Yuvi Lightman | Quantus

@YuviLightman

12h

Willy Woo

@willywoo

15h

Anyone saying BTC goes to zero on Q-Day demonstrates they know nothing about BTC.

It’ll be a buying opportunity of a lifetime taking the other side of the trade.

Yuvi Lightman | Quantus

@YuviLightman

Oct 24

Jake Mintz

@jakemintz

Oct 23

@Suhailard several OAI people say there are unfixable bugs in hardware that are exploitable by AI models directly speaking machine code so even if we could solve software that’s not enough. We need defense to move faster than offense if that’s even possible we may just have a new normal that requires adapting to insecure software (bank transfers require going into a branch and taking a dna test 🤣😬)

Yuvi Lightman | Quantus

@YuviLightman

Oct 23

Bala 🧤

@BalaiBB

Oct 22

they’re calling it “Black October” and i don’t think people realize how serious this is

in the last 48 hours there have been over 27 major cybersecurity incidents. not in a month. not in a week. in 48 hours

any ONE of these would normally be the biggest story of the year

PHP: critical vulnerability in the software running 80% of the web. severity 9.2 out of 10

Node.js: high-severity flaw letting attackers take over servers remotely. affects versions 22, 24, and 26

Java: also compromised. three of the most used programming languages on earth hit at the same time

GitLab: a perfect 10 out of 10 severity hole in every version since 2014

Railway: hosting platform compromised. API keys for OpenAI, Claude, Stripe potentially exposed

Signal: a bug that could leave your mic and camera on after you hang up

WordPress: hackers stole a plugin maker’s keys and planted backdoors on websites

LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer

and that’s not even half the list

thousands of AI agent swarms are reportedly scanning and attacking vulnerable servers right now. automated. around the clock

security researchers are saying this might be the early stages of a global cyber incident that nobody fully understands yet

if you run a website, use cloud services, store API keys on hosting platforms, or use any software built on PHP, Node.js, or Java you are potentially affected

update everything. rotate your API keys. change your passwords on critical services. enable 2FA everywhere you haven’t already

this is not a normal week on the internet. this is something different

Yuvi Lightman | Quantus

@YuviLightman

Oct 23

Numo@NumoPayApp

Feb 24

Tap. Beep. Done.

Bitcoin's first tap to pay solution is here.

Free and open source.

Privacy by default.

Meet Numo.

Yuvi Lightman | Quantus

@YuviLightman

Oct 23

Proton

@ProtonPrivacy

24 Oct 2023

You may have heard quantum computers will break encryption. That’s a long way off, but Proton is mitigating this risk.

And the difference with our approach is that we’re implementing post-quantum protection for PGP in open collaboration with the community and experts, enabling the standard. It’s post-quantum cryptography for the many, not just the few: proton.me/blog/post-quan…. (1/3)

Yuvi Lightman | Quantus

@YuviLightman

Oct 23

QuantumAnalysis

@Qtumanalysis

Aug 31

IN FOUR MONTHS, THE NSA STOPS BUYING ANYTHING THAT RUNS ON TODAY'S ENCRYPTION.

THE REASON IS QUANTUM COMPUTERS.

This is not a proposal, but a published directive with a date.

It's called CNSA 2.0, the NSA issued it in 2022, tightened it in 2025, and almost nobody outside the quietly orders every national security system in America to abandon the encryption the entire internet runs on, because a large enough quantum computer breaks all of it, and the NSA has decided that machine is coming.

The schedule:

January 1, 2027: every new system the government buys for classified or sensitive work must use quantum resistant encryption.

2030: all network equipment and software signing must run quantum resistant only. Legacy gear that can't be upgraded gets ripped out.

2033: operating systems, applications, cloud. Everything.

2035: full quantum resistance across all national security systems. Hard stop.

The NSA gave the EARLIEST deadlines to two categories, signed software and network traffic. Their stated reason: those are most exposed to harvest-now-decrypt-later, adversaries recording encrypted data today to crack it once the quantum computer exists.

Defense systems take 18 to 36 months to build. Anything designed today ships after the deadline. For much of the government, the planning window already closed.

Meanwhile your bank, your hospital, and the app you're reading this on run the exact algorithms the NSA is abandoning.

