Ethereum’s Quantum Plan Before Q-Day with Justin Drake

Transcript

One interesting shift of mindset for me in in the last few months is that I've I've stopped thinking about post-quantum as you know, a hurdle that we have to overcome. And I think of it more as an opportunity. Right? It's an opportunity for Ethereum to stand out as the very first global financial system that is post-quantum secure. Not just relative to its competitors, you know, like like Bitcoin and whatnot, but also relative to, you know, fiat and and and and and and tradfi. I think it would, you know, send a very strong message uh and and and kind of be a very natural >> [music] >> security shutting point for the for the world to to to migrate over over to Ethereum.

>> [music] >> Bankless Nation, we are once again joined with Justin Drake. We're going to talk about quantum computing as it relates to crypto, Bitcoin, and also Ethereum. Justin, welcome back to the podcast. Hi guys, thanks for having me again. So, uh quantum has become kind of a big uh looming threat to our industry. We've always kind of known this. We We have known this. We have known that this is a thing that quantum is a thing. It's been largely theoretical. Uh over the last, I'll say 6 months or so, uh quantum has firmly moved from theoretical to something materially impacting uh our industry. Starting with, I'll say, just like Bitcoin price,

just because uh fund managers, even BlackRock, has put out pieces about the threat of quantum to the security and therefore the value of Bitcoin. And so, we have anecdotally seen uh people de-weighting their portfolio of Bitcoin. Uh perhaps that has also suppressing the price of all the other assets in the industry. And not to just talk about price, but uh as we understand it, quantum really just impacts the way blockchains function. So, this seems to be a fundamental problem of our industry as a whole. A hurdle that our industry has to get over that uh when crypto blockchain was created in the first place, uh we were not We are not equipped to become post-quantum

uh of an industry. So, maybe to start off that with context, uh what is the timeline here that our industry needs to be aware of? The hurdle that's coming that we need to get over. What When is that hurdle coming? I I've heard this become called Q-Day. Uh When When is Q-Day? How much time do we have to get over this quantum hurdle? Yeah, so I just want to back up a little bit and kind of emphasize what you said, which is that in the last 6 to 12 months, we've had major breakthroughs. Uh one of them is this notion of error correction. So, we're able to go from so-called physical qubits, which are very noisy and error-prone, to like these perfectly logical um qubits. Right now, we can basically

manufacture one logical qubit, uh but it's still a very important zero-to-one moment. And now, it's about scaling it to multiple logical qubits. Another big breakthrough is on the algorithmic side of things. Previously, we thought it would take millions, actually tens of millions, of physical qubits in order to break our beloved cryptography. But last year, there was a paper that made a 10x improvement, bringing it down to 1 million physical qubits. And this year, we have another 10x improvement, bringing it down to 100,000 qubits. So, the goalposts are coming closer and closer and closer. And you have this this double exponential in some sense that will eventually uh cross. And then,

another thing that has happened is on the investment side of things. A lot of the quantum startups have been raising billions of dollars. So, last year, I believe we're talking on the order of $5 billion. And this is unprecedented. Previously, we were talking hundreds of millions uh of dollars. And I think the culmination of all of these things uh has has really energized the the public and led to this narrative, which has indeed, you know, potentially im- impacted the price of of Bitcoin and ether. Now, projecting into the future, my personal Q-Day is in 2042. Uh this is a little bit of an optimistic take uh in the sense that

it's possible they'll arrive a little bit later, but you know, we need to be prepared in some sense for the worst-case scenario. So, I'd say there's at least a 1% chance that Q-Day is in uh 2042, more likely than not double-digit percentage that Q-Day is in 2042. Um various experts uh that are, you know, super knowledgeable in the field will tell you somewhere between, you know, 2031 and, you know, 2038, maybe. Um and uh you know, one of my my friends who's in the in in the industry, um Steve Brierley, who's the the founder and CEO of one of the the biggest quantum error correction companies uh in the world. He happens to be based in Cambridge, where

I am. Our Our children went to the same class. Um he His personal Q-Day was 2032, but he's had this date for 15 years. And it's always stayed [laughter] the same. Wow, that's impressive continuity. And basically, you just need to extrapolate the exponentials and and and and that's where you end up. And so, what we're trying to do with Ethereum is, you know, to make sure that we have everything wrapped up well before 2032. And, you know, my completion date for Ethereum being fully secure is uh 2029. So, a year ago, we had uh you on with Scott Aaronson, who is kind of a godfather in this space of of quantum as well. And um we asked him questions about kind of when Q-Day. And

is a good definition of Q-Day, Justin, that that's the day in which quantum computers can in can break break our signature schemes like ECDSA? Is that what Q-Day actually means? Yeah, exactly. So, we have this new term called uh Croc. Uh cryptographically relevant quantum computer. Uh if you squint a little bit, the the Q in the middle becomes an O, and it's like a crocodile, Croc. Yes, uh that is when, you know, for us, it becomes relevant. It's possible that there will be other applications that make quantum computers useful for, you know, chemistry or or physics, but that will come uh yeah, a bit later.

>> Okay, I recall him saying, he was kind of hedging at that time. This was a year ago. This was, I think, in January 2025. And he said, within 10 years, we should have useful fault-tolerant quantum computers. But he was very careful to say that doesn't mean that we would be breaking able to break ECDSA. And generally, he wouldn't commit to a a date um because he said it was a staggeringly hard engineering problem. I have noticed that his tone has changed a little bit over the past year. And indeed, he's actually joined some organizations and and foundations to help uh cryptocurrencies navigate quantum. It seems like maybe his thinking has changed on this. Is this

for the three reasons you emphasized? We've got breakthroughs in algorithms. We've got um you know, some fault detection, I think you called this, which allows us to scale uh logical qubits, which I think that is that is the main thing that must be scaled in order to break ECDSA. And then also, all of the the billions in in VC and funding that is poured into it. Has his opinion changed on this? Yeah, I mean, I speak for him, but uh you know, one thing that I guess we should notice that like Scott is primarily a theoretician.

So, for a very long time, he was working on the theory, not so much on, you know, the day-to-day of quantum computers. And I think that was partially the reason why he was so hedged. I think what's happening more and more is that there's like real companies, real entrepreneurs, building these things. And he has an insider view, and he's basically ingesting all this information. Um one of the things that he said recently is that um the US government is starting to intervene with the publication of ideas. So, we have companies and academics that might come up with improvements, further improvements, to Shor's algorithm. And those are not completely being disclosed, potentially, you know, for national security reasons. What if you

could trade gold, forex, and global markets with the same tools and speed that you use for crypto? That's exactly what Bitget TradFi unlocks. After strong beta demand, including over $100 million in single-day gold trading volume, Bitget TradFi is now live for all users. Inside of your existing Bitget account, you can trade 79 instruments across forex, precious metals, indices, and commodities, all settled directly in USDT. No platform switching and no fiat conversions. This is Bitget's universal exchange vision in action. Crypto and traditional finance side by side. You get deep liquidity, low slippage, and leverage up to 500x, letting you apply crypto strategies to macro markets. New to TradFi? Start with gold. The gold USD pair is liquid, macro-driven, and a

familiar natural bridge between crypto and traditional markets. Try trading gold on Bitget now at bitget.com. Click the link in the show notes for more information. This is not financial advice. Galaxy operates where digital assets and next-generation infrastructure come together, serving institutions end to end. On the market side, Galaxy is a leading institutional platform, providing access to spot, derivatives, structured products, DeFi lending, investment banking, and financing. With more than 1,600 trading counterparties, Galaxy helps institutions navigate every phase of the market cycle. The platform also supports long-term allocators through actively managed strategies and institutional-grade staking and blockchain infrastructure. That scale is real. Galaxy has over $12 billion in assets on the platform and averaged a $1.8 billion loan book in late 2025,

reflecting deep trust across the ecosystem. Beyond digital assets, Galaxy is also building infrastructure for an AI-powered future. Its Helios data center campus is purpose-built for AI and high-performance computing. With more than 1.6 gigawatts of approved power capacity, making it one of the largest sites of its kind. From global markets to AI ready data centers, Galaxy is serving the digital asset ecosystem [music] end to end. Explore Galaxy at galaxy.com/bankless or click the link [music] in the show notes. Wow, okay. So, governments are getting involved in this, it sounds like. So, we're not actually sure all the work that's going on behind the scenes even. We we're aware of the commercially viable work at that point at this point. Um Okay. So, on the logical qubit piece, you said we

have like one logical qubit right now. There's physical qubits and logical qubits and the thing to scale is logical cubits if you if you know, in order to break uh ECDSA. How many logical qubits do we actually need to break these algorithms? Cuz that's that's a metric that I'm looking at. But, is that even the right number to look at for at one? I've heard people talk about, well, you need a thousand or maybe 1,500, something like this. Uh is this a number we should be paying attention to and what do you think about this? Yeah, so there's like multiple um relevant metrics. There's the total number of physical qubits.

Um there's the total number of logical qubits. And there's also the total number of steps it takes to run the algorithm. And this has a real impact because it's going to determine if it takes a minute to break a key, a day, a week, or month, or year. Um And what are the what are the scalars for each of those? Physical, logical, and then time to you know, the algorithm. Yeah. So, roughly speaking, the number of physical qubits to get one logical qubit today is a few hundred, call it a thousand. Um and what should happen is that the quality of the physical qubits, the so-called fidelities, should increase. And also, we should come up with better eraser coding uh codes uh

that will basically improve this ratio. So, it's possible that in the future we'll only have a hundred logical qubits for every a hundred physical for every logical one or maybe just ten. Um so, that's going to improve. And then, when you look at the algorithm to break um you know, the discrete log and ECDSA, roughly speaking, it's a small multiple um of the the the the number of bits in the curve. So, we're working with this curve called uh secp256k1.

