Photon: Quantum-Resistant Vaults on eCash, Built for Q-Day Before It Arrives
This is the fifth piece in our series covering the seven BIP-300 sidechains shipping with the eCash hard fork. Previous entries covered Thunder, the high-throughput payments chain that ended the blocksize war; zSide, the Zcash-grade privacy chain; BitNames, the identity and naming chain; and BitAssets, the tokens and digital-assets chain. Here we look at Photon, the quantum-resistant sidechain, with code developed under the repository LayerTwo-Labs/photon.
(Readers who followed this series from the beginning will remember an August launch date. The fork now rolls out in rehearsal stages: a practice Alpha on August 23rd, a Beta in late September, and the permanent chain on Halloween, October 31st, the eighteenth birthday of the Bitcoin whitepaper. All seven sidechains are slated to be available on day 1.)
Of the seven, Photon is the only one built to defend against an enemy that does not exist yet. That makes it the easiest to dismiss and, on reflection, the most interesting to argue about. Every other chain in this series answers a demand that is visible today: cheaper payments, real privacy, owned identity, tokens. Photon answers a demand that will either arrive all at once, on a day the industry calls Q-day, or never arrive at all. The entire case for the chain rests on a single uncomfortable observation: by the time the threat is undeniable, it will be too late to build the defense.
The Locksmith Who Has Not Been Invented Yet
Imagine that a mathematician publishes a design for a master lockpick. Not a tool anyone can build today, but a blueprint, proven correct on paper, that will open every lock of a certain make in seconds. Almost every front door in the world uses that make of lock. Engineers agree the machine can be built in principle. They disagree about whether it takes five years or thirty, and a respectable minority thinks the physics will never cooperate.
What do you do? Waiting for the first burglary is a bad answer, because the first burglary will not look like a burglary. It will look like your coins simply being somewhere else, transferred with a perfectly valid signature that you never made. The lock will not be broken in any visible way. It will be opened.
This is the quantum situation for Bitcoin. Ownership of bitcoin is enforced by a signature scheme, ECDSA, whose security rests on a simple asymmetry: deriving a private key from a public key is so hard for ordinary computers that the age of the universe is not long enough to try. In 1994, Peter Shor published an algorithm that makes the same derivation easy, but only for a machine that runs on quantum physics. That machine does not exist yet. The blueprint has been sitting on the shelf for three decades, and the shelf gets closer to the workbench every year.
What a Quantum Computer Actually Breaks
The nuance matters, because the threat is not evenly distributed. A Bitcoin address that has never spent reveals only a hash of its public key, and hashes are far more resistant to quantum attack than signatures. But several categories of coins are standing in the open:
- The 2009 vintage, including the coins attributed to Satoshi Nakamoto, sit in pay-to-public-key outputs, the oldest format, where the public key itself is permanently visible on the chain. Analyses over the years have commonly put roughly a quarter of all bitcoin in outputs with exposed public keys.
- Any address that has ever spent has revealed its public key to the world forever. Address reuse makes this worse.
- Every transaction in transit exposes its public key in the mempool for the minutes or hours before confirmation. A sufficiently fast quantum attacker would not even need to target old coins; it could race ordinary spends as they happen.
The honest calibration is that today's machines are nowhere close. Breaking Bitcoin's curve would require millions of stable, error-corrected qubits, where the best current hardware, like Google's Willow chip unveiled in late 2024, counts its qubits in the hundreds. The gap is enormous. But the direction of travel is unambiguous: Willow crossed a long-awaited error-correction threshold, IBM publishes roadmaps toward fault-tolerant machines, and in August 2024 the US National Institute of Standards and Technology finalized its first post-quantum cryptography standards. Serious institutions do not standardize new locks for a threat they consider fantasy. They standardize them because migrations take decades, and the cost of starting late is not linear, it is total.
