Scroll is an EVM-equivalent ZK-rollup praised for its EVM fidelity and decentralisation roadmap. But ZK proofs validate computation — they do not protect secp256k1 private keys from Shor's algorithm. Every Scroll component that matters — sequencer, bridge, upgrade authority, prover coordinator, and all SCR holder wallets — relies on the same quantum-vulnerable key primitive as plain Ethereum L1.
✗ WRONG: "Scroll uses zero-knowledge proofs, so it must be quantum-safe."
This is one of the most common and dangerous confusions in the ZK-rollup space. Zero-knowledge proofs are a cryptographic technique for proving that a computation was performed correctly without revealing the inputs. They do not replace, protect, or quantum-harden the signing keys used by wallets, sequencers, bridge admins, and protocol operators.
The threat model for a cryptographically relevant quantum computer (CRQC) running Shor's algorithm is completely separate from ZK proof validity. Shor's algorithm recovers an secp256k1 private key from its corresponding public key — a public key that is broadcast on-chain every time a wallet transacts. ZK circuits and validity proofs are irrelevant to this attack; the harvest happens at the key layer, before any proof is generated.
✓ RIGHT: ZK proofs guarantee computational integrity. They do not protect secp256k1 private keys. Scroll's sequencer, bridge multisig, upgrade authority, prover coordinator, and all SCR holder wallets are Shor-vulnerable — identical in key-security posture to plain Ethereum L1.
📌 Scroll's EVM equivalence is precisely the problem. Because Scroll is byte-for-byte EVM-equivalent, it inherits all Ethereum L1 secp256k1 assumptions — including every wallet address format, ECDSA signing scheme, and key derivation path. A CRQC does not need to understand ZK circuits; it only needs to run Shor's algorithm on archived secp256k1 public keys.
Understanding Scroll's quantum exposure requires understanding which cryptographic primitives each component actually uses — and which are relevant to CRQC attack surfaces.
Scroll posts transaction batches and ZK validity proofs to Ethereum L1 via contracts controlled by secp256k1 keys. The rollup contract itself is upgradeable via a proxy authority key — secp256k1 throughout.
The Scroll sequencer aggregates L2 transactions, orders them into batches, and submits compressed calldata to Ethereum L1. The sequencer operator signs every batch with a secp256k1 key — every batch submission is an archived public-key exposure event.
Scroll uses a ZK prover network with a coordinator that assigns proof tasks and aggregates results. The coordinator's secp256k1 signing key is a critical operational key — not protected by the ZK proofs it coordinates.
The Scroll canonical bridge holds all ETH and ERC-20 assets locked from Ethereum L1. The bridge is governed by a multisig — each signer holds a secp256k1 key. CRQC recovery of a threshold of signer keys enables full bridge drain.
Scroll protocol contracts — including the rollup verifier, sequencer registry, and bridge — are upgradeable via OpenZeppelin Transparent Proxy. The upgrade authority (an EOA or multisig) relies on secp256k1. Recovery enables silent malicious redeployment.
The October 2024 SCR airdrop distributed tokens to tens of thousands of eligible addresses. Every recipient who signed a claim transaction exposed a secp256k1 public key that is now permanently archived for harvest-now, decrypt-later targeting.
Each surface below represents a secp256k1 key (or set of keys) that a CRQC running Shor's algorithm could compromise. Severity ratings reflect blast radius and HNDL archive depth.
Every batch submission to Ethereum L1 is signed by the Scroll sequencer's secp256k1 key. The full history of batch submission transactions creates an on-chain archive. CRQC recovery → batch forgery, transaction reordering, selective censorship, fee redirection, and the ability to produce fraudulent state roots before ZK fraud-proof windows expire.
The Scroll canonical bridge is the primary asset custody layer, holding ETH and ERC-20 tokens bridged from L1. Multisig governance means each signer's secp256k1 key is individually archived. CRQC recovery of a signing threshold → complete drain of bridge liquidity, affecting every user with bridged assets on Scroll.