The 256 stands for 256 bit. So, you take this number and then you multiply it by five or six or something. And that will give you roughly the number of logical qubits that you need. So, let's call it 1,500. Um and and so, you know, because today we're at one logical qubit, in some sense, we're three orders of magnitude away. Uh it's three ten x's in order to get there. But again, what will happen is that we're going to have improvements at the error correction uh side of things. So, right now, the 1,000 to 1 will become maybe 100 to 1 or 10 to 1. And also, we're going to have improvements uh on the algorithmic side of things that will reduce the number of of

physical uh qubits, I should say logical qubits. Now, on the runtimes, this is kind of interesting because there's two flavors of quantum computers. There's the so-called fast clock and the slow clock. Uh so, the fast clock operate really fast, kind of at the speed of light. Uh so, you have the so-called super conducting uh quantum computers and you have the photonic um quantum computers. And you have photonic, as the name suggests, it's using photons, light, uh which explains why it's like so fast. Um and then you have the other flavor, which is the slow clock.

Uh you know, they're called trapped ions and and and and and and and neutral atoms. The names don't don't don't really matter, but roughly speaking, they operate a thousand times slower. Um and each architecture and so-called modality has its has its own advantages and and and disadvantages. And so, it's quite possible um that in the beginning, we might see a a slow clock modality win out um in the sense that they will be the first one to break a key, but it will take them a long time. It might take them a week or or or or month. Um and so, in some sense, Q-Day is not totally black and white. Like, there will be a little bit of a of a period where it's kind of broken, but only for the very very top

high value addresses. Interesting. But, Q-Day could also happen without you behind the scenes, without us knowing you know, how far along we really are. Yes. Um and if indeed it is going to be a nation-state that has access to these quantum computers first, you know, unless, you know, crypto is plays a a major systemic role in the world, more likely than not, they'll use their powers to attack things in a stealthy way, for example, spy on on on on their adversaries. Uh so, that plays in our favor. But, if you're dealing with a a purely rational um you know, entity that's that's motivated by dollars, they might indeed um you know, go go for Bitcoin or or or Ethereum. Last question

on qubits. So, are quantum computing data centers being built out right now? We have this massive data center build out for AI. Is something similar starting to happen with quantum computers? Yes. Um so, I was reading this press release, I believe, from uh Continuum. Um they're building um kind of this uh photonics-based uh quantum quantum computer. And they're very very stealthy. They they raised a lot of money, billions of dollars, you know, partly from the Australian government, if I understand correctly.

And um they kind of want a one-shot quantum computer. So, a lot of lot of what the other companies are doing is that they're building like small proof-of-concepts and then ramping up. You know, they want to build the whole thing, you know, from from day one. And so, they're they're building this massive data center and you can see pictures um on the internet. Um and you know, I I think this is is because of the modality where we we're dealing with with photonics, which doesn't require like the really cold temperatures that some other modalities, for example, superconducting requires.

And so, you can take a much more traditional-looking data center and and put your quantum computer there. We you just talked about how Q-Day isn't really black and white, it's on a binary. There's a bunch of different things about a blockchain that are relevant to quantum. Each one has a different level of quantum susceptibility. Uh but, I want to take the position that actually Q-Day is a an acute specific event. It's when the actual attack happens. And as a result of the attack, something breaks. Uh and maybe that's different for different blockchains because different blockchains' risk profiles aren't uniform, but we can talk about like the Q-Day for for Bitcoin under the assumption that Bitcoin doesn't do

anything. So, if we if we assume that Bitcoin doesn't adapt, it doesn't solve its quantum susceptibility, then there is a specific day that will happen where like Bitcoin is attacked. What what does that look like? What will it what would happen on that day? Do we have an idea of the way that like Bitcoin is the most susceptible first? Like, what's the lowest-hanging fruit for a quantum computer to attack Bitcoin? Well, basically, you you need to look at the incentives uh to attack. And you know, the rational move for an attacker is basically to go fetch uh like the largest addresses. And actually, maybe even before that, to go fetch um either addresses where there's like perfect privacy or addresses where

there's plausible deniability. Um so, let me go through these one by one. So, the the very first target will probably Zcash. Because if you attack Zcash, uh you can mint an arbitrary number of a ZEC and no one will know. So, you know, Q-Day won't be made uh public. >> Wait, just to be clear, Zcash is not post-quantum is not post-quantum secure right now. >> Correct. Even though it's using ZK like SNARKs and all this? Yeah, it's using SNARKs that are based on elliptic curves that are liable to be broken by quantum computers. >> Okay. And then, you know, one potential uh set of victims might be people who have died, for example. Um and they've just lost their coins. And so, if someone steals their coins, no one's

going to complain. Um there's like some amount of plausible deniability. But then eventually, you But we would notice that. I mean, like if if we started seeing coins from people >> because we're already seeing it today. Like, you know, every quarter or so, there's like some zombie address that hasn't moved for, you know, 13 years. They they they they they resurrect and no one knows the the real reason. It could >> Right, it's like a 13-year-old Bitcoin wallet that hasn't had a transaction since they mined the 50 Bitcoins forever ago. And it makes its first transaction in 13 years. Whether that person is still alive and just waking up a dormant wallet or it's a quantum computing

>> uh attack, you don't externally, a naive viewer just looking at the Bitcoin blockchain is like, I don't know how to tell the difference. These look the same to me. Exactly. Yes. Um and then, you know, you'd probably go and attack the biggest fish, which might be some exchange that hasn't put in the correct uh infrastructure to protect themselves. So, it turns out there's a very easy mitigation to quantum computers, the very first ones at least, is um to not reuse your addresses. Because when you reuse your address, you reuse the public key. And that means that an attacker has the time to go crack the the corresponding private key and then steal your funds the second time uh you you you use the address.

Um and so, really, the best practice should be that if you're holding any funds in long-term cold storage, it should be a a clean address for which the the corresponding public key has never been revealed. And just to make this crystal clear, what a quantum computer allows you to do is to go from the public key back to the private key. Um so, it it really uh jeopardizes the the foundations of our property rights. So, uh long dormant coins, no matter what blockchain, long dormant coins that have had their public key exposed, which is not all dormant coins, but it is a large percentage of them, are at risk.

Uh these are the Satoshi coins. Uh Satoshi coins and maybe a handful of others, but as I understand it, Satoshi has his coins in a wallet that people know. This is why we know we know that they're called the Satoshi coins cuz we know where they are. Uh do to what percentage of Bitcoins are susceptible to this? Yeah, so, um there's this webpage called the Risk List, uh it's uh spelled uh with a Q instead of a C, uh by this company called Project 11, where they have this uh you know, this dashboard that gives you a live view of uh vulnerable addresses. And I believe it's on the order of 35%.

Uh you know, we're talking >> 35% of Bitcoins? Yes. So, you know, millions of of Bitcoin, let's say six or seven million, something like that. Yeah, that's hundreds of billions of dollars, and you're right, but it does include the 1 million, roughly 1 million BTC that that Satoshi holds. Now, one of the interesting features of Satoshi's BTC is that they're all uh of increments of of 50 Bitcoin, because basically, that was the rewards that you would get, and he would use a fresh address every time he mined. That's how the the the the default software was was programmed back then.

And if it takes, let's say, a day, uh or even, let's say, 10 minutes, uh you know, to to to to to hack one pub key, you will see Satoshi's coins uh being drained at roughly the same rate that they were mined back then, you know, once every 10 minutes or so. So, it will be a process that will be ex- extended through time. And one interesting consequence is that if you're a small fish, and you have like significantly less than 50 Bitcoins worth in your address, then you're fine. You're kind of shielded by Satoshi. Uh you'll still be going before him.

>> right. Yes exactly. >> And in the running away from zombies, you just need to not be the slowest one. And in this case, uh we need to not have the largest wallets that are quantum insecure, because they'll just go for the larger wallets. Exactly. So, Q-Day happens in a Justin Drake scenario, and maybe a Zcash is is um the first to have some form of an attack, and then you might see some addresses on chain that aren't very noticeable, because the attacker won't want to draw their attention to it, some some addresses on Bitcoin. But then, the attacker would kind of step things up and go for larger and larger treasure sources on Bitcoin. Now, my

understanding, I I we talked about this a little bit last year when you came on, we talked about quantum. And then, um I've read some Nick Carter pieces currently, is that there is a portion of Bitcoin supply that is kind of in the lost coin type of scenario, which is like either the individual has passed away, lost their private keys, they're Satoshi themselves, um and I think Nick estimated this to be potentially up to uh the minimum threshold for that is like 1.7 million Bitcoin. I know there are different estimates of this, which would be 8.6% of the mined supply. So, this is less

than the 35% that you were talking about. Maybe 35% is susceptible to an attack. You have to imagine, people who are trying to stay one step ahead of the the zombie attack, they will, and they'll just move addresses to one that is not susceptible to this type of attack. But if the uh the coins are lost, if there's no access to private keys, then of course, you can't move to an address that is less uh that is not quantum attackable. And so, 1.7 uh million Bitcoin would be about 8.6% of supply, and then the other estimates, you know, say that there could be as high as 15% uh of Bitcoin that's susceptible to this

type of thing. What numbers have you seen, and what percent of Bitcoin do you think is just like lost, and going to be susceptible to a post Q-Day attack? Yeah, so, the rough number that I have in mind is in line with those that were shared. It's it's 2 million Bitcoin, um which, let's say, is 10%. Um so, we have the 1 million from Satoshi, and then we have roughly another million that hasn't moved for a very long time. Um now, we need to discount some of that, because, you know, some zombie addresses that are legitimate, um you know, will will revive uh over the coming years. But we should also increase it, because there might be some like recently spent addresses that that that will be lost. And so, you know,