What Photon Actually Is
Photon is a drivechain, which means it inherits the two mechanisms at the heart of every chain in this series: hashrate escrow and blind merge mining, as laid out in our explainer on what a drivechain actually is. Coins move onto Photon through the same two-way peg, fees are paid in ECX, and security comes from the same SHA-256 miners who secure the base layer and every other sidechain. Miners get paid twice here as everywhere else in the design.
What changes is the lock. Photon replaces Bitcoin's elliptic-curve signatures with post-quantum signature schemes from the families NIST standardized in 2024. These come in two broad designs. Lattice-based schemes derive their hardness from geometric problems in high-dimensional grids, structures where finding the one shortest path is easy with the key and hopeless without it. Hash-based schemes, the more conservative option, derive their security from the same family of hash functions that already secures Bitcoin mining, which means the trust assumptions barely change at all. Either way, Shor's algorithm has nothing to grab.
The trade-off is bulk. A Bitcoin signature is under a hundred bytes. Post-quantum signatures measure in the kilobytes, tens of times larger, with correspondingly heavier verification. Imposing that cost on the base layer would be madness, and this is precisely the drivechain pattern repeating itself: a feature with real costs belongs on its own chain, where the people who want it pay for it and everyone else is untouched. If the L1 is a courier on a bicycle, Photon is the armored truck. Slower, heavier, more expensive per trip, and exactly what you want when the cargo is a life savings.
That shapes Photon's character as the vault chain of the seven. Thunder is where you spend. Photon is where you store. The pitch on the launch infographic says it in one line: quantum-resistant signatures, vaults built for Q-day.
Why a Sidechain Instead of a Bitcoin Upgrade
The natural objection is that if the threat is real, Bitcoin should simply upgrade itself. This deserves a serious answer, and the answer has two parts, one about speed and one about politics.
The speed argument is the shorter one. Bitcoin has not activated a soft fork since Taproot in November 2021. A post-quantum migration would be the most invasive change in the network's history, touching the signature scheme that underlies every coin, every wallet, and every piece of signing hardware ever manufactured. A process that cannot currently ship anything would somehow have to ship this, globally, before an adversary ships the machine. The drivechain thesis exists because that bet is not one a saver should be forced to make.
The political argument is the deeper one, and it has a name: the frozen coins dilemma. Any L1 migration must decide what happens to the millions of coins whose owners never move them to the new scheme, including the most famous coins in existence. Freeze them by consensus and you have broken the social contract, confiscating the dormant to protect the active. Leave them spendable under the old rules and you have created the largest bug bounty in history, payable to whoever builds the machine first, with a market panic guaranteed the moment those coins move. Every answer is a civil war.
Photon dissolves the dilemma by refusing to pose it as a collective question. Migration becomes voluntary, individual, and gradual. Each holder moves when their personal risk model says move, pays the bulk cost only on the coins they vault, and leaves everyone else's money alone. No flag day, no freeze vote, no deadline imposed by a committee.
Photon converts the hardest collective decision in Bitcoin's future into the easiest kind of individual one: a personal choice, made coin by coin, holder by holder, on your own schedule.
There is a fitting irony here, and it is worth stating carefully. The dormant 2009-era coins, the most quantum-exposed outputs on Bitcoin's ledger, are precisely the coins that the eCash fork reassigns on its own chain to fund the launch. Whatever one thinks of that decision, it means the new network does not carry the Satoshi time bomb as a live political question. The base chain keeps the exposed vaults and the impossible debate about them. The fork simply starts cleaner.
Who Should Use Photon
Photon is not for everyone, and the series would not be honest if it pretended otherwise. The natural users are easy to describe:
- Long-horizon savers, anyone measuring their holding period in decades, including coins earmarked for children and inheritance. A twenty-year horizon is exactly the horizon where the quantum question stops being ignorable.
- Institutions with fiduciary duties, for whom the question "what is your post-quantum plan?" will increasingly require an answer better than a shrug.
