NEO launched in October 2016 using secp256r1 (NIST P-256) — a classical upgrade from secp256k1 with better parameter provenance. But P-256 relies on ECDLP, which Shor's algorithm breaks identically to all other elliptic curves. A decade of dBFT block signatures and contract invocations sits archived. BMIC ships NIST FIPS 203/204/205 from day one.
Get BMIC — Quantum-Safe from Day One →| Criterion | BMIC | NEO |
|---|---|---|
| Signature scheme | ML-DSA (FIPS 204 / Dilithium) | secp256r1 (P-256) ECDSA primary; secp256k1 legacy |
| NIST FIPS PQC standard | FIPS 203 + 204 + 205 ✅ | None deployed on mainnet ❌ |
| Quantum threat to wallets | None (lattice-based, no ECDLP) | Critical — secp256r1 P-256 ECDLP broken by Shor's algorithm |
| Consensus node key exposure | Not applicable | dBFT consensus: all validator (Council) P-256 keys published on-chain |
| HNDL archive since | N/A (PQC) | October 2016 (NEO mainnet) — 10 years |
| Smart contract risk | ML-KEM/DSA protected | NeoVM contract auth via P-256 — CRQC forgeable |
| PQC roadmap | Deployed at launch | No public PQC mainnet deployment plan as of Oct 2026 |
| Token standard | ERC-4337 (Ethereum) | NEP-11 / NEP-17 (NeoVM) |
NEO uses secp256r1 (NIST P-256) as its primary curve — different from the secp256k1 curve used by Bitcoin and Ethereum, but equally broken by Shor's algorithm. P-256 is an elliptic curve defined over a 256-bit prime field; its security rests entirely on the ECDLP hardness of the P-256 group. Shor's algorithm targets the algebraic structure of all elliptic-curve groups — the specific curve parameters are irrelevant to the quantum adversary.
NEO mainnet launched in October 2016. Ten years of P-256 transaction signatures, dBFT block signatures, and NeoVM contract invocations are permanently archived across all full nodes globally. This is one of the longest HNDL archives among smart-contract-capable chains, predating Ethereum's own mainnet by over a year in quantum-archivable material.
NEO's delegated Byzantine Fault Tolerant (dBFT) consensus requires Council members (formerly "Consensus Nodes") to sign each block with their P-256 keys. Council member keys are registered on-chain and are a matter of public record. A CRQC adversary recovering Council private keys from the archived block signatures can forge valid consensus messages — enabling block censorship, transaction ordering manipulation, or double-spend attacks if sufficient Council members are compromised.
NeoVM smart contracts frequently use signature verification as an access-control mechanism. Contract admin keys, multi-party signature thresholds, and Oracle request authorisations all rely on P-256 signatures. When the underlying P-256 keys become recoverable via CRQC, the NeoVM signature check passes for forged signatures — authorising arbitrary state transitions and asset withdrawals from contract-locked balances.
In early NEO documentation and community discussions, the project was sometimes positioned as more quantum-aware than Bitcoin due to its use of NIST P-256 rather than secp256k1. This claim conflates NIST's recommendation of P-256 for classical security (it has better parameter provenance than secp256k1) with quantum resistance. P-256 provides zero quantum resistance — Shor's algorithm applies identically to all elliptic curves.
Module Lattice Key Encapsulation. No elliptic-curve structure. No known quantum attack.
Module Lattice Digital Signature. Replaces P-256/secp256k1 for all BMIC signing. MLWE-based.
Stateless Hash-Based Signature. Hash-function-only — no algebraic structure for quantum exploitation.
No. NEO uses secp256r1 (P-256) — a NIST-recommended elliptic curve for classical security, but broken by Shor's algorithm on a CRQC. Its 10-year HNDL archive is one of the longest in smart-contract blockchain history. No NIST-aligned post-quantum primitive has been deployed to NEO mainnet as of October 2026.
No. NIST recommends P-256 for classical security due to its transparent parameter generation (unlike secp256k1). This is unrelated to quantum resistance. NIST's post-quantum standards (FIPS 203/204/205) are entirely different primitives — lattice and hash-based — and are what BMIC implements.
BMIC deploys NIST FIPS 203/204/205 — no ECDLP dependency, no known quantum attack — from day one. NEO deploys P-256 ECDSA with a 10-year archive. Visit bmic.ai for presale details. DYOR.