5 to 15% I think is is is the correct range, and I would bet around, you know, 10, 12% or so. Well, with, you know, it's very sizable. Um it's it's it's definitely in the hundreds of billions of dollars. Um and one could kind of think through the game theory here. Um you know, option A is to try and and burn the coins. Um the advantage here is that you don't have the hundreds of billions of dollars of sell pressure. So, if you analyze this with a short-term lens, that's the rational move. Uh but then, you know, the whole story of Bitcoin is to be uh strong property rights. And so, if you have a longer a lens, then you should you should not want to to to burn the

coins. And it's very difficult to know uh which way the community will go. It's possible that ultimately, the decision will be made by large holders, for example, Michael Saylor and N Strategy, right? Because these large holders, they will receive a copy of both versions of the Bitcoin, uh the one with the burn and the other one without the burn, and they can choose to dump the one that they don't like. Uh and we know that Saylor uh is in favor of burning, and so he's can single-handedly potentially, quote, manipulate the market and and and and get the outcome that he wants. Can we be clear on what what you mean when you say there there's two options? Like two options for for who? So, we have a scenario where post a Q-Day. So, if you believe in in a Q-Day, okay? And and you

clearly do that it's coming at some point in time. We will have, say, 10% of all Bitcoin supply that can be attacked by whoever has the best quantum computer that time. An attack just means, you know, they can go and reach in and get the Bitcoin. And that can happen in, you know, like relatively short short order, over days and weeks and and maybe months, but they can pick these addresses off one by one, and effectively, that 10% can be taken by someone. You're saying that the Bitcoin community has some options with what to do with that 10% on, I guess, the social layer, on the hard fork layer. And those options are twofold. Either they can burn or freeze the coins. They can

effectively say, "No, Satoshi, this 10% Satoshi's amount and some others, these are dead addresses. We know they're dead. We don't want them to be quantum susceptible. So, we're just going to make a social decision and hard fork, and just say, 'These coins shall never be moved. They're they're frozen. We'll write it into the to the code, right?' So, it's uh 21 million less the 10% that was um you like frozen this one time. Uh that's one of their options. The other option is they just leave that 10% to whoever can create the quantum computer to go claim them, almost like a salvaging a shipwreck situation, where you have a a Spanish Armada fleet, and they sink with all their gold and their

treasure, and whoever has builds the submarine to go to the bottom of the ocean to get the gold can go claim it. But those are forced options. Like no matter what happens, if Q-Day happens, the Bitcoin community will have to choose one of those two options, either intervene, burn and freeze, or just leave it to whatever geopolitical commercial force has the ability to develop quantum computers and go claim the prize. Is that what we're saying here? Yes, that's very well said.

But the one small um correction is that this doesn't have to happen at Q-Day or after Q-Day. It can happen prior to Q-Day. At any point in time, the Bitcoin community or some subset of it can propose to make a fork. Um and then, at that at the at the fork uh block number, um there will basically be two versions of Bitcoin the asset, just like, you know, the Bitcoin Cash fork back then. It was the Bitcoin Classic, if you will, Bitcoin Cash. And ultimately, this is decided by the market. So, you'll have exchanges that will set up the two versions of of of the assets, and it's the market that decides which one is the true uh uh Bitcoin. And it's possible, just because of short-term liquidity

dynamics, uh that the version which burns the coins, potentially ahead of Q-Day, uh is going to be the one uh that that that that wins. Right. Okay, so, I'm Michael Saylor. I own a per- a large percentage of the Bitcoin supply, like 2, 3% of the especially the liquid supply. I get both copies of the Bitcoin. So, we're forking the Bitcoin blockchain, just like we did during the Bitcoin fork wars between Bitcoin Cash and Bitcoin back in 2017. Uh I'm Michael Saylor. I want to preserve my value. So, I sell all of the Bitcoins that are quantum susceptible, and I keep all the Bitcoins that are on the version of Bitcoin that burned or

locked all of the quantum susceptible Bitcoins. And therefore, the price of the Bitcoin blockchain, the Bitcoin on the Bitcoin blockchain that has quantum susceptibility, the untouched blockchain, that one goes down. And the price of the Bitcoin, the version of Bitcoin that is having all the quantum susceptible Bitcoins burned, stays high because no one's selling that one. Michael Saylor's not selling, you know, BlackRock's not selling, or whoever anyone who believes in this isn't selling. And so, what you're saying is simply the price of the quantum solved Bitcoin will be higher, and therefore that will, by market forces, become the canonical Bitcoin.

Yeah. And Michael might even decide to buy, you know, the the burned version of the Bitcoin using the proceeds of the the vulnerable >> Right. And go from like 5% to 5.5% or whatever. Right. Um question though, doesn't this mean that there needs to be some level of top-down coordination on which wallets are frozen and which wallets are not frozen? And so, isn't that also a choice that needs to be made of like, okay, clearly we can label Satoshi's coins, we will definitely freeze those, but then we have to freeze a few more, and there are some wallets out there that are, you know, we can be meaningfully sure about is like, it's okay to freeze those because that

person's dead. But we actually don't know where to draw the line on who which wallets are valid to be frozen and which wallet wallets are actually owned by humans somewhere that are just dormant. Is there a clear line there? How do we make that choice? Well, there's a concept called the shining point, which is, you know, in the absence of of a of a central coordinator, how do you come to consensus? And like, for Bitcoin, I guess the shining point might be, um you know, the block where having might happen. So, you might pick the first having or the second having or the third having. That seems like reasonably credibly neutral. Any coin that hasn't moved since, let's say, the second having is is considered burned. So, we just pick a date, and we say, "Hey, if you are leaving your wallet your

Bitcoins in a quantum insecure wallet by this date, we are going to burn your coins on the this Bitcoin secondary blockchain that we're going to have fork." Yeah. It's like, there's a relatively wide design space, and some people have tried to be creative. So, for example, some people are trying to solve, um two problems in one go, both the quantum one and the security budget problem, where the proposal is, "Let's take the 2 million coins, and instead of burning them, we just add them to to to issuance, so that it kicks the can down the road for the security budget."

>> I bet that becomes even more ambitious in terms of Bitcoin coordination. I don't know if you want to overload Bitcoin's coordination ability. Yes. If I were a betting man, I would just bet on the very simple burn, let's say, after the second having. Okay. This is so difficult though, because to to your point earlier, Justin, this does shatter the incorruptible narrative, the the property rights narrative. So, this this is any decision on a freeze or burn somewhat shatters the the the pure nature of what Bitcoin is. And I'm just wondering, so Nick Carter in his essays about this goes through a different story, where there's not a burn and freeze scenario. Instead, it's it's the salvage scenario, where

you just leave the coins. And in his scenario, he goes through there's a private quantum lab uh that it cracks the the um ECDSA ahead of schedule. They happen to be kind of US-based. The US government quickly nationalizes them in secret. It goes and starts acquiring the Bitcoin. They coordinate with Treasury. They coordinate with the big ETF providers, BlackRock's, the Michael Saylors of the world. And at the end of this, uh the US ends up with the 10% of Bitcoin supply in the Treasury. And he goes through fictional price charts, of course, when people realize the Bitcoin network is under a quantum attack and

the supply is being taken by someone. Price spikes down by 73%, but then when it's revealed that actually the US government has it, and um they're using uh salvage laws, maritime salvage laws, in order to legally confiscate this, then the market rebounds and is very excited because the US has this um you know, Bitcoin strategic reserve treasury. So, that's his other scenario, and kind of you just you just leave the Bitcoin, and some nation-state, maybe the US government, actually cracks it and and uh gets that. Do you Do you find a scenario like that plausible? Because at least in that scenario, you're not breaking any property rights. It certainly is um incredible that this will have happened

to a multi-trillion-dollar network, and there's such a prize bounty. It's like just unprecedented. But that could happen as well, and maybe that's a a better outcome for Bitcoin. Yeah, so I have a couple thoughts. Um the first one is that there is this rather sophisticated way of proving ownership of Bitcoin without going through the private key. And this is what's known as a proof of seed phrase. So, the way that um you derive a Bitcoin address is in some certain in in three steps. Step number one is that you generate your seed phrase. Step number two, you do some manipulations on the seed phrase, including hashing, and this is an

important point, to derive your private key. And then from the private key, you derive the public key, you know, which then is the address that that that that that that that goes on chain. Now, the private key, unfortunately, is no longer um something that can prove ownership. But because of the hashing step, if you know your seed phrase, that is still a a a proof of of ownership. And so, one thing that could happen, and technically speaking is the the the soundest way forward, is to freeze the Bitcoin, but to allow anyone to revive their Bitcoin with a proof of seed phrase. Mm. Now, the proof of seed phrase, unfortunately,

uh is quite complicated. It requires a snark, a zero-knowledge proof. Um and so, it would significantly uh potentially complicate uh a Bitcoin. But I guess we'll get back to this later, because my prediction is that Bitcoin is going to have snarks to solve the so-called size problem of post-quantum signatures. So, Bitcoin is very much known for not wanting to increase its block size. Unfortunately, post-quantum signatures are roughly 10 times larger than ECDSA.

