Grin hides transaction amounts and removes addresses — but the underlying secp256k1 Pedersen commitments and Bulletproofs are broken by Shor's algorithm. Privacy is not post-quantum security.
Grin's MimbleWimble protocol is one of the most technically sophisticated privacy constructions in crypto. It eliminates explicit addresses, hides transaction amounts using Pedersen commitments, and compresses the blockchain by cutting through spent outputs. This has led to a widespread assumption: that MimbleWimble's privacy properties also confer quantum resistance.
Critical distinction: Privacy hides information from classical observers. Quantum resistance means the underlying mathematical problem cannot be solved efficiently by a quantum computer. These are independent properties. MimbleWimble achieves the former but not the latter.
Every output on the Grin blockchain is a Pedersen commitment of the form C = r·G + v·H, where r is the blinding factor (the "private key"), v is the value, G and H are secp256k1 generator points. Shor's algorithm running on a cryptographically relevant quantum computer (CRQC) can recover r from the public commitment C. Once r is known, the attacker can forge a valid Schnorr spending signature — also over secp256k1 — and steal the output.
The classical privacy property (hiding v and the transaction graph) is irrelevant to this attack. A CRQC is solving for r, not trying to read the transaction amount.
Every Grin output is a Pedersen commitment C = r·G + v·H over secp256k1. The blinding factor r is a 256-bit scalar — functionally a private key on the secp256k1 curve. Ownership of an output is equivalent to knowledge of r. Shor's algorithm solves the ECDLP on secp256k1 in polynomial time, recovering r from the public commitment. Every unspent Grin output is therefore attackable by a CRQC.
Quantum verdict: VULNERABLE — secp256k1 Pedersen blinding factors are broken by Shor's algorithm.
Grin transaction kernels are signed with Schnorr signatures over secp256k1. Each kernel contains an excess commitment (the net blinding factor difference between outputs and inputs) and a Schnorr signature proving knowledge of the corresponding private key. This signature scheme uses the same secp256k1 ECDLP hardness assumption as the Pedersen commitments — and is equally broken by Shor's algorithm.
Quantum verdict: VULNERABLE — Schnorr kernel signatures over secp256k1 are broken by Shor's algorithm.
Grin uses Bulletproofs — a non-interactive zero-knowledge range proof scheme — to prove that committed values fall within [0, 264) without revealing the value. Bulletproofs are constructed using an inner-product argument whose security reduces to the discrete logarithm problem on secp256k1 (via the Fiat-Shamir heuristic). They prevent inflation attacks (no negative coin creation) but provide no post-quantum protection. A CRQC can solve the DLP in the Bulletproof verification equations just as it does for the commitment blinding factors.
Quantum verdict: VULNERABLE — Bulletproof security reduces to secp256k1 DLP, which Shor's algorithm solves.
Unlike Bitcoin, Grin transactions require sender and receiver to interact. The Slatepack protocol exchanges partial transaction data including partial Schnorr signatures, public nonces, and public excess values — all secp256k1 curve points. These values are ephemeral but may be logged in relay nodes, wallet software, or network traffic captures. A state actor performing HNDL on Grin network traffic can collect these ephemeral public values and later use a CRQC to recover the corresponding private scalars, enabling retrospective theft of any transaction whose slate was observed in transit.
Quantum verdict: ADDITIONAL HNDL RISK — Interactive slate construction creates a secondary secp256k1 pubkey leakage surface beyond the blockchain itself.
Every Grin output commitment ever created is a potential CRQC target. A state actor harvesting the Grin blockchain today accumulates a corpus of secp256k1 commitments spanning the entire history of the chain.
Here is the precise four-step process by which a CRQC operator drains a Grin output — including outputs whose transaction amounts were never visible to classical observers:
Harvest the blockchain. Download the Grin UTXO set (output commitments C = r·G + v·H). Each commitment is a secp256k1 curve point. The value v is hidden from classical observers, but the commitment C is public. Store all commitments for future quantum processing.
Apply Shor's algorithm to each commitment. For each target commitment C, run Shor's algorithm to solve the ECDLP on secp256k1: given C and the generator points G and H, recover the blinding factor r. Since the value v appears linearly (v·H), the CRQC can recover both r and v simultaneously by factoring the discrete logarithm across both curve points. The attacker now knows the exact coin value of the "hidden" output — the privacy property is fully broken alongside the security property.
Construct a valid spending transaction. With r known, the attacker constructs a Grin transaction that transfers the output to an attacker-controlled address. They create a kernel with a valid Schnorr signature over secp256k1 using r (or a derived excess blinding factor). The interactive slate construction can be performed locally since the attacker controls r — no cooperation with the victim is required.