- Hedgers, holders who assign Q-day a small probability but recognize that the payoff asymmetry of insurance is the whole point. Seatbelts are for crashes you do not expect.
- The merely prudent, because the cost of moving coins to Photon is a transaction, while the cost of being wrong in the other direction is everything in the address.
Why Photon Is Positioned to Succeed Where QRL Could Not
Quantum-resistant cryptocurrency is not a new idea. The Quantum Resistant Ledger has been running since 2018 with hash-based signatures, a genuinely pioneering project that did the hard cryptographic work years before it was fashionable. It has also never accumulated meaningful capital. Understanding why is the key to understanding Photon's actual pitch.
The problem was never the cryptography. It was the wrapper. Buying a standalone quantum-resistant coin means selling bitcoin to buy the hedge, which means the hedge only pays off in the world where Bitcoin dies of the very thing being hedged. And in that world, the thin market for your hedge coin has evaporated too, because the panic that kills Bitcoin's signatures does not spare the liquidity of a niche asset ranked far down the market cap tables. The insurance policy and the thing insured turn out to be the same instrument. It is like buying flood insurance denominated in sandbags, payable in the flood.
Photon separates the two. The value stays Bitcoin-descended money, pegged one to one with ECX, and only the lock changes. Security is inherited through blind merge mining rather than bootstrapped from a thin independent hashrate. This is the same structural argument this series made for zSide against standalone privacy coins and for BitAssets against gas-token chains: the feature was always viable, the standalone-coin wrapper is what failed. As the drivechain critique of altcoins has argued for years, there was never a need for thousands of coins each defending its own monetary base. There was a need for one monetary base with many rooms.
The Honest Case Against Photon
Three serious objections deserve air, because Photon's pitch is paranoia and paranoia demands standards of evidence.
First, Q-day may be decades away, and some serious physicists think fault-tolerant machines of the required scale will simply never be built. A user who vaults today is paying real complexity costs for insurance they may never collect. That is a legitimate choice, not an obvious one.
Second, the new locks are young. ECDSA has survived 17+ years of live fire securing trillions in value. The post-quantum families are the survivors of NIST's process, but that process itself produced cautionary tales: SIKE, a celebrated candidate, was broken in 2022 not by a quantum computer but by an ordinary one. Moving early carries its own risk, because a flaw in the new lock can hurt you before the old lock is ever picked. The mature position is not that Photon's cryptography is proven stronger. It is that a diversified holder might reasonably refuse to keep every coin behind a single lock design.
Third, Photon is the youngest codebase of the seven sidechains, and launch-day software tends to break. The fork's staged rollout exists for exactly this reason, and it is fitting that the sidechain built for a threat that has not arrived yet ships on a network that rehearses its own launch twice before it counts. And if Bitcoin eventually does upgrade its own signatures in time, Photon's permanent role could shrink. The honest answer is that this outcome would be wonderful. Insurance that goes uncollected is not insurance wasted.
Why Photon Is a Big Deal
Money got decentralized in 2009, and then the base layer froze in place, which means every unpriced tail risk has been accumulating in the dark ever since. The quantum question is the largest of these, and the existing answers were all bad in the same way: they asked holders to abandon Bitcoin to be safe from Bitcoin's fate. Photon is the first design that lets a holder keep the money and change the lock, on their own schedule, at their own cost, without asking permission from a process that has not granted permission for anything in five years.
This is the eCash thesis in its purest form. The blocksize war, the privacy wars, the token wars: all of them were arguments about what one chain should be allowed to do. The quantum question is the same argument wearing a graver costume, and it resolves the same way. Different chains make different trade-offs. Users choose. Nobody is forced.
The time to dig the storm cellar is when the sky is blue. Whether the market agrees that the sky will not stay blue forever will, as Paul Sztorc likes to say, be decided on the merits.
Tagged: ecash photon quantum resistance post quantum quantum computing q-day drivechain sidechains qrl security