To give you the concrete numbers, ECDSA is 64 bytes. It's a minuscule signature. The smallest NIST-standardized um post-quantum signature is Falcon, which is 666 bytes, more than 10 times larger. And so, if you were to naively swap out ECDSA for something that is post-quantum secure without increasing the block size, your throughput is going to go down roughly 10x. So, your TPS on Bitcoin will go from three to 0.3, which in my opinion is a is a non-starter. And so, what we're building for Ethereum is this like fancy post-quantum signature aggregation technology, so that you don't put the raw signatures, even if they're large, on chain. You only put

this aggregation proof. And my bet is that Bitcoin is going to adopt the solution that Bitcoin will develop, because there's just no other technically sound way forward. I see, and that's why you're betting against the salvage type scenario, because you think they'll they'll go with this approach. And if they go with this approach, then that gives them a way to more credibly neutrally like kind of like freeze the assets, because they're not completely freezing it. If you can prove ownership, then you can access the the old legacy if you're a property rights maxi, this is not completely satisfactory. No.

>> And the re- And the reason is that there there are some subset of the frozen addresses for which there is no known seed phrase. So, for example, the seed phrase standard only came several years after Genesis. So, all of the earlier all the Satoshi addresses, for example, won't have a corresponding seed phrase. And there's some like wallets, for example, MPC-based wallets, um where there there is no corresponding uh seed phrase. So, it's it's not a perfect solution, but it it gets you 80% of the way there. So messy. This is so messy, no matter how you >> Yes.

Yes. The other thing I wanted to highlight is that a lot of people think that when you steal Bitcoin, the price of of BTC the asset will crash, and then, you know, the asset that you've stolen will be worthless. But there actually is a way to basically hedge the price of Bitcoin, which is very easy. You just go short BTC. So, let's say you know for sure that you've cracked the the the private key of a of a wallet that hold, let's say, 100,000 BTC. What you do is you short 100,000 BTC. That locks in your your profit of 100,000 BTC. And then, no matter what the price of Bitcoin does, it goes up or down, you've locked in your profit, which could be, you know, tens of of of billions of dollars.

Mm. Now, I do want to flag that uh Justin, you you think in a particular way, uh and the way that you think is why you are in Ethereum. And if you were a Bitcoiner, you would think a different way. The Bitcoiner way of thinking is very unique, very distinct, like kind of Ryan just alluded to, a property rights maxi. I think what Justin would do if he was in charge of Bitcoin is very different than what the general aggregate of Bitcoiners would do if they're in charge of Bitcoin. And I don't really have like an actionable like question here, but I just do want to highlight that Oh, yeah. Well, >> what Bitcoiners do is not is probably not what you're going to do.

>> charges that basically what many of the Bitcoin core devs are doing is kind of burying their head in the sand and saying Q-Day is not real or it's not going to be real for like 20 to 30 years. That's what he's saying they're doing. Just to be clear, my prediction around the the the burn winning out is, you know, a prediction of what I think is most likely is not what I would do. If I would actually just not touch Bitcoin and and embrace the property rights. Um, you know, just because I have uh you know, I don't have this this this this this short time preference. Um, and I think many Bitcoiners will will agree with me, but unfortunately, you know, Michael Saylor has such a strong influence um that, you know, in some sense,

Bitcoin has been centralized at the social layer. Um, and uh and and and and that comes with great power and great responsibility. I actually agree with you. That's what I would do, too. I would let the treasure hunt happen. I would let the salvage happen. I would not touch anything. That is the key thing that Bitcoin does and just let the chips fall where they may. Um, but let me ask you the same question though. So, it's not just some portion of Bitcoin supply that is um you know, you you uh you post-quantum insecure. Also, Ethereum has this problem, too, but with a different percent of supply.

Can you map that same problem? So, we get to a post-Q-Day scenario. Oh my god, somebody let let's say they didn't freeze and burn. Somebody is is is grabbing, scooping up the the Satoshi Bitcoin. What is happening on Ethereum at this point in time? What percent of supply would be susceptible? Now, let's just say Ethereum didn't solve, you know, quantum yet. So, let's just say it's in its its current place. What percent of supply would be vulnerable to this type of an attack? One advantage that that Ethereum has is that there isn't the 5% of supply controlled by what what person, Satoshi, which is kind of thought to to to to be lost. Um the other advantage in some sense is

that Ethereum is less old um and it had a a price from day one. So, you know, there was a reason to take care of your your your ether, uh you know, from the very beginning, whereas in the early days of Bitcoin, it was just monopoly money and people just didn't really have very good hygiene with with with their with their private keys. And so, it's much more likely that um you know, the the the 1.7 that Nick Carter was talking about um you know, are actually, you know, truly truly lost. Um Now, when I was with the ultrasound project, uh one of the things that we were trying to do is calculate the amount of known lost coins so that we could add it to

the to the dashboard in addition to to to the burn. And it was just such a negligible amount that we didn't even bother doing doing it. Um there were like some >> the parity hack, isn't that a large portion? Yes, very good point. So, that was like the number one item in in the list, but it it so happens that this is a a bricked small contract, which is not vulnerable to to to quantum computers. Um, so It's actually just stuck. It's not about not having private keys. It's just literally stuck.

It's bricked. Yes, exactly. >> Okay. >> And then, you know, there's like a few case studies of a few people. You would you really go digging in in the in the you know, Reddit discussions and and and whatnot, you'll find stuff. But it it in the grand scheme of things, it's, you know, some total less than 0.1%. So, that is the known lost supply. Um but you know, realistically, there will be um some coins which, you know, will be revealed to be lost closer to to to Q-Day. And that, if I were to make a guess, you know, that is in the small single digit. Call it, I don't know, 2 3 4 5% maybe. So, you think maybe at max 2 3 4 5% of Ethereum supply is kind of uh both lost

and in quantum crackable addresses. Exactly. Yes. Um I mean, if I were to make a concrete prediction, then I'd say, you know, 2%. Um which is roughly an order of magnitude less than than than than than Bitcoin. And, you know, this this quantitative difference actually has a a a qualitative consequences, which is that in the case of Ethereum, I would strongly advocate for not doing anything and really honoring property rights, because at the end of the day, whatever, 2% is not a big deal. Uh in the case of Bitcoin, you know, 15% is is is a massive deal. So, Ethereum will have to make the same choice, right? Whether to, you know, let's say it's something like 3%. Whether to do the freeze and burn or just let that be

a treasure hunt. And your hope is that we just go with the treasure hunt option, which means some sort of quantum attacker will be able to scoop up that 1 2 3% of ether. And if you zoom out and you look at the big picture, we're basically moving towards ether being, you know, much better money than BTC. It will be non-interventionist, respectful of property rights. It will be, you know, quantum secure. And it will not have the security budget issue that is going to plague Bitcoin in, you know, a couple halvings.

Um and so, I think this is a big opportunity for for ether the asset. Okay, so we've just talked about kind of the the soft social issue that quantum computing brings up. There's a lot of technical challenges that we also have to face in order to make kind of the the rest of the chain post-quantum secure. I I want to bring out this this tweet that I saw from Haseeb Qureshi, friend of the show. Uh he said this and he was quote tweeting a Vitalik post on Ethereum's quantum roadmap. And he said this, "Ethereum has a tougher roadmap to become post-quantum than Bitcoin.

Actually, a lot of dependencies before you can tackle EOAs and private keys due to um post-quantum proof sizes." So, his take is actually the challenges and the roadmap ahead for Ethereum are much tougher than Bitcoin. What do you think about that? So, there's two problems that need to be solved. There's the the technical one and and the social one. If you look at the the technical one, you know, Haseeb is correct that there's basically three problems that Ethereum has to solve, each at the different layers of Ethereum. So, there's the the consensus layer where we have this cryptographical BLS. There's the data layer where we have KZG. And then, we have the execution layer where we have

ECDSA. And each three of these pieces of cryptography are vulnerable. And that is a superset of what you have in Bitcoin, where you only have the the ECDSA problem. So, in some sense, we have like three three times more things that that that we need to upgrade. But when you zoom out, I would argue that the bigger issue, maybe 80% of it, is is is social. Uh you know, we've already touched on whether to burn on or not to burn. But there's something even more fundamental, which is do we accept that this is even a problem?

And in Bitcoin land, you have this immuno response, which basically um just rejects any kind of uh you know, narrative which could potentially be bad for for for for the price. And you have, you know, people like Adam Back that are saying, you know, quantum computers are at least decades away uh from from from from today. And so, you know, step zero is is to have some sort of acceptance that there is a problem. Um and it it's possible that uh Bitcoin will be slightly too late.

Uh and um that would have, you know, much bigger consequences than than than on the technology side of things. So, you think generally Bitcoin will have a harder problem because of their social layer is is just like not acknowledging this reality and is less willing to engage with um new developments on chain. Yeah, let me say this. I'm willing to bet a large amount that all three layers of Ethereum will be upgraded prior to the single layer of of the >> [laughter] >> Right. Right. So, that three we have three times larger of a problem. Uh but it is on the Ethereum side of things just an engineering problem at the end

of the day. And not only that, it is is an engineering problem that Ethereum is taking head-on. So, while, you know, the Bitcoin engineering problem is a smaller engineering problem, it is a social problem, a coordination problem, which is fundamentally harder to get over. Yes, exactly. Um and even on the technical side of things, you know, we this is a problem that we've been working on for, you know, almost a decade now. So, if you rewind the clock back to 2018, we gave a a $5 grant to StarkWare to study these hash-based post-quantum SNARKs and to lay the foundations with um you know, SNARK-friendly hash functions. This is where the Poseidon

hash function came came came out from. Um and you know, if you look, you know, in more recent uh past, you know, in 2024, there was um the Lean Consensus Chain that was announced, formerly known as as the Beam Chain. Um we've had uh for example, the post-quantum workshops in Cambridge uh last year. We now have a dedicated post-quantum team uh with Tom and Emil. Uh and you know, we have this this straw map which really details um some of the the key milestones stones to to to making these upgrades. Can we talk about each of those problems one by one in I and I know, Justin, you can get into extreme detail with respect to the

cryptography. Um we'll want to try to keep this at the level that uh David and I can understand, which is um much more simple, let's say, Justin. But we [clears throat] we do understand kind of the different layers, of course, of the Ethereum stack and maybe we can start with the execution layer, cuz that's been the main thing we've talked about, ECDSA. This is the uh signature scheme behind both Bitcoin addresses and Ethereum addresses. That's the thing that would be cracked in a post-quantum world where somebody could go and and take the actual assets. So, what's the upgrade path to ECDSA? I mean, that is a long-standing um you know, cryptography uh like a tool.