Broadcast before detection. Grin has no address system, so there is no "address scanning" that would alert the victim to an attempted theft. The attacker broadcasts the fraudulent transaction. Once confirmed, the output is spent and the funds are permanently transferred. The victim receives no warning — they simply observe their output has been spent by an unknown transaction.
Unique risk: Because MimbleWimble hides amounts classically, the victim does not know the attacker also decrypted the hidden value. Both the security AND privacy properties of MimbleWimble fail simultaneously under a CRQC attack.
One frequently cited Grin property is the absence of explicit receiving addresses. In Bitcoin, static addresses can be scanned to build a target list for CRQC attack — addresses that have received funds but whose keys have never been published reveal nothing until spent. Grin has no equivalent persistent address.
However, this does not materially reduce Grin's quantum attack surface for two reasons:
In Bitcoin, a P2PKH address hashes the public key, so the public key is only revealed when the UTXO is spent. In Grin, the output commitment C = r·G + v·H is directly a secp256k1 curve point from which r can be recovered by a CRQC. The CRQC does not need a "static address" — it needs a public curve point, which is exactly what the Grin UTXO set provides.
MimbleWimble's cut-through removes intermediate spent outputs from the blockchain, but unspent outputs remain permanently. The CRQC target set is the current UTXO set of unspent commitments — which always exists and is always publicly available on any Grin full node.
Conclusion: The "no address" design improves classical privacy and reduces one specific static-pubkey HNDL surface. It does not prevent a CRQC from recovering blinding factors from output commitments. Grin's quantum attack surface is the entire unspent UTXO set.
MimbleWimble's privacy model relies on a specific algebraic property of Pedersen commitments: homomorphism over an elliptic curve group. The identity C(r₁, v₁) + C(r₂, v₂) = C(r₁+r₂, v₁+v₂) allows verifiers to confirm transaction balances without seeing individual values. This homomorphism is what makes cut-through and confidential transactions possible.
NIST PQC lattice standards (ML-KEM, ML-DSA) are defined over module lattice algebraic structures. Lattice-based schemes do not have a natural equivalent of Pedersen commitment homomorphism — the algebraic structure is fundamentally different. Post-quantum Pedersen commitments have been proposed in academic literature (e.g. using lattice-based commitments from Ring-LWE), but:
Migration verdict: A genuine post-quantum Grin would require a fundamentally different cryptographic protocol — not just a parameter swap. The timeline is indeterminate. Existing committed outputs cannot be retroactively protected.
| Property | Grin (GRIN) | BMIC |
|---|---|---|
| Transaction Signature Scheme | Schnorr over secp256k1 Shor-vulnerable | ML-DSA (FIPS 204) NIST PQC |
| Output Commitment Scheme | Pedersen commitments over secp256k1 Shor-vulnerable | ML-KEM (FIPS 203) key encapsulation NIST PQC |
| Range Proof Scheme | Bulletproofs (secp256k1 DLP) Shor-vulnerable | Hash-based / lattice constructions Quantum-resistant |
| Stateless Hash-Based Signatures | None N/A | SLH-DSA / SPHINCS+ (FIPS 205) NIST PQC |
| Interactive Tx Construction | Required (Slatepack) — ephemeral secp256k1 pubkey leakage HNDL risk | ERC-4337 account abstraction — no interactive construction No leak |
| HNDL Corpus | 7+ years (Jan 2019–present) Accumulating | Post-quantum from genesis No legacy exposure |
| Privacy Design | MimbleWimble confidential transactions Classical only | ERC-4337 smart account abstraction Different model |
| Address Model | No addresses (commitment-based) Reduces static HNDL | ERC-4337 smart contract accounts PQC key rotation |
| NIST PQC Standards Implemented | None Zero | FIPS 203, 204, 205 (all three) Full suite |
| PQC Migration Roadmap | Not published (Aug 2026) None | Built-in from architecture Complete |
| Key Rotation Without Address Change | Not available N/A | ERC-4337 key rotation built-in Supported |
| NIST/CISA Compliance Pathway | None identified Non-compliant | FIPS 203/204/205 (NSM-10 aligned) Compliant pathway |
While Grin's MimbleWimble innovations are technically impressive, the underlying secp256k1 Pedersen commitments, Schnorr signatures, and Bulletproofs are all broken by Shor's algorithm. BMIC implements NIST FIPS 203, 204, and 205 — all three post-quantum standards — with ERC-4337 account abstraction for seamless key rotation. No migration required. DYOR before investing.
Learn More at bmic.ai →BMIC is the only presale token built on all three NIST post-quantum cryptography standards. Grin's MimbleWimble is innovative — but secp256k1 Pedersen commitments are not quantum safe. DYOR. Make an informed decision.
Explore BMIC at bmic.ai →