Scroll's rollup verifier, batch inbox, bridge, and sequencer registry contracts are upgradeable. The upgrade authority (EOA or multisig) uses secp256k1. Recovery → silent replacement of any protocol contract with a malicious implementation: custom withdrawal logic, fee extraction, ZK proof bypass, or selective user blacklisting.
The October 2024 SCR airdrop created a large, datable archive of secp256k1 public key exposures. The most valuable targets: largest airdrop recipients (highest SCR holdings), earliest claim transactions (longest harvest window), and wallets that subsequently moved SCR on-chain (additional signing events, additional HNDL depth).
Scroll's proof coordination layer assigns proving tasks across the prover network and aggregates ZK proofs before they are submitted to L1. The coordinator's secp256k1 key is an operational signing key. Recovery → disruption of proof generation, proof substitution (if coordinator controls proof acceptance), or denial-of-service to the proof submission pipeline.
EVM equivalence means every Scroll address is an secp256k1 address. Every transaction a user has ever sent on Scroll — including DeFi interactions, NFT mints, bridge operations, and SCR staking — has broadcast a public key to the permanent on-chain record. CRQC → recovery of all transacting wallet private keys.
Scroll's EVM equivalence attracted a range of DeFi protocols. Each protocol's deployer wallet, admin multisig, and fee recipient key uses secp256k1. These deployer keys represent upgrade authority over all protocol contracts deployed on Scroll — TVL control, fee parameter manipulation, and liquidity extraction vectors for each protocol.
Ethereum L1 has no finalised secp256k1 → PQC migration EIP as of September 2026. Scroll's EVM equivalence locks it to Ethereum's key model. ZK circuit redesign for post-quantum signatures is an unsolved research problem. All existing SCR holder wallets require voluntary re-keying with no forced migration authority. Accumulated HNDL archive grows irreversibly until all four blockers are resolved.
Harvest-now, decrypt-later is not a future hypothetical — it is an active archival strategy. The cascade below describes the exploitation sequence once a CRQC becomes available.
Scroll's migration blockers are structural — not a matter of engineering effort alone.
| Blocker | Why It Applies to Scroll | Status (Sep 2026) |
|---|---|---|
| Ethereum L1 EIP for secp256k1 → PQC migrationUpstream | Scroll settles on Ethereum L1. Wallet migration requires L1 account abstraction + PQC signature support. No finalised EIP as of September 2026. | No final EIP |
| EVM equivalence constraintArchitectural | Scroll's core value proposition is byte-for-byte EVM equivalence. Departing from secp256k1 breaks compatibility with existing Ethereum tooling, wallets, and dApps — undermining Scroll's market position. | Structural conflict |
| SCR holder voluntary re-keyingCoordination | Even if a migration mechanism were designed, all existing SCR holders must voluntarily move to new PQC wallets. There is no forced migration authority. Historical HNDL-archived public keys remain exploitable after migration unless wallets are emptied before CRQC availability. | No forced authority |
| ZK circuit redesign for PQC signaturesResearch | Scroll's ZK circuits are optimised for secp256k1 ECDSA verification. Redesigning circuits to verify ML-DSA (Dilithium) or other NIST PQC signatures is an active research problem with no production-ready solution as of September 2026. | Unsolved research |
This analysis focuses on quantum cryptographic risk. Scroll has real technical merits that its community and ecosystem value.
Scroll achieves byte-for-byte EVM equivalence — existing Ethereum smart contracts deploy without modification, giving developers the broadest compatibility of any ZK-rollup.
Scroll targets the most rigorous ZK-EVM type classification — proving Ethereum blocks directly rather than EVM-compatible but modified execution environments.
Scroll's codebase is fully open-source and developed with significant community involvement, including academic partnerships with major research institutions.
Scroll has a credible sequencer decentralisation roadmap — moving from a single sequencer to a distributed network — as part of its long-term scaling architecture.
Scroll attracted a range of DeFi protocols post-mainnet, offering users access to DEXs, lending, and yield strategies with Ethereum-level security guarantees for computational validity.
Scroll's public research on zkEVM circuit design, proof aggregation, and prover efficiency has contributed meaningfully to the broader Ethereum ZK-rollup ecosystem.
| Dimension | Scroll (SCR) | BMIC |
|---|---|---|
| Signing primitive | secp256k1 ECDSA (Shor-vulnerable) | ML-DSA / CRYSTALS-Dilithium (NIST FIPS 204) |
| Key encapsulation | secp256k1 ECDH / EVM account model | ML-KEM / CRYSTALS-Kyber (NIST FIPS 203) |
| Post-quantum standard | None (ZK proofs ≠ PQC) | NIST FIPS 203/204/205 |
| HNDL exposure | Yes — all wallets, sequencer, bridge, deployers | Designed to resist HNDL attacks |
| Sequencer key risk | Critical — secp256k1, batch-submission archive | Not applicable — different architecture |
| Bridge custody quantum risk | Critical — full liquidity at secp256k1 multisig | Not applicable |
| Upgrade proxy quantum risk | Critical — proxy authority is secp256k1 | Not applicable |
| ZK proofs | Yes — computational validity proofs | N/A (different security model) |
| EVM equivalence | Yes — byte-for-byte EVM compatible | ERC-4337 account abstraction |
| Token launch status | Live (SCR, Oct 2024) | Presale (TGE Q4 2026) |
| Migration path to PQC | Blocked (4 structural blockers) | Built on PQC from inception |
| Price | Market price (volatile) | $0.0528542 presale entry (phase-stepped) |
No. Zero-knowledge proofs verify computational correctness — they do not protect the secp256k1 private keys used to sign transactions. A CRQC running Shor's algorithm recovers private keys from public keys archived on-chain. ZK validity proofs are irrelevant to this threat; the harvest happens at the key layer, before any proof is generated.
Adversaries archive secp256k1 public keys from on-chain transactions today. When a CRQC becomes available, Shor's algorithm derives the private key from any recorded public key. Every address that has ever transacted on Scroll — including SCR airdrop recipients, DeFi users, sequencer operators, and bridge administrators — has an archived public key in the HNDL queue.
Scroll's sequencer orders, compresses, and submits transaction batches to Ethereum L1. Every batch submission is signed with a secp256k1 key that is broadcast on-chain. CRQC recovery → batch forgery, transaction reordering, selective censorship, fee redirection, and the ability to produce fraudulent state roots.
The October 2024 SCR airdrop distributed tokens to tens of thousands of eligible addresses. Every recipient who signed a claim transaction exposed a secp256k1 public key now permanently archived. CRQC priority targets include the largest airdrop recipients and wallets with the longest public-key exposure window.
Migration faces four structural blockers: no finalised Ethereum L1 EIP for secp256k1 → PQC migration, EVM equivalence architectural constraint, the need for voluntary SCR holder re-keying with no forced authority, and the unsolved problem of redesigning ZK circuits for PQC signature verification.
BMIC ships NIST FIPS 203 (ML-KEM / Kyber) for key encapsulation and NIST FIPS 204 (ML-DSA / Dilithium) for digital signatures — both standardised post-quantum primitives that resist Shor's algorithm. Scroll and all current EVM chains rely on secp256k1. BMIC's architecture was designed post-NIST standardisation; Scroll was designed for EVM equivalence, not post-quantum safety.
No. Scroll is a serious ZK-EVM project with strong technical merits, an active community, and a credible decentralisation roadmap. This analysis identifies a specific, structural cryptographic risk that affects all secp256k1-based chains — not a flaw unique to Scroll's design. The quantum security gap applies equally to Ethereum L1 and every EVM chain that inherits its key model.
Visit bmic.ai for the full technical specification, NIST FIPS standards documentation, and presale details. All investment decisions should follow independent research. This page is educational analysis, not financial advice.
ZK proofs validate computation. NIST FIPS 203/204/205 protects the keys. BMIC was built post-standardisation — for a world where quantum computers are a real threat model, not a distant hypothetical.
Learn More at bmic.ai →