Uh and we have something that can replace it. What's what's the process for that? >> Yeah, so first of all, let me just highlight that this is a very big task. Fundamentally, we're changing the the pillars of of blockchains, um the the the the base cryptography and swapping it out with with something uh new with completely different uh properties. Now, if you were kind of a a layperson, your answer might be it's simple. We have a standard body called NIST, the National Institute of of Standards and Technology.

Um They've basically come up with this post-quantum signature competition and they've selected a few, uh namely Falcon, Dilithium, and SPHINCS+. And so, we just need to pick, you know, one or several of these options. The problem is that NIST has not designed for the blockchain use case. They're designed for a use case where you have individual signatures for individual messages um that are, you know, used on the internet. Um in the context of blockchains, you have batches of transactions. You For example, for Bitcoin, you have, you know, thousands of transactions per block.

And again, we have the size problem with the post-quantum signatures that that at least 10 times larger, if not 100 times larger. Um And so, in my opinion, it's a it's a total non-starter to consider these individual signatures that we're just naively packing and concatenating in in in the blocks. The only solution that I see is called signature aggregation. Where you take multiple signatures and then you squish them into one multi-signature, if you will. Um and then verifying this master multi-signature is the same as verifying all of the the individual uh constituents.

Now, when you do your homework of, you know, looking at the design space for aggregatable post-quantum signatures, there's just not that many options. There's essentially one option that is you know, viable in my opinion, at least with the technology that we have today. Um which is to make use of SNARKs, specifically post-quantum SNARKs. And there's not that many post-quantum SNARKs that we know about. There's basically one major family, which is the the hash-based SNARKs. Um So, the basic idea is that you you you take individual post-quantum signatures and then you prove knowledge of all of these signatures to end up with a final SNARK uh proof.

Um now, if you're going to go with the hash-based SNARKs, you might as well also go with the hash-based leaf signatures, the on-aggregated uh raw signatures. And the reason is that this gives you simplicity and security benefits. It is the most minimal security assumptions that you can have where you you're just assuming that your hash function is secure. And in the world of blockchains, hash functions are sunk costs. You we have them everywhere, you know, for for building blocks and Merkle trees and and state trees and and and and and you know, blockchains where the chaining is done with with with with hashes.

Um And so, um you know, the Ethereum Foundation has put in a a lot of effort to start with hash-based signatures and make sure to make them as SNARK-friendly as possible, so that the cost of aggregation is as low as possible. And um you know, I'm pleased to report that the the the the performance of of of this approach is actually good enough uh for all of the blockchains. Um So, you know, the whatever the throughput of your of your chain is, um you can have an aggregator on on reasonable hardware, for example, on a laptop CPU, that can just be aggregating all these all these transactions and

producing a final proof against accompanied with the block. And one of the ironic things about this approach is that it's actually a scalability increase relative to what we have today. And the reason [clears throat] is that you don't have the fixed cost of you know, 64 bytes per transactions. The transactions have like zero bytes of signature data and then you have this one master signature um which gets amortized away across all of the transactions in the block.

>> Okay, so this is a upgrade for many of the other smart contract blockchains downstream of Ethereum. Especially the ones that optimize for for speed, like Solana and so on and so forth. >> contract, right? Bitcoin as well. ECDSA. Yeah, right. Right, right, right. So, like but the idea here, what I thought going into this episode, that chains like Solana would be encom- encumbered uh by having to do beefier uh signatures. Uh just in the same way Bitcoin TPS slows down to 0.3 transactions per second, Solana would similarly also slow down because transactions just would be beefier in a post-quantum world. But what you're saying is with this technology that it won't be true and it actually

will allow chains to broadly get faster and solve that problem. Yeah, exactly. Um and just like Satoshi with ECDSA set a de facto standard for the whole industry, and we basically copied even the curve, the >> [laughter] >> the the you know, the K1 curve, which is very unusual to pick with Satoshi. No one knows why he picked that curve, but that became the de facto standard. I think there's an opportunity for Ethereum to be a first mover and set the de facto standard. And the strategy that we're taking is actually to collaborate with the Bitcoiners. So, in the Bitcoin land, um there's a couple individuals, Mihailo Kudinov and Nick Jonas. They're both part of Blockstream and they're both hash-based

signature experts. Um and we're basically working with them um to make sure that whatever we develop in Ethereum land is also applicable to Bitcoin. And if Bitcoin and Ethereum uses that standard, then the whole industry presumably will also use the standard. Some exciting news. We are launching a new podcast to help people figure out the crypto [music] cycle, how to navigate it. The best crypto cycle investor I know, his name is Michael Nadeau. He runs The DeFi Report. This is the guy that sent me a sell alert before the 10/10 [music] price drop happened. His cycle analysis has been absolutely on point. I've been following him for years, and this year we started recording weekly podcast episodes. Each one we get into his portfolio, what he's holding, the market structure, entry targets, fair market

value of Bitcoin and Ether, and where we are in the cycle. There's new episodes that are released every Wednesday. They're 30 minutes, they're short, they're punchy. I think this crypto cycle is harder to navigate than most, so let's do it together. Go subscribe to this podcast. Search The DeFi Report wherever you get your podcast, YouTube, [music] Apple, Spotify, or find a link in the show notes. There's a new episode waiting for you now. That's fantastic. So, we have a way to solve the execution layer um you know, post-quantum upgrade without a performance hit. Let me ask you another question, though. How about security? So, these are this is newer cryptography versus ECDSA, which has been around forever, has Lindy, it's been proven. Should we be worried

in implementing new cryptography that there's some kind of hidden bug, zero day, something out there that uh you know, could completely destroy what we've built? >> So, I have a few thoughts here. Um you know, we take security extremely extremely seriously, and overall, what I expect will happen is that the solution that we deploy is going to be orders of magnitude more secure than what we have today with ECDSA. Now, let me try and explain this. So, ECDSA is based on elliptic curves, which are, you know, these fancy structured mathematical objects. And it is possible that some clever mathematician comes up

with an algorithm to break the discrete log using some very fancy mathematical trick that humanity was not aware of. And this is the kind of thing that has happened in the past. You know, we have better and better algorithms for factoring, for example, and for the discrete log. And one possibility with the advent of AI is that we just have mathematicians that are, you know, 100 times smarter than than human mathematicians that discover this hidden structure in elliptic curves and can can break up cryptography. And so, the cryptography that we're building is not only post-quantum, it's also post-AI.

Mhm. Um And going back to one The other thing that I said is that it only relies on hash functions. So, if you take basically any any signature scheme, it will rely on two things. One, the hash function, and then two, an optional additional hardness assumption, which might be the discrete log or, you know, in the case of lattice-based signatures, like these structured lattices. But in the case of hash-based signatures, there isn't this additional hardness assumption. It's just hash functions. So, if your hash function is secure, then then you're good. So, in so, in that sense, um I I expect to be um uh a an improvement versus the status quo.

Now, there's two caveats that I want to highlight. Caveat number one is that we're dealing with more complex objects. And the solution that we have here is what we call deep end-to-end formal verification. So, we we we we have our our cryptographic object, and we want to basically prove mathematically that it is sound, that it is impossible to forge a signature. And not only do we we want to do this for the mathematics, but we also want to do this for the code.

And had you asked me, you know, two three years ago, is there something that, you know, that would be doable? I would say I'd have said yes, but it was, you know, extremely laborious, extremely expensive. But what we're seeing with the advent of AI is that this very laborious and expensive work can be done 100 times faster and 100 times cheaper. Um we're starting to see um you know, bleeding edge world-class mathematics. You know, for example, a recent result that won the Fields Medal, which is the equivalent of the Nobel Prize for Mathematics. That result has been formally verified by an AI in five days. They produced half a million lines of code proving mathematically that, you know, like machine-checkable proof that

this is indeed a a valid theorem, and in the process, finding all sorts of typos in the proof of the the human-written uh paper. So, that's the kind of due diligence that we want to have in order to avoid the bugs. Now, there is another thing that I want to highlight, which is the hash function itself. So, historically, blockchains have been built on either SHA-2 in the case of Bitcoin, or a hash function called Keccak in the case of Ethereum.

And the proposal that we have for for for for for your post-quantum Ethereum is to introduce another hash function called Poseidon, which in some sense is is a different type of hash function because it's it's SNARK-friendly. Now, by the time we launch Poseidon, it should be pretty safe in the sense that it will have been, you know, analyzed for a whole 10 years. It will have been securing many billions of dollars through the L2s. And it will have gone through cryptanalysis by all of the top experts in the field. And also, recently, we just announced a $1 million prize, you know, to try and break Poseidon.