$INFQ $IONQ $QBTS $RGTI

Yuvi Lightman | Quantus

@YuviLightman

Oct 23

QuantumAnalysis

@Qtumanalysis

Oct 22

NORTH KOREA’S HACKERS ARE ALREADY USING AMERICA’S QUANTUM-PROOF ENCRYPTION STANDARD

Kaspersky just exposed a new campaign by Lazarus, North Korea’s state hacking group. Its malware uses ML-KEM-1024, the post-quantum encryption standard NIST published in August 2024, to lock down the hackers’ servers.

Kaspersky says Lazarus has been using post-quantum crypto since at least September 2024. That’s about a month after the US finalized the standard.

Why would hackers bother? Security teams catch malware partly by recording and studying its traffic. If that traffic is quantum proof, even a future quantum computer can’t open it up later.

The attack itself was fake résumé and portfolio websites, likely built with AI, sent to targets through phishing emails. At least three South Korean companies in software, construction and telecom equipment were hit, and Kaspersky believes the real number is much higher.

Governments are giving their own agencies until 2030 to 2035 to switch to post-quantum encryption.

North Korea switched in about a month.

$IONQ $INFQ $BTQ $LAES

Yuvi Lightman | Quantus

@YuviLightman

Oct 23

calle

@callebtc

Oct 22

HelloHotspot

Pay-as-you-go eSIMs from silent.link and VPNs from Obscura, paid from one balance in the app. No email, no contract.

Built on Cashu.

gethellohotspot.com

Yuvi Lightman | Quantus

@YuviLightman

Oct 23

john kutay

@JohnKutay

Oct 21

Rotate your social security number

Yuvi Lightman | Quantus

@YuviLightman

Oct 23

Felipe Montealegre

@TheiaResearch

Oct 19

Please listen to Dan Boneh (top 5 cryptographer alive today) who is known to be measured and judicious in his comments describe the probability that Bitcoin is able to transition to a post-quantum world.

Lots of opinions out there - be careful who you listen to.

Yuvi Lightman | Quantus

@YuviLightman

Oct 22

log4j

@log4j

Oct 21

i own a relatively new (2025) samsung tv.

i kept getting weirdly targeted ads.

i tried reversing the firmware but it was aes encrypted and no keys unless tear it apart and do uart/jtag magic.

zero days it is. root shell on new samsung TVs!

discovered PRIVACY HORROR. write up?

Yuvi Lightman | Quantus

@YuviLightman

Oct 22

Quantus

@QuantusNetwork

Oct 21

SegWit took 20 months. Taproot took almost four years.

There isn’t enough blockspace to migrate everyone in 90 days.

Yuvi Lightman | Quantus

@YuviLightman

Oct 22

Jteve Sobs

@jtevesobs

Oct 21

the sub harmonic blessings of a substrate that loves you for who you are

Yuvi Lightman | Quantus

@YuviLightman

Oct 21

Alex Pruden

@apruden08

Oct 20

The "KYC everyone for everything" situation has gotten totally ridiculous.

Even for non-financial products & use cases, I am having to scan my face and drivers license to get access to things like a Lime scooter, e.g. Before they could give me accounting advice, a Big 4 firm recently asked me to send a photo of my email *attached as a JPEG*.

This expectation creep around personal data sharing already has documented devastating consequences (e.g. financial ruin) at the individual level. It's only going to be a matter of time before personal identity compromise of enough individuals leads to a total collapse of online trust.

Yuvi Lightman | Quantus

@YuviLightman

Oct 21

Arjun Khemani

@arjunkhemani

Oct 20

“Encryption is the peaceful, nonviolent version of the Second Amendment.” — @tyler

Yuvi Lightman | Quantus

@YuviLightman

Oct 21

Justin Thaler

@SuccinctJT

Oct 21

A few reflections on the lattice vs. hash-only debate that our recent Aerie post sparked:

1. Cryptographic ossification for blockchains was never safe. Until the day we know with certainty that P ≠ NP, that finding short vectors in lattices is intractable, that Keccak effectively behaves like a random oracle in deployed SNARKs, and that every single bug has been eliminated from our codebases, blockchains cannot ossify. That is simply not how safe systems are built. Issues will arise, and the system will have to respond.

It’s a double standard to reject lattices because blockchains are hard to upgrade if lattices break, while counting on upgrades if AI breaks your hash function or finds a critical zkVM bug.

The best counterargument is that hash-only designs are more agile: if your hash function breaks, just swap out the hash. But we must aspire to a higher level of agility than this. Indeed, as I cover next, if SNARK recursion itself turns out to degrade security, the proposed hash-only blockchain designs would need to be rethought from the ground up.

