Decred's hybrid PoW/PoS uses secp256k1 ECDSA, Schnorr aggregated signatures, and Curve25519 EdDSA across three protocol layers — all broken by Shor's algorithm. Ten-year HNDL corpus, locked PoS ticket collateral on-chain. BMIC implements NIST FIPS 203/204/205. Full technical breakdown.
Buy BMIC — Quantum-Safe Presale → See Full ComparisonDecred is not quantum safe. Its hybrid PoW/PoS architecture employs three separate elliptic-curve schemes — secp256k1 (ECDSA, Schnorr) for user transactions and PoS ticket voting, and Curve25519 (EdDSA) for Politeia governance and CoinShuffle++ mixing — all of which are efficiently solved by Shor's algorithm. Decred's 10-year on-chain corpus (February 2016 – August 2026) is available for Harvest Now, Decrypt Later (HNDL) today. The PoS ticket system creates a uniquely concentrated, publicly-identified attack surface: ~40,000–60,000 tickets with locked DCR collateral, all with known public keys. As of August 2026, the Decred developers have published no NIST PQC migration roadmap.
Decred is a self-funded blockchain project founded in 2016 that pioneered a hybrid Proof-of-Work / Proof-of-Stake consensus mechanism. Its governance system (Politeia) and privacy feature (CoinShuffle++) add further cryptographic layers. Each layer uses a different elliptic-curve scheme — but all share the same fundamental vulnerability to a cryptographically relevant quantum computer (CRQC).
Standard DCR send/receive transactions use secp256k1 ECDSA — the same elliptic curve and signature scheme used by Bitcoin, Ethereum, Litecoin, and dozens of other major cryptocurrencies. Every P2PKH (pay-to-public-key-hash) output on the Decred chain stores a secp256k1 public key hash on-chain; the full public key is revealed when the output is spent. P2PK outputs expose the public key immediately upon creation without requiring a spend step.
Shor's algorithm, running on a CRQC, can efficiently solve the elliptic curve discrete logarithm problem (ECDLP) over secp256k1 and derive a private key from any exposed public key. For unspent P2PKH outputs where the public key has not yet been revealed (i.e., the address has received but never sent), the attacker must wait for a spend to observe the public key — but all P2PK outputs and any previously-spent P2PKH outputs are immediately vulnerable.
Decred's PoS component requires holders to time-lock DCR as "tickets." Five randomly-selected tickets must vote to validate each block. Ticket voting uses Schnorr signatures over secp256k1. Schnorr enables efficient signature aggregation and is used in Decred's treasury spending proposals and ticket vote aggregation. However, "Schnorr" here refers only to the signature construction — not to a different hardness assumption. The underlying security depends on the ECDLP over secp256k1, identical to ECDSA. Schnorr signatures on secp256k1 are fully broken by Shor's algorithm.
The PoS ticket system introduces a quantum risk absent from simple UTXO chains: ticket purchase transactions lock DCR collateral on-chain for a protocol-defined period (average ~28 days, up to 142 days). The ticket's public key is exposed at purchase time. A CRQC attacker can derive the corresponding private key and either vote fraudulently on behalf of the ticket holder or revoke the ticket and redirect the collateral refund — without the legitimate holder being able to react within the voting window.
Decred's off-chain Politeia governance system and CoinShuffle++ privacy mixing feature use Curve25519 EdDSA (specifically Ed25519 signatures for proposal signing and identity). Curve25519 is a different elliptic curve from secp256k1 but is equally vulnerable to Shor's algorithm — the ECDLP over Curve25519 is efficiently solved by the same quantum attack. Ed25519 keys used for Politeia proposal authentication represent a third attack surface with no quantum mitigation.
secp256k1 (ECDSA) · secp256k1 (Schnorr) · Curve25519 (Ed25519) — Decred's protocol diversity does not translate to quantum diversity. All three curves rely on elliptic curve arithmetic, and Shor's algorithm breaks all of them. Architectural novelty (hybrid PoW/PoS, governance, mixing) is not a substitute for NIST-standardised post-quantum primitives.