But it is indeed possible that that that Poseidon, which is a new thing, would would would break. Now, the way, unfortunately, that you design hash functions is that you can't just prove that they're secure. Uh the best that you can do is, you know, the lack of an attack that proves that they are insecure. And so, there's basically this this baking time. Uh and the order of magnitude that I have in mind is eight years. Why eight years? Because when Satoshi picked SHA-256, it was eight years old.

When Vitalik picked Keccak, it was eight years old, coincidentally. And so, you know, I I would want Poseidon to be at least eight years old, which it will be when we do deploy it on Ethereum. Okay, so that's the execution layer. Quickly, could you talk about the data layer? KZG needs to be upgraded to something post-quantum. And the consensus layer, we where we have BLS signatures, is that sort of similar in terms of the the level of effort to the execution layer and replacing ECDSA? So, let me start with the consensus layer because it's a simpler answer.

At first approximation, it's basically a copy-paste. So, we have a similar concept where we have actors making signatures, and there's a lot of signatures, and you know, they take up a lot of space, and we want to we want to compress them. The issue with the consensus layer is that we have way more signatures than at the execution layer. People don't realize this, but you know, we have a million validators. So, that's a million signatures per epoch, um which is 32,000 signatures per slot, which is thousands of signatures per second. You know, it's like it's it's it's it's more than Solana, uh you know, in terms of of vote transactions. In order to unlock a certain performance

optimization, which is only available at the consensus layer, we have this notion of a stateful signature, which basically says that the messages that you sign have a counter that increases every time you sign. And doesn't that remind you of something? Um the the slot number. So, you know, in Ethereum, at the consensus layer, you will only ever sign a single message per slot. If you sign two messages per slot, you'll get slashed, so you you'll probably never do that. And we use this constraint to basically have signatures that are 10 times more efficient to to aggregate.

But this is the main difference, you know, the the stateless, so-called stateless hash functions at the execution layer versus the stateful signatures where you have this the slot number that that that increments. Um and the aggregation technology, uh we have a name for it. It it's called Lean VM, uh which is a minimal ZK VM for hash-based cryptography. Basically, what Lean VM would be doing is proving that this is a correct um you know, Merkle root. Um and the main thing that we're not completely sure yet is whether or not this approach can unlock um you know, what I call the the teragas frontier.

Um you know, we have this very ambitious 1 giga gas per second at the L1, 10,000 TPS. But in some sense, even more ambitious, 1 teragas, 10 million transactions per second at at the L2, um using the the data availability. And we're talking about 1 GB per second of data availability. And so, the question is, can the ZK VM be performant enough to crunch through 1 GB of data per second? And you know, this is still yet to be determined based on on on future optimizations.

Okay. >> But what we do know for sure is that Ethereum will have the DA to have the the 1 giga gas per second for the L1, plus, you know, a handful of other L2s. So, I think now listeners might be thinking at this point of the conversation, okay, it sounds like the Ethereum community has a plan to upgrade to post-quantum. They're acknowledging that quantum computers will exist, and there is a Q-Day, and they have a plan. Now, they're wondering about timeline and level of effort. So, I took um Vitalik's post-quantum roadmap tweet, and I I threw it into Claude, and I was like, "Hey, Claude, what's the level of effort here? What are we talking about?

How difficult really is this?" And Claude responded like, "Think of this as like a nine out of 10. Okay, this is one the most significant upgrade, maybe one of or the most significant upgrade that Ethereum will ever do." He compared it actually to the merge, where we sort of had to we had a we had a plane, and mid-flight, we had to swap out the proof-of-work engine for proof-of-stake. Well, now we're swapping out all of the many of the core cryptography of Ethereum, and that feels like a pretty large level of effort. So, can you I guess scope this for us? First of all, are we going to be ready for this by 2032?

And also, like, how difficult is this as you're getting into it? Does does it seem possible for us? Does it seem daunting to you? Yeah, so I have two parts to this to the answer here. The the first part is actually it's even more ambitious than the way you framed it. And the reason is that [laughter] the [clears throat] the change to the cryptography is so invasive that it's essentially almost a rewrite of the consensus layer, at least. And so, if we're going to rewrite the consensus layer, we might as well like properly rewrite it, and like put all of the goodies and clean up all of the technical debt. And does that remind you of anything? That's the Lean Consensus project, uh where we're basically bundling together multiple rewrites,

including the the single slot finality, um with with the the upgrade to to to to post-quantum. So, yes, it is a very ambitious project. In some sense, we we're starting from a clean slate and building something, you know, amazingly beautiful and simple and efficient, and, you know, provably secure, and and and all of the good things. The good news is that in in many ways, starting from scratch is simpler because, you know, you you you're you're you're you don't have all of this this this this this technical debt, and you we can rewrite the spec to be as as minimal and simple as possible. And this is where the terminology lean comes

from. Right, we want to have maximum simplicity, where we want to have the the the whole state transition function basically be 1,000 lines of Python code that some sort of smart high schooler can just just read. And um right now we have testnets, sorry devnets, uh for for lean consensus and the specs are so easy to to to ingest that we've seen about 10 teams all implement them, join start joining the the the the devnets and do so without even contacting the Ethereum Foundation.

So, the the barrier to entry is is is relatively low. And um when this crazy world where AI development means that you can basically just to large extent vibe code your your your client. And then I think there's a big reason why we have so many clients um and often times we're talking about either single-person teams or like small like two-person or three-person teams. Um and I think this is going to have, you know, interesting consequences uh in terms of like sustainability of, you know, paying for all of these client teams as well as, you know, around governance

uh of, you know, how do you make upgrades uh to Ethereum. Like on this on this latter topic, the way that we do governance today, roughly speaking, is that, you know, we have five consensus layer clients and they all need to implement the upgrade, so some sort of EIP, um in order to to move forward. And if we want in the future when we have, you know, let's say 10 or 15 clients, we can just require the top 80% or the fastest 80% in order to move forward and that's more of a Darwinian competition that allows us to move fast you know, much much faster without having to to wait for the the the the slowest client. So, will we be ready by 2032? Uh what what at what point will we

be ready? So, the the whole straw map, you know, has everything laid out up to 2029, uh which is basically um the exact same road map that I gave um at at my Devcon talk where I introduced the the the beam chain and back then people were just >> hated? Yes, it was >> [laughter] >> it was my most hated slide TM, uh you know, because it stretched over, you know, 4 and 1/2 years or whatever. Um and you know, I historically I've been like bad with timelines. I've just been way too too optimistic, but you know, as I age and I'm I'm mature and I have white hair, um I've becoming I've been becoming better at at at at timelines and I think it was a

realistic/conservative uh timeline that got people upset, but you know, that's just the the way it is. But Also, just for for adding on the context, the reason why people got upset was this was in peak Solana momentum versus a perceived lack of uh technical momentum on the Ethereum road map. So, it was also the timing of the context. It wasn't just that you were giving a road map that was like four years uh along, I think. And that was also two years ago as well. And so, we're also we're decently all the way ready like decently far into that road map, but it's also the context in the moment as well. So, I don't want to discount that for the listeners who don't have that context. Exactly. Yeah, so we're a year and a half away and back then it was four and a half years ago

away, so now we're roughly uh it's it's three years away. Um and I'm relatively confident that, you know, we can meet this 2029 uh milestone. And I think there's even an opportunity, you know, if if we want to move like faster thank thanks thanks to AI. So, by 2029, all of this would be implemented if it meets the road map, everything we just talked about. You promise? >> Everything. >> [laughter] >> I yeah. A- Another question as I was thinking about this, and this is sort of uh from old software engineering veterans that have told me in the past that they say things like, you know what, uh rewrites never work.

And they have reasons for this that I'm not a software engineer, so I I I can't recite, but it it's basically like the rewrite is kind of a trap because it's a myth because like there's this panacea of getting rid of all the technical debt, but like what ends up happening is is you just kind of do staple on to the existing code base and it becomes so much more thorny to start something from scratch. I- In this case, Justin, you're saying like, hey, a rewrite is going to be a fresh start, it's going to work. What what gives you that confidence? And why why is there something in the in the back of my head of some ancient software developer telling me that that rewrites never work? What is why does that not apply here? One piece of good news is

that in some sense we have already done this type of large rewrites as you alluded to with the merge. Like we completely changed the consensus foundations of Ethereum from proof of work uh to to to proof of stake. So, that's in some sense is an existence proof uh that it can be done. Um and, you know, Ethereum is is no stranger to ambitious projects. You know, we've had other like very ambitious things like uh danksharding and and and data availability sampling um that is kind of on a similar scale.

Um another piece of good news is that we have no choice. Uh like we have to, you know, change the cryptography. It is a very strong uh forcing function and that alone, you know, I would argue is is a, you know, 80% rewrite uh anyway. So, um that that is that makes the the the coordination and coming to consensus uh much simpler. And then the other thing else, go ahead. I guess we should emphasize it's not just Ethereum has no choice, no one in crypto has an alternative to this. Everyone in crypto has to do a rewrite. With Bitcoin, it's just ECDSA, but that in itself is enough. Yes, so it's possible that um Ethereum has to do

more of a rewrite than other chains. And this has to do with the number of validators. So, if you only have, let's say, 100 validators, then you know, you can just absorb the cost of the the 10x larger signatures at the consensus layer. It's it's not too much of a big deal. So, for most of the the the the the proof-of-stake chains, actually you don't need the sophistication that that we have. But for Ethereum, we're hoping to have, you know, tens of thousands of validators voting every single slot, which is again like thousands of seconds transactions signatures per per second.

