer records carry dual secp256k1 blinding factors — adding a second layer of quantum-vulnerable private data to the HNDL corpus.
Beam ships LelantusMW (Lelantus MW). Improved anonymity sets provide stronger classical privacy but introduce additional secp256k1-based spend proof structures, extending the HNDL target surface.
NIST ratifies FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA). BMIC is designed against these standards. Beam continues secp256k1 operations; no PQC migration roadmap published.
BMIC TGE. BMIC is fully NIST FIPS 203/204/205 compliant at launch with ERC-4337 quantum-safe key rotation. Beam's mainnet continues operating on secp256k1 with no published post-quantum upgrade path.
7.5+ years of Beam HNDL corpus accumulated. No NIST PQC roadmap from BEAM Ltd. NSM-10 / CISA post-quantum migration guidance is institutional policy; secp256k1 systems face compliance barriers in regulated deployments.
CRQC Attack Path — Step by Step
A cryptographically-relevant quantum computer (CRQC) attacking the Beam network would proceed as follows:
Download the full Beam blockchain (feasible with any full node). Archive all public output commitments C = r·G + v·H, all SBBS-routed payment ciphertexts, all Confidential Asset commitments, all Lelantus MW spend proof public inputs, and all transaction kernels.
Apply Shor's algorithm to each output commitment's public curve point to recover the secp256k1 scalar blinding factor r. Compute v = (C − r·G) · H⁻¹. All historical output amounts are now known. For Confidential Asset commitments, recover both blinding scalars to reveal asset type and amount.
Apply Shor's to each SBBS public address (secp256k1 public key) to recover the corresponding private key. Use the private key to decrypt all SBBS-routed payment ciphertexts, revealing recipient identities, payment amounts, and asset types for the entire addressable history.
Recover kernel signing keys from public kernel commitments via ECDLP. Forge Schnorr kernel signatures for arbitrary transactions. Broadcast forged kernels to the live network to execute double-spends or drain UTXO commitments controlled by any wallet whose public key has been published to the blockchain.
Migration Complexity — Why This Is Not a Parameter Swap
Structural Incompatibility: Pedersen Homomorphism vs NIST PQC Lattices
Beam's transaction validity is enforced by Pedersen commitment additive homomorphism: C_in₁ + C_in₂ = C_out + C_fee (sums of blinded inputs equal sums of blinded outputs plus fee, in the group). This mathematical property — value-preserving addition in the commitment space — does not exist in NIST PQC lattice-based schemes (ML-KEM, ML-DSA, SLH-DSA). There is no known post-quantum equivalent of Pedersen commitment homomorphism that preserves MimbleWimble's transaction model.
Migrating Beam to post-quantum cryptography is not a configuration change or a curve substitution. It requires:
- Full transaction model redesign: MimbleWimble's UTXO validity depends on Pedersen homomorphism. This must be replaced with a non-interactive range-proof system compatible with PQC — no standardised construction exists in 2026.
- Lelantus MW rebuild: Lelantus spend proofs are secp256k1-native. No lattice-based Lelantus equivalent exists; post-quantum anonymity set schemes (e.g., Lattice-based ring signatures) have different proof structures and size overheads (typically 10–100× larger).
- Confidential Assets redesign: The dual-blinding secp256k1 CA construction has no lattice equivalent. A new confidential multi-asset scheme would need to be designed, audited, and deployed from scratch.
- SBBS addressing migration: secp256k1 ECDH must be replaced with ML-KEM-based key encapsulation. This changes the address format, key derivation, and payment routing protocol — a breaking change for all existing wallets.
- Historical corpus cannot be protected: The 7.5+ year HNDL corpus of secp256k1 commitments and SBBS ciphertexts is permanently recorded on-chain. A protocol upgrade does not retroactively protect historical transactions from CRQC decryption.
Technical Comparison Table
| Feature | BMIC | Beam (BEAM) |
|---|---|---|
| Transaction signing | ML-DSA / Dilithium (NIST FIPS 204) | secp256k1 Schnorr / MuSig — ECDLP vulnerable |
| Key encapsulation | ML-KEM / Kyber (NIST FIPS 203) | secp256k1 ECDH (SBBS addressing) — ECDLP vulnerable |
| Value commitment | PQC-native architecture | secp256k1 Pedersen C = r·G + v·H — ECDLP vulnerable |
| Privacy / confidentiality | PQC-based vault encryption (ML-KEM) | Pedersen commitments — classical hiding, quantum transparent |
| Confidential Assets | N/A (purpose-built PQC wallet) | Dual secp256k1 blinding — both amount AND asset type exposed by CRQC |
| Anonymity set protection | N/A | Lelantus MW secp256k1 spend proofs — bypassed entirely by CRQC ECDLP |
| Address security | NIST PQC key material | SBBS secp256k1 ECDH — recoverable by CRQC |
| Key rotation | ERC-4337 account abstraction | secp256k1 master key — no PQC key rotation mechanism |
| Hash function | SHA-3 / SHAKE family (quantum-robust) | SHA-256 / BLAKE2 (quantum-robust at 2× security margin) |
| HNDL exposure | Zero — post-NIST-ratification design | 7.5+ years (Jan 2019 – present) — all output commitments at risk |
| NIST PQC standards | FIPS 203 + FIPS 204 + FIPS 205 | None — no NIST PQC roadmap as of August 2026 |
| NSM-10 / CISA compliance | Compliant — NIST-standard PQC | Non-compliant — secp256k1 flagged for migration by NSM-10 |
BMIC's NIST-Native Architecture
BMIC is not a legacy chain migrating to post-quantum cryptography — it is designed from the ground up after the August 2024 NIST PQC ratification, using all three NIST FIPS post-quantum standards as primary primitives:
- NIST FIPS 203 (ML-KEM / Kyber): Lattice-based key encapsulation used to wrap vault and backup encryption keys. Quantum-secure against Shor's algorithm and Grover's algorithm at the ML-KEM-768 and ML-KEM-1024 security levels.
