The machine is called Volta B1. It is a quantum annealer, unveiled in Italy with the ceremony usually reserved for a particle accelerator. Within days, a Layer-1 project called DAC published commentary attaching its own consensus design to that event.
Here is the anomaly. An annealer solves combinatorial optimization problems by mapping them onto the energy landscape of superconducting qubits. It does not run Shor's algorithm. It cannot factor a 2048-bit RSA modulus. It cannot recover a secp256k1 private key from a public key. The hardware in the photograph and the threat model in the press release are not the same object.
That gap is the story. Not because quantum risk is fake — it is not, and NIST has already standardized the migration path with CRYSTALS-Kyber and Dilithium. The story is the distance between a genuine long-term threat and a specific product pitch. That distance is where capital goes to die.
DAC positions itself as a quantum-resistant Layer-1 with EVM compatibility, developed by DAC Labs. Its public technical vocabulary consists of three terms: "Proof of Quantum Work," "quantum entropy," and "quantum-resistant first." The only named human is Davide Costa, identified as Innovation Lead. No CEO. No CTO. No chief cryptographer. No repository. No whitepaper. No audit. No TPS. No latency figures. No validator count. No token name.
Set that against projects that have actually shipped post-quantum infrastructure. QRL uses XMSS hash-based signatures and has run a mainnet for years. QANplatform implements NIST-standardized post-quantum signatures with EVM compatibility. Abelian uses lattice constructions and serves an Asia-weighted market. All three can name a signature scheme. All three can point at code.
DAC names none. This is not a minor omission. For a chain whose entire value proposition is cryptographic, the signature scheme is the product. Everything else — the branding, the conference panels, the quantum vocabulary — is packaging around a primitive that has not been disclosed.
The only timestamp in the source material is "2026 Digital Innovation Forum," while the surrounding narrative reads in present tense. Either the copy was assembled from a forward-dated template, or the timeline has been stretched for narrative convenience. Neither is a technical crime. Both are signals about editorial discipline.
The ECDSA contradiction nobody addresses
Ethereum accounts are secp256k1. ecrecover is a precompile. Wallet derivation paths, hardware signers, meta-transaction relayers, Safe multisig modules, EIP-1271 contract signature verification — every layer of the stack assumes ECDSA.
Replace the signature scheme with XMSS or Dilithium and you get a chain that executes EVM bytecode but cannot verify a single Ethereum signature. That is "EVM-compatible" in the same sense a translated novel is the same book. The bytes compile. The identity layer does not port.
The mechanics matter. XMSS is stateful: every signature consumes a one-time key from a Merkle tree, and reuse of a leaf index leaks the private key outright. Managing that state across validators that can restart, fork, or restore from snapshot is a hard distributed systems problem, and it is unsolved in production at scale. Dilithium is stateless but produces signatures around 2.4KB against 65 bytes for ECDSA. That is roughly a 37x calldata expansion — a direct cost multiplier on any rollup that batches these signatures to L1.
So DAC has exactly three options. One: ECDSA at the account layer with post-quantum primitives somewhere else, which leaves the actual attack surface — the account — untouched. Two: post-quantum signatures everywhere, which severs compatibility with the tooling the project cites as its adoption strategy. Three: a dual-signature transitional scheme, which doubles verification cost and manufactures a downgrade surface where an attacker forces the weaker path.
The source material does not say which. That silence is not modesty. This is the single hardest problem in the design, and it is unaddressed.
There is a real solution path, and its absence is telling. Signature aggregation via recursive proofs could amortize the calldata cost of post-quantum signatures — batch a thousand Dilithium signatures, prove the batch, post one proof. ZK-circuits are compressing the future, and anyone genuinely building a post-quantum EVM would be talking about exactly this. DAC is not.
Proof of Quantum Work, read two ways
Take the term literally. Block production requires quantum computation. Then block production is restricted to entities that own quantum hardware — a set numbering in the dozens globally, dominated by corporations and states. That is not decentralized consensus. That is a permissioned consortium wearing a miner's jacket, and it inverts the entire thesis of the product.