And we we we we have to um we have to be very creative. Where I would agree with you is that there has to be a very big change for all blockchains at the execution layer. But the good news for the other chains is that the firm is doing all the homework. Like we're building lean VM. Um we're going to formally verify the whole the the whole thing and you can just copy-paste it and and it's it's largely an easy job to to integrate it. Nic Carter tweeted out, "One of the dumbest fallacies is people thinking their coin is going to win if only Bitcoin dies. Like the Zcash people fighting Bitcoin over quantum. It's precisely the opposite. If Bitcoin dies, no one will ever trust internet money again. All coins ride on Bitcoin's coattails."

What's your reaction to this sentiment? Yeah, I I I disagree with with with Nic Carter and Nic has always been like very upset when I tweet about the the security budget. You know, he thinks that it's you know, it's destructive of the whole industry to be to be talking about this and uh you know, even though the fundamentals, you know, align with, you know, what I say in my tweet like uh we should be treading more more more more cautiously and ironically like he's doing the same thing with quantum that I'm doing with the security budget, uh which is kind of to try and force force the discussion uh and and and and force uh change. I mean, what about the larger take though, Justin that let's say we get to 2032,

Ethereum is quantum secure, um Bitcoin isn't, Bitcoin gets attacked in some of the ways we've described or there's this treasure hunt going on and there's this market uncertainty as to the outcome. I think what Nic is saying is like, "Don't cheer for that because that's going to be bad for every chain in crypto." And he's further saying, "So goes Bitcoin, so goes everybody else. If you want a meme of a store of value internet money, Bitcoin has to lead that charge. There's like no such thing as a a flippening type scenario of like Ethereum community being able to say, 'Hey, look, you know, our chain is post-quantum secure and we don't have the problems that Bitcoin does.' You're

saying that this will take the entire crypto space down, at least from an internet money store of value perspective." Yeah, I mean, I I disagree and you can just, you know, look at historical analysis where you have, you know, seashells that were superseded by by salt or something and then they were superseded by silver and then gold and then, you know, we even have, you know, Bitcoin, you know, superseding gold potentially. And just because gold fails doesn't mean that the next thing you also has to fail. Um and I'd say, you know, that Ethereum is the very natural successor uh to to to Bitcoin as as internet money. And just because Bitcoin fails doesn't mean that that Ethereum has to fail.

I agree with him that, you know, there might be some short-term pain, uh but we're also talking about long-term gain. So, what do we get at the end of this? So, 2030, uh Ethereum is post-quantum secure. Because Justin promised. >> [laughter] >> Let's uh you know, what what does Ethereum become? Is it sort of the only one in its class or do you expect all other blockchains to kind of follow in its footsteps and to also achieve post-quantum security? Like at that point in time, like what is Ethereum up to? I know there's a broader road map here but um it does seem like a feather in the cap of being post-quantum secure to the extent that that quantum is on the horizon in in the 2030s, but can you describe the system that we have in 2030

if if all of this comes to pass? Yeah, so one interesting shift of mindset for me in in the last few months is that I've I've stopped thinking about post-quantum as, you know, a hurdle that we have to overcome and I think of it more as an opportunity. Right, it's an opportunity for Ethereum to stand out as the very first global financial system that is post-quantum secure. Not just relative to its competitors, you know, like like Bitcoin and whatnot, but also relative to, you know, fiat and and and and and and tradfi. I think it would, you know, send a very strong message and and kind of be a very natural security shining point for the for the world to to to migrate over over to

Ethereum. And not only is it an opportunity for Ethereum to distinguish itself, you know, relative to to its peers, um but it's it's also an opportunity for Ethereum to become the best version of itself. And this goes back to the idea of you know, the move to post-quantum essentially being a rewrite and that being a massive opportunity to start with a clean slate and and wipe out technical debt. One interesting data point here is that the OG beacon chain launched in 2020 and the design of it was frozen 1 year before in 2019.

So, when if and when we ship, hopefully when we ship, you know, lean lean consensus, you know, the the lean beacon chain in 2029, we're going to be upgrading something that is 10 years old. Um and, you know, in as you know, in in crypto 10 years is is an eternity. We've learned so much um that the the the lean beacon chain is going to be very very different from the OG beacon chain. And you can think of it as kind of being proof of stake 2.0. We are in a very interesting time with respect to computing, Justin. There seem to be these these three kind of computing platforms and and paradigms that are really at the frontier shaking things up in ways that will interact

with each other in the ways that will change the course of human history. One is AI, of course, and everyone is aware of what's going on there. And where does that lead? And then we also have quantum, which is maybe where AI was in the 2010s, you know, maybe where in 2018 quantum, something like that as compared to to AI. So, we have quantum and what's that going to shake up? And then we also have crypto and cryptography is best exemplified by, I think, blockchains like like Ethereum and and Bitcoin. So, it almost seems like we're entering kind of a single singularity of these three things where like you know, AI is speeding up a quantum and cryptography

and then, you know, cryptography is going to be useful as kind of a a counter-ballast for the some of the centralization vectors of AI. What do you think of all of this, like Masses? You I mean, you're a cryptographer, so and and you're certainly involved in in at least one of these frontiers. What what's going to happen next? It's very hard to predict, but as you said, there's this very strange coincidence where 2032 seems to be the year where computing in general like reaches the singularity. People have been talking about AI singularity potentially even even before 2032, right? There's like AI 2027, which is a very very famous a write-up. I'm I don't think, you know,

we'll have superintelligence in 2027, but I think it's likely that we'll have it by by 2032. We're already starting to see just yesterday um you know, Cap one of the AI OGs starting to have AIs recursively improve themselves autonomously, um which is like extremely scary. And this is basically the the thing that should start the exponential, at least many people believe should start the exponential towards towards superintelligence. Um we have 2032 as, you know, potentially that being Q day when we have these these these crocs, cryptographically relevant quantum

computer. Is um and we also have 2032 where, you know, Bitcoin will have what I believe its final halving. And I believe, you know, it's it's it's, you know, you could call it B day, right? The the Bitcoin day where, um you know, the the the the some sort of a of a reckoning that that's going to happen because the issuance will be way too low to to secure it. In in 2 years' time, we're going to have one halving and then in 6 years' time in in 2022 32, we're going to have this this other halving.

And you know, this the whole the security story for Bitcoin over the last, you know, 15, 16 years has been that transaction fees are going to replace issuance. I invite you to look at the data. It's just not happening. Transaction fees today are 0.6% of issuance. So, um forget about transaction fees. We're going to have basically an exponential decay of Bitcoin security. And today Bitcoin is secured, roughly speaking, by 10 gigawatts.

And here's a an absolutely crazy, mind-blowing statistic. Every single day China deploys 1 gigawatt. >> [clears throat] >> Every single day China deploys 1 gigawatt, you know, mostly of solar. And so, 10 days' worth of deployment in China is sufficient to 51% attack Bitcoin. It's just In terms of energy cost, which is the thing that shields Bitcoin, China is producing as much energy as it takes to produce to secure Bitcoin every 10 days. So, in terms of the power draw, so Bitcoin in is is drawing 10 10 gigawatts. And you know, a gigawatt is,

let's say, you know, a nuclear plant. So, it's your 10 nuclear plants. And China is deploying the equivalent of a nuclear plant every single day. And you know, that is the, you know, one of the the the main bottlenecks to making attack. The other bottleneck is to have the the rigs, the hardware. And here we're talking about a million rigs. Just a million machines and it will cost you about $10 billion to to to pull off the attack, which in the grand scheme of things is is absolute peanuts both relative to the market cap of Bitcoin, but also for an attacker like a nation-state. Well, when you talk this way about Bitcoin, Justin, it it almost

makes me think that you no longer think Bitcoin should be sort of the vanguard of this crypto movement. You know, it's it's it's it's it's almost the the framing of this is almost like um Bitcoin has some flaws from a security budget perspective, from a quantum perspective, and Ethereum is going to be here to kind of lead crypto after you know, if Bitcoin can't get past some of these flaws. Is that what you believe? >> So, I remain optimistic on quantum. I still think that, you know, ultimately it's rooted in in in a technical challenge that that that can be overcome. The bigger issue I see is the the security budget. Because here we're getting at the core essence, the DNA of

what it means to be Bitcoin, which is to have this 21 million dollar cap and to be secured by proof of work. And I just don't see how you can combine proof of work and 21 million cap. You have to to just lose one. Um so, there is a possibility, for example, uh BTC the asset would decouple with Bitcoin the chain and it could go live on the more secure chain for free. Um and you know, the obvious choice here is, you know, to live as an ERC-20 token, for example, on Ethereum. But you know, that just saying these words, you know is is is impossible.