2. The real security debate is not lattices vs. hashes — it is lattices vs. building everything on SNARK recursion. That’s because “hash-only” is not really hash-only: it rests on hashes plus the soundness of deep SNARK recursion. Ethereum’s roadmap relies on exactly that: hash-based aggregation needs recursion to keep up with a slot’s worth of signatures, and EIP-8288 would send other signature schemes and users’ own proofs through the same recursive pipeline. In contrast, Aerie proves a slot’s worth of signatures on one laptop without any recursion.

All deployed post-quantum SNARKs rely on the Random Oracle Methodology (via Fiat–Shamir) to establish their security. This is an idealization we know fails in the real world: we have explicit counterexamples where “SNARKs” coming out of this methodology are totally insecure when instantiated with any concrete hash function.

We generally ignore these counterexamples in part because they only arise when proving contrived, self-referential statements about the very hash function used by the SNARK verifier.

But proving statements about the verifier’s own hash function is the exact thing you do in SNARK recursion. That’s why the security of recursive SNARKs can’t be established even in the random oracle model.

On top of that, the standard security proofs for recursion (in other models) suffer an “extractor runtime” blowup that is exponential in the recursion depth, suggesting that security may degrade as more recursion is applied. Yet Ethereum’s own EIP-8288 enables unlimited-depth recursion, even as it lists soundness of recursive SNARKs as a trust assumption. Proofs in more idealized models avoid the blowup, but they mainly tell us that an attack on SNARK recursion would have to exploit the concrete hash function, which is exactly what the Fiat–Shamir attacks above do.

To be clear, we don’t know of any outright attacks on SNARK recursion, and I very much hope it is secure. But some of us who have studied the question have a lingering sense that an attack may be possible in some settings. And if AI is going to supercharge cryptanalysis, there is no reason to expect it to spare Fiat–Shamir for SNARKs, let alone SNARK recursion, both of which have had far less scrutiny than lattices.

So, I do not concede that a “recursion everywhere” hash-only approach is clearly more conservative than one built on standard lattice assumptions.

3. “Just wrap everything in a hash-based SNARK” (like EIP-8288) faces challenges.

Aggregating signatures and proofs off-chain into a single block-level proof is a powerful design independent of the hash-only vs. lattice debate, and I am not telling people to avoid it. But claiming, as Vitalik Buterin did this week, that users can run whatever cryptography they want locally and wrap it in a client-side leanVM proof glosses over major hurdles.
For example, leanVM today is a minimal VM designed almost entirely to prove hash-based signatures and recursion, not general-purpose computation. And binary-field SNARKs like leanVM remain slow at proving the integer multiplications that lattice cryptography does en masse.

I am optimistic that many of these zkVM challenges can be met (including via my own work, binary-field Twist and Shout, which are now implemented in Magnetar). But regardless, if lattices can make aggregation simpler and faster, then they should be leveraged. We need to be agile no matter what.

4. For chains whose reason for existence is privacy, I truly struggle to understand the pushback. Public-key encryption (and fast single-server PIR) cannot be built from hashes alone, at least not in any black-box way. If lattices break, it is going to be very, very hard for these chains to provide acceptable levels of privacy and functionality. For a project whose entire reason for existence is privacy, a loss of confidentiality is an existential failure. Next to that, a second signature upgrade (after the first one, from elliptic curves alone to, hopefully, a hybrid lattice scheme) is easy.

Summary: We don’t know for sure what is secure and what isn’t. We are all weighing unquantifiable risks against each other, and we do not need to agree on a total order on them. But hash-only solutions face many open engineering challenges, and they are not more “conservative” in the way some have argued. Some of those challenges are entirely prosaic and have nothing to do with bugs or cryptography, like hardware support for custom schemes whose hash function is still undecided. I hope we can overcome those challenges within the appropriate timelines, but they must be acknowledged and portrayed realistically.

Overall, cryptographic agility and defense in depth (e.g., hybrid signatures) are the answer, which is why we are building both lattice-Jolt and hash-Jolt. In practice, the positions are less polarized than social media discourse suggests: for example, StarkWare is working to make Falcon verification cheap (falcon.provably.fast), which is great to see.

Here is the (apparently) controversial take I am sticking to: Conditioned on agility, whenever lattices make systems simpler or more functional, we should embrace them rather than default to “hash-only” designs. Lattices are what the rest of the world will depend on, with decades of study and hardening behind them, and at the system level, less functional often means less secure. Where hash-only designs are just as simple and functional, by all means use them.