"Harvest Now, Decrypt Later" (HNDL) is the practice of collecting encrypted or signed data today for decryption once a CRQC becomes available. Because all Decred transactions are permanently and publicly on-chain, every public key ever used on the Decred network is available for harvesting right now.
| Period | Event / Milestone | Quantum Exposure |
|---|---|---|
| Feb 2016 | Decred mainnet launches (genesis block) | secp256k1 ECDSA corpus begins accumulating |
| 2016–2017 | Early PoS ticket system live; first Politeia drafts | Ticket public keys + Ed25519 governance keys on-chain |
| 2019 | CoinShuffle++ privacy mixing live | Curve25519 mixing keys introduced as third exposure layer |
| 2020 | Decred treasury decentralised (on-chain spending) | Treasury output public keys added to harvestable corpus |
| 2021 | BLAKE3 PoW algorithm upgrade (Decred v1.7) | BLAKE3 is hash-based (quantum-resistant for PoW); signatures remain ECDLP-based |
| 2022 | Subsidy split revised; PoS weight increased to 80% | Higher PoS weight = more ticket public keys per block = larger harvestable corpus growth rate |
| 2024 | NIST finalises FIPS 203/204/205 (first PQC standards) | Decred publishes no migration proposal; BMIC adopts all three standards |
| Aug 2026 | This analysis — 10+ year corpus complete | All Decred public keys (secp256k1 + Curve25519) harvestable; no PQC roadmap published |
State actors and well-resourced adversaries do not wait for a CRQC to arrive. HNDL operations collect blockchain data now. The 10-year Decred corpus — including all ticket purchase public keys, treasury outputs, Politeia governance keys, and standard UTXO public keys — is already a candidate for future decryption. A CRQC reaching operational capability in the 2030s would give an attacker retroactive access to all pre-migration DCR holdings.
Download the complete Decred chain — all blocks since February 2016. Extract every secp256k1 public key from P2PK outputs (directly exposed) and previously-spent P2PKH inputs (public key revealed at spend time), all Schnorr ticket vote keys, and all Curve25519 Ed25519 Politeia signing keys. Identify all currently-live ticket purchase transactions (approximately 40,000–60,000 at any given time) and their associated public keys and locked collateral amounts.
Apply Shor's algorithm to derive the private key from each harvested public key. Prioritise live ticket public keys (known locked collateral value, known expiry window) and large-balance outputs. ECDLP over secp256k1 and Curve25519 are solved in polynomial time on a CRQC. No brute-force required — Shor's is deterministic given a valid public key.
Use derived private keys to broadcast fraudulent revoke or vote transactions for live tickets, redirecting DCR collateral refunds to attacker-controlled addresses. Simultaneously broadcast fraudulent send transactions for all other exposed UTXOs. Because Decred's PoS voting window is 5 blocks (~25 minutes), attackers who control the full CRQC derivation pipeline can act faster than legitimate holders can detect and respond.
Use derived Curve25519 Ed25519 private keys to forge Politeia proposal signatures, approve fraudulent treasury spending proposals, or impersonate Decred stakeholders in governance votes. The Decred treasury itself — funded by 10% of each block subsidy — becomes accessible if treasury output keys are compromised.
Decred's hybrid PoW/PoS consensus is its primary differentiating feature — designed to give stakeholders meaningful governance power and make 51% attacks more expensive. In a classical threat model, this design works as intended. Under a quantum threat model, it introduces a risk that pure UTXO chains like Bitcoin do not face in the same form.
A pure UTXO chain requires an attacker to identify high-value, exposed outputs and race to spend them. On Decred, active tickets are:
This means a CRQC attacker attacking Decred has a pre-compiled, publicly-available target list with known collateral values — a capability not available against standard UTXO-only chains, where attack targets must be inferred from wallet behaviour.
Because ticket collateral is locked by protocol for up to 142 days, a CRQC attacker can derive ticket private keys in advance and then wait for the optimal broadcast window — for example, when the ticket is near expiry and the legitimate holder is likely to be inattentive. This is a unique temporal attack surface that does not exist in standard UTXO-only chains.
Migrating Decred to post-quantum cryptography would require replacing all three cryptographic layers simultaneously — a coordination challenge with no precedent in the Decred codebase.
NIST FIPS 204 (ML-DSA / CRYSTALS-Dilithium) Level 3 signatures are approximately 3,309 bytes — compared to secp256k1 ECDSA signatures at 71–72 bytes. That is a 46× size increase per signature. Decred blocks average multiple transactions and five ticket votes per block. Block size, propagation time, and storage requirements would increase substantially without a major protocol redesign.
Decred's PoS ticket voting uses Schnorr signature aggregation to combine multiple ticket votes efficiently. Post-quantum lattice-based signatures (ML-DSA, FALCON) have different algebraic properties that make naive aggregation incompatible with the current Schnorr aggregation scheme. A PQC migration would require either a new threshold/aggregate construction (with no standardised equivalent to Schnorr aggregation in the PQC space as of 2026) or a fundamental redesign of the PoS ticket voting protocol.
Even a successful PQC migration for new transactions cannot retroactively protect the 10-year historical corpus. All DCR outputs created before migration — including all pre-migration ticket collateral refunds and treasury outputs — retain their original secp256k1 or Curve25519 public keys on-chain. A CRQC attacker can target any pre-migration output whose public key has been revealed, indefinitely.
As of August 2026, the Decred developers have published no Decred Change Proposal (DCP) or public roadmap for NIST PQC migration. The Decred project does not have a dedicated cryptography research team comparable to the Ethereum Foundation's Applied Cryptography Group or the Bitcoin Core cryptography contributors group. The absence of a published migration timeline means Decred holders have no visibility on when — or whether — PQC protection will be implemented.
BMIC was designed from the ground up with post-quantum cryptography as a core requirement — not a future migration item. The BMIC protocol implements all three NIST post-quantum cryptography standards finalised in August 2024:
BMIC implements ERC-4337 account abstraction, which decouples signing keys from wallet addresses. Users can rotate to new post-quantum keys without changing their wallet address — eliminating the "migration race" problem that UTXO-based chains like Decred face when a CRQC arrives. Decred holders would need to move funds to new PQC addresses before a CRQC derives their private keys; BMIC users face no such race condition.
| Feature | BMIC | Decred (DCR) |
|---|---|---|
| Transaction signatures | ML-DSA (FIPS 204) — lattice-based Quantum Safe | secp256k1 ECDSA Vulnerable |
| PoS / consensus layer signatures | ML-DSA (FIPS 204) Quantum Safe | Schnorr over secp256k1 Vulnerable |
| Governance / auxiliary keys | ML-DSA (FIPS 204) Quantum Safe | Curve25519 EdDSA (Politeia) Vulnerable |
| Key encapsulation | ML-KEM (FIPS 203) Quantum Safe | Curve25519 ECDH (CoinShuffle++) Vulnerable |
| Hash-based signature fallback | SLH-DSA (FIPS 205) Quantum Safe | None N/A |
| NIST FIPS 203/204/205 compliance | All three standards implemented Compliant | None Non-compliant |
| PoS ticket collateral quantum risk | No PoS ticket lockup N/A | 40–60k tickets with known public keys on-chain High Risk |
| HNDL corpus (years of exposed keys) | PQC from genesis — no ECDLP exposure None | 10+ years (Feb 2016 – present) 10 Years |
| Key rotation without address change | ERC-4337 account abstraction Supported | Not supported — address = public key hash Not Supported |
| NSM-10 / CISA institutional compliance | Aligned with 2035 mandate Aligned | No roadmap published Non-compliant |
| PQC migration roadmap published | Native — no migration needed N/A | None as of Aug 2026 None |
| Hybrid PoW/PoS architecture | ERC-4337 AA, no PoW N/A | Hybrid — PoW (BLAKE3) + PoS tickets Classical Only |
US National Security Memorandum 10 (NSM-10, 2022) mandates that all federal systems migrate to NIST-approved post-quantum cryptography by 2035. CISA, NSA, and the UK NCSC have all issued advisories recommending organisations begin PQC migration planning now, with a stated preference for NIST FIPS 203/204/205 as the baseline standards.
For institutional investors, custodians, and regulated entities considering DCR exposure: holding an asset whose cryptographic scheme has no published PQC migration roadmap creates compliance risk relative to the 2035 NSM-10 deadline. Any custodian or asset manager that cannot demonstrate migration to NIST PQC standards by 2035 faces regulatory scrutiny under frameworks that incorporate NSM-10 or equivalent national mandates.
BMIC implements NIST FIPS 203/204/205 natively — aligning with the NSM-10 mandate from genesis, with no migration execution risk.
BMIC is the only presale token implementing all three NIST post-quantum cryptography standards: FIPS 203, FIPS 204, and FIPS 205. TGE Q2 2026. Presale live now — price rises each phase.
Buy BMIC at bmic.ai →DYOR. Not financial advice. Presale involves risk.