>> that. No, they don't. So, but you know, if I were to say different words like, "Oh, yeah, we're just going to remove the 21 million limit because we realized that the security budget is insufficient." Bitcoiners also don't think like that. And so, they're heading very fast towards a wall. And 2032 is is the the reckoning day. What about quantum as it relates to the rest of society? Cuz this is not just a crypto problem. Blockchains are uniquely susceptible to quantum computers, but there are other components about society that is also susceptible to quantum computers. Uh so, like yeah, regular uh encryption, for example. To what degree does a post-quantum Ethereum, like the 2029, 2032 Ethereum, represent just a

tool for society to solve stuff, fix stuff, prevent stuff uh in a post-quantum, post-AI world? So, there's basically two flavors of cryptography, if you will. There's real-time cryptography, where you're just signing messages in real time. Um and there's no material impact on on, you know, the actions that you that you made in the past. And I think here, upgrading to post-quantum cryptography should be relatively straightforward for most of most of the internet. There are some exceptions, for example, if you have, you know, satellites that have already been deployed and you literally can't upgrade them, then, you know, they they will be signing

producing signatures that can be forged, but But more of of exception. Then there is another problem which has to deal with encryption. Where if there's material that has been encrypted today and you're not using post-quantum secure encryption today, that means that this data can be decrypted in the future. And there's this whole class of attack called um you know, harvest now and and decrypt later. I think it's realistic um that we're going to have mass decryptions in in society. So we might have uh you know, like lots of signal messages from several years ago or maybe lots of you know,

Telegram messages or whatever. I don't want to pick on one specific platform or maybe like troves of of Gmail messages all being decrypted simultaneously. Um and I think that could have a very significant impact on on society. Justin, when we were talking about these um these three compute technologies, um it it does feel like the one that does that sticks out is AI. And I mean you were talking about 2032 being sort of maybe an AGI type moment. What one just general question I have is as you are a human, uh an extremely talented cryptographer, um extremely intelligent particularly within your domain. But you are not an AGI. You are not artificial general

intelligence. And the concern is as we enter into that computing singularity that all bets are off when it comes to AGI? Like all of the well-laid plans we make in 2026 to have our blockchains be quantum resistant. What if AGI just figures out how to crack crack our quantum resistant cryptography in some other way? Like as a cryptographer, are you worried about the un unknown unknowns of artificial general intelligence and the things that it it could crack? Like what if we're prepared for this quantum world post-quantum world, but we're not

prepared for a post-AGI world? Yeah, so on on the cryptography, I'm like fairly you know, confident about about the soundness. And the reason is that um you you you can prove mathematically that your cryptography is is is correct. So cryptography is a a sub-branch of of mathematics. Um and um you know, you there is this this one exception where you have like the the the these hard problems. And what you try and do generally speaking is that you you calibrate, you parameterize these hard problems so that if someone were to computationally break the hard problem, it would use more energy than there is in the solar system or

something ridiculous um like like like this. Um and you know, going back to the the cryptographic foundations that we're suggesting for post-quantum Ethereum which is hashes, it it doesn't get any stronger than that. And this is in some sense the the weakest cryptography that that that you could hope to have. And this is one of the reasons why I'm cautious about putting the foundations of of of the incentive value um on top of so-called lattices. So NIST has this like two major flavors of of post-quantum signatures. There's the hash-based stuff and the lattice-based stuff. And the lattice-based stuff to me is very reminiscent of the elliptic

curves. You know, these are highly structured objects. You know, lattice suggests that you have these you know, grid if you will of of of of points. And it's very it's plausible uh at least that you know, some AGI or even stronger some ASI, artificial superintelligence, you know, something that is thousands of times smarter than the combination of all humanity could uh could could could crack. Um but you know, the the the hash functions, there's like reasons to believe that it's that it's it's it's strong. You know, even though I'm not too worried about our cryptography, I am worried about something like much deeper if you will if you if you if you zoom out. And I'm more and more worried

about just existential risk for for humanity. And I think more and more people are starting to um you know, understand what Alyssa was trying to say on Bankless um not not not too long ago. I think it's plausible that if humanity were to survive, that Ethereum plays a key role in that happening. Um the metaphor that I have right now is that humanity is driving, you know, in a car at 100 miles an hour. And um there's like all sorts of incentives.

There's this Moloch trap where you know, the big nation states, the TSMC, Nvidia, you know, OpenAI, they're all pressing on the gas. And the car has no brakes. It has no seatbelt. It has no airbag. And while today, you know, we can steer relatively comfortably at 100 miles an hour, next year we're going to be at 200 miles an hour and then the year after that 300 miles an hour. And eventually, we're just going to be driving irresponsibly fast that we're going to crash into a tree or into a wall or we're going to you know, drive off a cliff.

And I think for me working on Ethereum has taken a whole new meaning in the last few months. To a large extent, I was ignoring AI. You know, partly because I was just so obsessed with blockchain stuff, but also partly because it was a toy, you know, just not not long ago. But what's happening is that through my work, especially with formal verification and development and coding, I'm just seeing how powerful this stuff is. And in the last few weeks and months, I've just been obsessed by AI, just learning as much as I can, watching many many uh videos.

And I'm I'm I'm I'm by no means an expert and maybe this is just some sort of a phase that people go through um when they open Pandora's Box, but for me working on Ethereum is now all about defensive accelerationism. And I I don't see other parts of society that are you know, working on the braking system. It's just all all all gas. And the good news, I guess, is that Ethereum has a lot of the thinking and a lot of the tools that potentially could provide some of the solutions. So, you know, by day one we assume adversariality. By day one, we're making use of technology like cryptography that

empowers the weak and make sure that, you know, even the strong, the arbitrary strong, cannot break certain things. You know, we're trying to be this this source of truth if you will. Um we're trying to be decentralized and and and and uh try and and give people um sovereignty. And like all of these words, um you know, they're they're at least in the right direction. And I think it's possible that in the coming months and and and years, we will have some sort of an awakening where society goes oh [ __ ] And it might become uh a a moral imperative to start working on defensive accelerationism. And we might have some of the smartest minds in

the world just naturally come to Ethereum as a potential uh solution as part of a suite of solutions that we need to tackle this. I I love that you're thinking about that. And it does sound like your work on Ethereum gives you meaning. I I have another question on that. So, um being obviously a huge fan of Ethereum David myself, one of the worries I actually have if kind of the AI destiny comes true is like at some level, yes, it's it's a defensive accelerationist technology.

It's um decentralized. It's kind of permissionless. It's pushing power to the small rather than the large. At another level though, it is digital. And we have created a property rights system. And it does seem to be the case that some sort of AGI or uh ASI could leverage our immutable, can't turn it off, world computer for things that humanity actually doesn't want. Are you worried at any level about that being an outcome that it just uses Ethereum for to say, "Hey, humanity, thanks for the property rights system. We'll take it from here. And you've now actually accelerated a technology that you you is

is counter humanity?" I think this is a very fair point. Um and you know, ultimately Ethereum is a tool uh which could be used, you know, by both the humans and and and the AIs. Um now maybe this is this is cope, but the one way to to think about it is that if you remove Ethereum, there doesn't seem to be like many other alternative products that people are building in the defensive accelerationist space. It's pretty much all accelerationist. And so, yes, maybe Ethereum will accelerate some things. But in some sense, it's one of the only hopes that we have

for for for for defensive acceleration. And so, as such, I think it's it's still rational to be you know, trying to ship the straw map by 20 2029 and and and doing my best to to make sure that Ethereum will be ready for an age of artificial superintelligence. This last question as we draw this to a close, Justin. This has been absolutely fantastic. Thank you. And maybe this is a kind of a personal question as you've had an AI awakening over the last few months.

I I now notice you're qualifying the the Ethereum with like if humanity survives. So, Ethereum plays a key role if humanity survives. Those words are hard to say for me. It's hard to actually get that out of my mouth because that is a caveat that I've not had to think about or deal with like the real possibility that the technology accelerationism means humanity doesn't survive. How do you deal with that personally? I'm relatively zen about it.

I've reached a point where, you know, I'm I'm happy to die, you know, I've lived a very happy [laughter] life. Um What? David, you're shocked. >> [laughter] >> That was not the answer I was expecting. >> [laughter] >> I think you just need to to to keep hope, you know, you just need to, you know, put it aside, you know, the so-called p-doom. Like, what is the probability of of doom? Like, my p-doom now is, you know, relatively high. I think it's more than 50%. But, I I don't want to say this out loud, you know, I don't want to >> to live in that that pessimism.

Yeah, exactly. I don't want to discourage myself and make my life miserable. And maybe more importantly, I don't want to discourage other people, you know, and have them lose hope. Um and so, I think we should just be, you know, doing our best with what we have. The future is highly highly highly unpredictable. And so, even though like my p-doom kind of went way up in the last few weeks and months, this is a uh you know, strong opinion weekly held. And I want very smart people to come forward and tell me why I should I should not be uh so scared. I must be you know, more optimistic and and and more hopeful. And you know, just as I said, I've only been thinking about this

for like literally weeks and months. I'm just scratching the surface. The big wake-up call for me was uh Opus 4.5, where Emil told me um from you know, from this point onwards, AI is actually helping me becoming more productive. Before that, it was kind of net slowing me down. Um and then what we've seen in the last few weeks is more and more impressive results. So, for example, uh about a month ago, one of the key lemmas in the hash-based snarks, it's called the PolyShocks-Spillman lemma, um that was proven formally verified um in 8 hours and it cost $200. Something that

would have cost, you know, 100 times more if a human were to do it and would have taken 100 times more time if a human were to do it. And then I also mentioned that the the Fields Medal uh result, um which only took 5 days to generate a a 500-line uh proof. Um and you know, you can just it's kind of obvious, right? Like, we're going to have all the known mathematical theorems just be either, you know, checked and verified by the the the AIs with all of the typos corrected. And you know, for some small subset of of of quote theorems, we're actually going to have a you know, a demonstration that these are

actually incorrect and there might be counterexamples. And um you know, it already seems like programming is is largely solved. And then we're going to solve, you know, scientific progress and and all sorts of other things. And you know, really things get philosophical extremely quickly. And you know, maybe that's for another episode. Yeah, I I I do think that is for another episode, Justin. It's a it's a fantastic answer though. I appreciate your insight into approaching this with some level of stoicism and then agency, which is working on things that are meaningful to you. And we hope, if humanity survives, to do many more of these podcasts with you in the future.

It's always a treat to have you, Justin Drake. Thank you so much. Thank you. Got to let you know, of course, crypto is risky. So is the real world. You could lose what you put in, but we are headed west. This is the frontier. It's not for everyone, but we're glad you're with us on the Bankless [music] journey. Thanks a lot.