BMIC vs Verge (XVG) 2026
Tor Routing Is Not Quantum Protection

The Core Issue in One Paragraph

Verge (XVG) is a privacy-oriented Bitcoin fork that uses Tor and I2P routing (the Wraith Protocol) plus dual-key stealth addresses to obscure the source IP and on-chain transaction graph. Every XVG transaction is nonetheless signed with secp256k1 ECDSA — the same elliptic curve digital signature scheme used by Bitcoin. Shor's algorithm, running on a cryptographically relevant quantum computer (CRQC), recovers a secp256k1 private key from its public key in polynomial time. Tor does not encrypt private keys; it routes TCP packets. The two layers operate in entirely different domains: Tor is a network-layer privacy tool; ECDSA operates at the cryptographic layer. A CRQC attacker does not observe a Verge transaction in transit — they read public keys directly from the publicly accessible Verge blockchain and run Shor's algorithm offline. Verge's 12-year blockchain (October 2014 genesis) represents a fully harvestable HNDL corpus.

Verge's Three-Layer Cryptographic Stack

Verge's privacy features are built as three stacked layers. Each layer serves a different purpose — and each has a different relationship to quantum computing risk. Understanding the distinction is critical to correctly evaluating XVG's quantum exposure.

Multi-Algorithm Proof of Work

Verge secures its blockchain via five PoW algorithms running in parallel: Lyra2REv3, Scrypt, X17, Groestl, and Blake2s. This design provides ASIC diversification and resistance to 51% attacks from single-algorithm miners. It has no bearing on quantum security for the following reason:

• PoW hash functions are separate from transaction signing. Owning hash power does not give access to wallet private keys.
• Grover's algorithm provides a quadratic speedup against hash functions, roughly halving their effective security (e.g., SHA-256 256-bit → ~128-bit effective against quantum). This weakens mining economics but does not break ECDSA signing.
• The existential quantum threat to Verge comes from Shor's algorithm breaking secp256k1 ECDSA — not from Grover's algorithm against PoW hashes.
• No combination of classical hash algorithms in a PoW system compensates for secp256k1 ECDSA vulnerability at the transaction signing layer.

Three Critical Misconceptions Addressed

Dual-Key Stealth Address Quantum Anatomy

Verge's stealth address system (part of the Wraith Protocol) implements a dual-key stealth address protocol where each recipient publishes a scan public key (S = sG) and a spend public key (B = bG), both on secp256k1. Here is the quantum vulnerability at each step:

Step 1 — Sender derives one-time address

Sender generates ephemeral key pair (r, R = rG). Sender computes shared secret: c = H(r·S) = H(r·sG). This is secp256k1 scalar multiplication — an ECDH operation. Quantum attack: CRQC recovers scan private key s from scan public key S via Shor's ECDLP. This yields the shared secret c for any observed ephemeral key R.

Step 2 — One-time address derivation

One-time address: P = B + H(c)·G. The spend public key B and the point H(c)·G are both secp256k1 points. Quantum attack: once c is known (from Step 1) and spend private key b is recovered from B via Shor's ECDLP, the attacker derives the one-time spend private key: p = b + H(c).

Step 3 — Spending a stealth output

The output is spent by signing with spend key p (secp256k1 ECDSA). The signature reveals the one-time public key P on-chain. Quantum attack: even without the sender-receiver ECDH derivation, a CRQC recovers p directly from the on-chain public key P — the same ECDLP as any other secp256k1 address.

Verge HNDL Timeline: 12 Years of Harvestable Data

"Harvest Now, Decrypt Later" (HNDL) is the adversarial strategy of archiving encrypted or signed data today for decryption once a CRQC becomes available. Every secp256k1 public key ever broadcast on the Verge blockchain — from genesis to today — is harvestable and permanently vulnerable to future CRQC attack.

Four-Step CRQC Attack Against Verge

A state actor operating a CRQC would follow this sequence to drain Verge wallets — without any Tor interception required:

1. Harvest public keys from the Verge blockchain. Every secp256k1 public key ever published in a Verge transaction is permanently on-chain. No network interception is needed — the blockchain is public. This includes both standard P2PKH spend public keys and stealth address one-time public keys revealed at spend time. The entire 12-year corpus (2014–2026) is archived.
2. Run Shor's algorithm. For each target secp256k1 public key Q = kG, the CRQC solves the ECDLP to recover private key k. This takes polynomial quantum time — estimated hours to days per key depending on CRQC clock speed and error correction. The attacker prioritises high-value wallets (large UTXO outputs).
3. Derive stealth key pairs (if targeting stealth outputs). For stealth-protected outputs: recover scan private key s from scan public key S via Shor's. Compute shared secret c = H(R·s) for any observed ephemeral R. Recover spend private key b from spend public key B via Shor's. Compute one-time spend key p = b + H(c). The classical privacy guarantee of stealth addresses is nullified.
4. Construct and broadcast signed transactions. Using the recovered private key(s), the attacker signs valid Verge transactions draining target UTXOs. These transactions are valid secp256k1 signatures — the Verge network accepts them. The transactions may be broadcast via Tor (the attacker has no IP concealment problem — the victim's IP privacy is irrelevant at this stage).