Take it charitably. "Quantum entropy" is a QRNG feeding the VRF or nonce derivation. That is real. It is used in key generation and validator selection. It hardens the entropy source against a class of predictability attacks. It is not a new consensus family, and it does not warrant a new acronym.
Both readings are defensible from the text. That is precisely the failure. A consensus mechanism that a technical reader can parse two incompatible ways has not been specified — it has been named.
What the disclosure gap actually looks like
| Project | Signature scheme | Mainnet | Audit disclosed | |---|---|---|---| | DAC | undisclosed | undisclosed | none | | QRL | XMSS | live | yes | | QANplatform | NIST PQC | live | yes | | Abelian | lattice-based | live | yes |
The token column is the same shape. No name, no supply, no allocation, no unlock schedule. For a chain targeting enterprises, that is at least internally consistent: enterprise L1s such as Hyperledger and Canton deliberately suppress speculative tokens. But then the asset being marketed has no claim on anything, and the investment logic collapses into a bet on a private company with no disclosed financials.
If a token does exist and simply was not disclosed, the disclosure gap itself becomes the risk. Distribution structures that survive daylight tend to get disclosed.
The positioning has a second conflict. Enterprise buyers want KYC, SLAs, privacy, and legal recourse. Permissionless EVM wants none of those. DAC claims both simultaneously, which usually means the product is undecided and the pitch is segmented by audience.
Governance is blank in the same way. No registered entity, no jurisdiction, no legal wrapper. Most structures calling themselves DAOs have the legal status of no legal status — and when something breaks, contributors discover that limited liability was never actually limited. A chain courting enterprise clients while concealing its corporate form is asking those clients to accept a risk their compliance departments exist to refuse.
And none of this touches the oracle problem. Post-quantum signatures do not fix a stale price feed. A signed message is only as trustworthy as the number inside it, and the latency between an exchange print and an on-chain update remains the soft underbelly of every DeFi protocol that consumes it. Chainlink's answer to decentralization is a committee of professionally operated nodes — mathematically elegant, operationally centralized, and still late by seconds that cost millions.
Scale is the other unspoken problem. Dozens of L1s and L2s now compete for the same finite pool of real users. This is not scaling. It is slicing already-scarce liquidity into fragments, and every new chain adds a bridge to be exploited.
The threat model points at the wrong adversary
Here is the contrarian read. The absence of data is not the interesting part. The interesting part is that DAC has aimed its entire architecture at an adversary that has never taken a dollar from anyone.
In 2025 I led a post-mortem on cross-chain bridge failures that totaled roughly $400 million. I dissected signature verification flaws in the multichain consensus layers of three major bridges. In every case the weakest link was a centralized multisig or an off-chain signer, not a smart contract, and not a cryptographic primitive. Not one dollar was lost to a quantum computer. Not one.
The dominant loss vector in this industry is key management and operational compromise. A post-quantum signature does nothing against a compromised laptop, a phished validator, or a threshold scheme where three of five keys sit in the same cloud tenancy.
The moat question is worse. If Ethereum migrates account verification to post-quantum primitives over the next decade — and that discussion is live in the account abstraction work — then quantum resistance becomes a network upgrade, not a chain. A standalone post-quantum L1 would be selling a feature the largest network absorbs for free, at the cost of every composability guarantee it spent eight years accumulating. That is the same trap every "faster L1" walked into between 2018 and 2021.
Code does not lie, but it can be misled. So can a market.
Vulnerability forecast
The most probable failure mode here is not a cryptographic break. It is a TGE timed to a quantum headline. IBM or Google publishes a qubit milestone, the sector reprices on reflex, and a chain with no repository captures the bid.
Watch for the repository before the token. Watch for a named signature scheme before a mainnet. Watch for an audit from a firm that has actually published a report. Trust is a legacy variable — and right now, DAC has published nothing that lets anyone compute it.