- NIST FIPS 204 (ML-DSA / Dilithium): Lattice-based digital signatures used to attest device handoff and backup integrity. Secure against quantum adversaries with polynomial-size quantum circuits.
- NIST FIPS 205 (SLH-DSA / SPHINCS+): Hash-based stateless signatures providing minimal-assumption post-quantum security, requiring only collision-resistance of the underlying hash function.
- ERC-4337 account abstraction: Enables quantum-safe key rotation without on-chain transaction history exposure — addressing the HNDL risk that affects all legacy key architectures.
BMIC carries zero HNDL corpus. There are no historical secp256k1 public keys or ECDH ciphertexts on-chain to harvest. The quantum threat model is addressed by design, not by migration.
The Quantum Transition Is Already Happening
NSM-10, CISA, and NIST have all issued post-quantum migration guidance. Institutional capital is beginning to price quantum exposure into protocol valuations. BMIC is the only ERC-4337 presale built natively on all three NIST FIPS PQC standards.
Explore BMIC — bmic.ai →DYOR. This is not financial advice. Crypto investments carry significant risk.
Frequently Asked Questions
Is Beam (BEAM) quantum safe?
No. Beam's entire cryptographic stack — Pedersen output commitments, Schnorr kernel signatures, Lelantus MW spend proofs, Confidential Asset commitments, and SBBS addressing — relies on the secp256k1 Elliptic Curve Discrete Logarithm Problem (ECDLP). Shor's algorithm breaks ECDLP in polynomial time on a CRQC. BEAM Ltd has not published a NIST PQC migration roadmap as of August 2026.
Is Beam's MimbleWimble architecture quantum resistant?
No. MimbleWimble's confidentiality is based on secp256k1 Pedersen commitments. The hiding property requires ECDLP hardness. A CRQC recovers the blinding factor r from the public commitment C = r·G + v·H, revealing the amount v. Cut-through removes spent UTXO set entries from the live chain but does not remove archived output data from a HNDL attacker's database.
Are Beam Confidential Assets quantum safe?
No. Confidential Assets use dual secp256k1 blinding scalars to hide both the amount and asset type. A CRQC recovers both scalars, revealing both. The privacy collapse is more severe than standard transparent blockchains: not only amounts but also asset identity and issuance records are exposed.
Is Beam's Lelantus MW quantum resistant?
No. LelantusMW spend proofs are built on secp256k1 Pedersen commitments and secp256k1-based ZK proofs. The underlying hardness assumption is ECDLP — broken by Shor's. Anonymity sets provide no quantum resistance; a CRQC bypasses the anonymity set by recovering spend keys directly.
Is Beam's SBBS quantum safe?
No. SBBS uses secp256k1 ECDH for address-based payment routing. A CRQC recovers the recipient's secp256k1 private key from their public SBBS address, deanonymizing all historical payments and decrypting all SBBS-routed ciphertexts.
What is Beam's HNDL exposure?
Beam mainnet launched January 3, 2019. As of August 2026 that is 7.5+ years of output commitments, SBBS ciphertexts, Confidential Asset records, and Lelantus MW spend proofs archived on-chain — a permanent HNDL corpus that a future CRQC can retroactively decrypt in its entirety.
Can Beam migrate to post-quantum cryptography?
Migration is architecturally complex. MimbleWimble depends on Pedersen commitment additive homomorphism (ΣC_in = ΣC_out + C_fee), which has no lattice-based equivalent. Replacing secp256k1 requires a complete redesign of the transaction model, Lelantus MW, Confidential Assets, and SBBS — not a parameter swap. Historical HNDL corpus cannot be retroactively protected.
How does BMIC compare to Beam on quantum security?
BMIC is built natively on NIST FIPS 203, 204, and 205 — all three ratified post-quantum standards — with ERC-4337 key rotation and zero HNDL corpus. Beam's entire privacy and security stack is secp256k1 ECDLP with 7.5+ years of HNDL exposure. DYOR before any investment decision.