Technical Comparison: BMIC vs Verge (XVG)

Can Verge Migrate to Post-Quantum Cryptography?

Verge's PQC migration is theoretically possible but structurally complex across all three layers of its privacy stack. As of August 2026, Verge Core has published no migration proposal for any layer.

Layer 1 — secp256k1 ECDSA transaction signing

Migrating from secp256k1 ECDSA to ML-DSA (CRYSTALS-Dilithium, NIST FIPS 204) requires a hard fork introducing a new address format and signature type. This is technically feasible — similar to Bitcoin's transition from P2PKH to SegWit. Key challenges: (a) a migration race condition exists where old secp256k1 addresses remain vulnerable until swept, and funds in dormant addresses can be drained by a CRQC before their owner migrates; (b) ML-DSA signatures are ~2.4 KB versus secp256k1 ECDSA at ~72 bytes — a 33× size increase that increases blockchain bloat; (c) Verge's lower hashrate and smaller developer community make coordinating a hard fork more difficult than for higher-cap chains.

Layer 2 — Stealth address ECDH (Wraith Protocol)

The dual-key stealth address protocol relies fundamentally on secp256k1 ECDH: the shared secret derivation c = H(r·S) uses elliptic curve scalar multiplication. NIST PQC does not include an ECDH-equivalent — ML-KEM (CRYSTALS-Kyber, FIPS 203) is the nearest substitute, providing key encapsulation rather than key agreement. The entire stealth address derivation scheme must be redesigned around ML-KEM-based key encapsulation. The one-time address derivation formula P = B + H(c)·G has no lattice equivalent — this is not a parameter swap but a protocol redesign. All existing stealth address outputs on the chain use the secp256k1 scheme and remain permanently vulnerable.

Layer 3 — Network routing (Tor / I2P)

Tor and I2P themselves use classical cryptography (Curve25519 ECDH, Ed25519 signatures internally), but these are transport-layer concerns. Replacing them is outside Verge Core's scope — the Tor Project is a separate organization with its own migration timeline. Verge's use of Tor for transaction routing is a configuration choice; it does not require Verge to maintain Tor's internals. However, organisations relying on Verge for private transactions should note that the Tor transport layer also has its own quantum vulnerability independent of XVG's transaction signing.

How BMIC Addresses the Quantum Threat Verge Cannot

BMIC is a quantum-safe cryptocurrency presale built on three NIST post-quantum cryptography standards ratified in August 2024. It was designed from the ground up for the post-quantum threat environment — not retrofitted onto an elliptic curve foundation built in 2014.

NIST FIPS 203 — ML-KEM (CRYSTALS-Kyber)

ML-KEM replaces ECDH-based key agreement. It provides IND-CCA2-secure key encapsulation based on the Module Learning With Errors (MLWE) problem. No efficient quantum algorithm is known for MLWE. BMIC uses ML-KEM for vault encryption key wrapping — the function that Verge attempts with secp256k1 ECDH in stealth address derivation.

NIST FIPS 204 — ML-DSA (CRYSTALS-Dilithium)

ML-DSA replaces secp256k1 ECDSA for all transaction signing. Based on MLWE and the Short Integer Solution (SIS) problem — no efficient quantum algorithm known. A CRQC running Shor's algorithm cannot recover an ML-DSA private key from its public key. This is the direct replacement for the secp256k1 ECDSA that signs every Verge transaction.

NIST FIPS 205 — SLH-DSA (SPHINCS+)

SLH-DSA provides stateless hash-based signatures as a conservative fallback. Its security reduces to the one-way-ness of a hash function — no lattice assumptions required. Even if ML-DSA's lattice assumptions were somehow broken, SLH-DSA provides a second layer of defence grounded in a fundamentally different mathematical basis.

ERC-4337 Account Abstraction — Key Rotation

BMIC's ERC-4337 account abstraction layer allows quantum-safe key rotation without changing the wallet address. This eliminates the migration race condition that threatens Bitcoin-derived chains like Verge: on those chains, a user migrating from secp256k1 to a PQC scheme must create a new address, and their old address (with its public key permanently on-chain) remains vulnerable for any funds not yet swept. BMIC users can rotate keys in place.

Frequently Asked Questions

More Quantum Security Comparisons

Continue your research with our complete series of BMIC vs competitor quantum analyses: