The chain publishes its own consolidated inventory, and it is specific. The roadmap of 2026-09-10 tabulates eleven quantum-vulnerable components with the primitive and the consequence of a break for each: RLPx session key agreement under secp256k1 ECDH, discv4 and discv5 with ENR signing under secp256k1, operator transport under classical TLS key exchange, account and transaction signatures under ECDSA over secp256k1, node identity under secp256k1, validator vote keys under BLS12-381, fast-finality vote aggregation under BLS12-381 aggregate signatures, blob commitments under KZG over BLS12-381, the pairing precompiles 0x06 to 0x08 under BN254, the EIP-2537 precompiles under BLS12-381, and cross-chain light-client and relayer verification under Ed25519 plus BLS12-381. A twelfth row scopes Keccak-256 and SHA-2 out as Grover-only. The deployed set is checkable against the client source, where the precompile table carries p256Verify at 0x0100 and the EIP-2537 BLS12-381 operations. Points are withheld for three gaps: the inventory is carried in an unmerged draft, it stops at the protocol boundary and names no key material held by the off-chain signer set that operates the canonical bridges, and no BNB Chain document states which Ed25519 verification rule the cross-chain precompile enforces, cofactored or cofactorless, or whether it rejects small-order keys; the client delegates that check to its CometBFT dependency rather than specifying it.

The classification is published and it is close to the per-primitive tagging this sub-score asks for. The inventory separates the two threat classes by name: the three transport rows are marked as the only ones where delay itself causes permanent loss, because recorded ciphertext can be decrypted later, while every other row needs the quantum computer to exist at the moment of attack. It also isolates the Grover-only surface, stating that block hashes, Merkle-Patricia proofs and Keccak lose half their effective strength and are recovered by a longer output, which is why the work is confined to public-key cryptography. Three refinements are missing. KZG blob commitments are tagged as one permanent exposure, where BEP-336 keeps blobs for about 18.2 days and the data behind an EIP-4844 commitment is pruned after that window, so a forged opening is a short-shelf-life threat rather than an equivalent of a permanent account key. BN254 and BLS12-381 are treated as one pairing family without separating their classical security levels. And the candidate schemes are listed without stating whether the pure or the pre-hash variant is meant, ML-DSA-44 or HashML-DSA-44 under FIPS 204, which is the normal case on a chain that signs digests.

Zero post-quantum algorithm families are deployed, which scores 0 under the family-count rule. The candidate set is lattice-weighted: the only fully specified companion proposal requires ML-KEM-768 per FIPS 203, and the signature candidates named in the roadmap are ML-DSA-44 per FIPS 204 and Falcon-512 from the round-3 submission, which are the same family, so a deployment of both would add no diversity. One hash-based option appears in the comparison table, named without its hash family and therefore not identifying an approved FIPS 205 algorithm, and it is not selected. No code-based family is named anywhere, and no isogeny scheme is named. Nothing here reaches the one-family floor, because a family counts when it is deployed, not when it is tabulated.

No document maps categories 1 to 5 to primitives, but the parameter sets are pinned in two places, which is what makes a category readable. The draft transport handshake requires X25519MLKEM768 and fixes ML-KEM-768 per FIPS 203, at category 3, with the encapsulation-key, ciphertext and shared-secret sizes written out. The proof-of-concept branch fixed ML-DSA-44 per FIPS 204, at category 2, and states its reason for preferring it over ML-DSA-65, a claimed match to the effective post-quantum security of BLS12-381 at a smaller signature. Credit stops there. Two of the four candidate signature rows are unreadable as categories: the hash-based row names no hash family, so it selects neither of the two approved 128s algorithms under FIPS 205, and the Falcon row is written under a standard name that has no published document and therefore no NIST parameter sets, where the buildable reference targets category 1 in the round-3 submission. On the classical side the deployed curves carry no post-quantum category at all, which is the point of the migration.

The deployed cryptography is the go-ethereum lineage: secp256k1 ECDSA, Keccak-256 and the BLS12-381 and BN254 pairing code, all long-reviewed classical primitives at the top cryptanalytic tier, in an open client whose precompile set and fork activation times are readable in source. The draft transport handshake is the strongest implementation-quality signal: it requires the Go standard library's ML-KEM-768, X25519 and HKDF, so it introduces no new third-party cryptographic module, mandates the FIPS 203 section 7.2 encapsulation-key validation, requires a fresh key pair per handshake with no caching or reuse, binds the key schedule to a hash of the full transcript, requires zeroization of every shared secret after key derivation, and requires a length check before parsing a peer's share with an abort rather than a downgrade on a malformed one. Against that: no post-quantum verifier is deployed, so there is no deployed-verifier provenance to assess; the library and dependency policy that would set constant-time requirements, FIPS posture and audit expectations is a not-started line item with no proposal number; no audit or reproducible build is published for the proof-of-concept branch, whose pull request is closed; and the candidate schemes carry the lattice confidence discount, with Falcon sitting at the selected-but-not-final tier.

Exposure is structural and the chain says so. On an account model that recovers the public key from the signature, every address that has ever broadcast a transaction has published the public half of its ECDSA secp256k1 key, and the roadmap gives that as the reason its signature phase is the largest asset-security surface. The roadmap also gives address reuse as the norm, so the exposed set is not confined to a dormant tail. No mitigation is live: there is no key rotation for an externally owned account, no post-quantum verifier to rotate to, and no rate limit or monitoring on spends from exposed keys. The small credit is for the published binding model that would let an exposed account move to a post-quantum key without changing its address, which is the right shape and is not built. No public source quantifies the share of circulating BNB held at addresses that have revealed a public key.

An address that has only ever received value has revealed nothing: the address is a Keccak-256 derivation of the public key, so the key stays hidden behind a hash until the first outbound transaction, and that hash is a Grover problem rather than a Shor one. That is a real structural mitigation and it is what this score credits. It is bounded in two ways. It evaporates the moment such an address spends, which moves the balance into the exposed bucket, and it protects nothing for contracts, for exchange-operated hot wallets or for any long-lived account that has transacted. No public source measures how much value sits at never-spent addresses on this chain, so the size of the mitigated set is not established.

Long-range exposure scores 2 of 13. Signatures stay on chain permanently and stay valid, exposed public keys on dormant balances retain their exposure indefinitely, validator BLS12-381 vote keys are public for as long as their holder sits in the validator set, and the cross-chain path carries Ed25519 and BLS12-381 keys whose attestations authorize movements of value. No sunset date exists for any of them. Short-range exposure scores 5 of 12, all of it from the window factor: the block interval is 0.45 seconds since 2026-01-14 and fast finality under BEP-126 closes the window within a small number of blocks, so the interval between a spend revealing a public key in the public mempool and its confirmation is short. The exposure-discipline factor is 0, because single-use addresses are not enforced, the mempool is public, and no post-quantum spend path exists to move value to. This sub-score covers user spends only. Standing consensus exposure sits in Dim 4 sub-score 4f, since validator keys are public for the whole epoch and a fast block interval is no defense against forging a vote from a key that was never hidden.

This is the exposure that accrues today, and the chain's own roadmap names it as the only class where delay causes permanent, irreversible loss. Peer-to-peer sessions agree keys with secp256k1 ECDH under RLPx, so traffic recorded now is readable once the curve falls. Operator-facing transport is worse in practice than in specification: the chain's own published RPC endpoints, bsc-dataseed.bnbchain.org, bsc-dataseed1.bnbchain.org, bsc-dataseed-public.bnbchain.org and bsc-dataseed1.binance.org, negotiate TLS 1.2 with ECDHE over P-256 and an RSA certificate, and TLS 1.2 has no mechanism for a hybrid key-agreement group, so the transport that carries user transactions to those nodes cannot be made post-quantum without a protocol-version change. A third-party public endpoint for the same chain, bsc-rpc.publicnode.com, negotiates TLS 1.3 with the hybrid group X25519MLKEM768, which shows the mitigation is available at the edge and is not applied at the chain's own. The credit is for the draft handshake specification, which fixes X25519MLKEM768 for RLPx v5 with a concatenated shared secret in an HKDF-SHA256 schedule and requires no hard fork, and which no client release contains.

Pseudonymous and fully transparent. Every transfer, contract call, validator vote and cross-chain message is public, amounts and counterparties included, and the protocol contains no shielded pool, no stealth-address scheme and no ring signature. The chain's own inventory of quantum-vulnerable components confirms the architecture from the other side: it has no row for a privacy primitive, because there is none to migrate. No structural-impossibility statement is published naming what a single validator, a validator quorum, an RPC provider or a bridge relayer can observe, so nothing bounds the visibility from the other direction either.

Three components. Provider concentration scores 2 of 8: several chain-operated dataseed endpoints and a number of independent public endpoints exist, so there is no single mandatory entry point, and no public source measures what share of transactions originates through the top three providers, so no inverse credit can be established beyond the plurality of endpoints. Mempool and gossip observability scores 3 of 7: the mempool is public and any node can observe broadcast, which is transparent rather than private, while the builder API of BEP-322 is enabled, so a transaction can reach a block through a builder's bid rather than only through the public mempool. That specification claims no confidentiality for the bid path; the one privacy property it states is for the validator, whose optional sentry hides its real network address from builders. Validator metadata retention scores 0 of 5, because no policy on retention of peer IP addresses, timing or client fingerprints is declared.

Cross-chain bookkeeping is visible end to end. The light-client verification precompile at 0x67 records the validator set and the relayer signature field for each accepted package, and the canonical bridges post their lock, mint and withdrawal legs on chain, so a passive observer links a source transaction to its destination by amount and timing without privileged access. A third-party protocol-risk analysis describes the canonical bridges as resting on an off-chain multi-signature and MPC signer set rather than a trust-minimized construction, which concentrates the correlation further, since one operator sees both legs. The hardening shipped on 2026-08-25 tightened how duplicate validator entries are counted toward the cross-chain signature threshold, which is a soundness fix and changes nothing about observability.

Nothing on the ledger is encrypted, so a break of secp256k1 or of the pairing curves does not retroactively decrypt transaction content: there is no note ciphertext, no encrypted memo and no discrete-log ring signature to unwind, and no zero-knowledge construction stands between an observer and the transaction graph. What a break does expose retroactively is recorded transport. Sessions agreed under secp256k1 ECDH over RLPx and sessions terminated under TLS 1.2 with ECDHE over P-256 at the chain's own RPC endpoints both become readable after the fact, and what they carry is origination metadata: which address submitted which transaction from which network location, and which peer relayed it. That is a smaller loss than a shielded chain's, and it is not zero. No structural-impossibility statement is published bounding what that recorded transport reveals after a break, so the residual is stated rather than bounded.

None. The protocol contains no cryptographic shuffle, no batch-ordering or commit-reveal construction, no mix network with cover traffic, and no structural hiding of any kind. Transactions are relayed in the clear over the peer network and ordered by a validator or a builder. No mechanism can be named here, so the sub-score takes the floor of the rubric rather than a judgement.

The chain has demonstrably added a signature-verification algorithm without redesigning the protocol: the p256Verify precompile at 0x0100 verifies ECDSA over secp256r1 and has been in the live precompile set since the 2025-03-20 activation, ahead of the upstream client, and its gas and semantics were updated to the EIP-7951 form at the 2026-04-28 activation. EIP-7702 delegation has been live since the same 2025-03-20 activation, which gives an externally owned account a route to contract-defined verification. Against that, the roadmap is blunt about the underlying format: the chain encodes which algorithm is in use implicitly, by field position and width, so a 65-byte signature is ECDSA and a 48-byte key is BLS12-381 because nothing else could occupy the field, and a verifier cannot be told to use a different algorithm. The one exception it names is the EIP-4844 versioned hash, whose leading byte declares its commitment scheme. The fix, an algorithm registry with governance for adding and deprecating entries plus self-describing (algorithm, bytes) envelopes for keys, signatures and commitments, is listed as not started with no proposal number, and the roadmap makes it a prerequisite for the first algorithm swap. No post-quantum verifier exists on chain: the one proposal for a Falcon-512 verification precompile has sat as an unmerged community draft since 2025-05-19.

Account abstraction is live and standard. The ERC-4337 EntryPoint at version 0.7 is deployed at its canonical address on mainnet, and EIP-7702 delegation has been active since the 2025-03-20 fork, so a user can already put contract-defined authorization behind an existing address. That is the account-model component at full credit for account abstraction alone. Nothing lifts it further. The seed-derived rebind floor does not apply, because standard accounts commit to an ECDSA secp256k1 key rather than an RFC 8032 Ed25519 seed. There is no documented client-layer path that would give a user post-quantum protection at the wallet or signing-device layer, since no post-quantum verifier is available on chain for a smart account to call, and the wallet, keystore and tooling standards line of the roadmap is not started. The address-preserving binding model that would let an account adopt a post-quantum key is described in a draft with no specification behind it, so it earns no rebind credit.

Coordination capability is the chain's strongest asset here, and it is verifiable from the client's own fork schedule rather than from announcements. Mainnet activations run Pascal and Prague on 2025-03-20, Lorentz on 2025-04-29, Maxwell on 2025-06-30, Fermi on 2026-01-14, Osaka and Mendel on 2026-04-28, and Pasteur on 2026-08-25, each at a fixed timestamp with a required client release, and the testnet activation of Pasteur ran five weeks ahead of mainnet on 2026-07-21. Osaka and Mendel carried nine proposals together. A further upgrade was assembled on 2026-09-20 with four proposals scheduled. No persistent minority chain and no contested activation is recorded in the public record for any of them. The single point withheld reflects what the cadence has not yet been used for: none of the activations changed a cryptographic primitive, and the fork-coordination muscle is unproven on the one kind of change this index measures.

Split by layer. At transport the answer is yes and it is worked out: the draft RLPx v5 handshake adds a hybrid group to the existing handshake rather than replacing it, keeps the classical shared secret in the key schedule so the result is never weaker than today against a classical adversary, negotiates by capability with a defined downgrade to version 4, needs no hard fork because transport is not consensus-critical, and requires no new third-party cryptographic dependency. That is hybrid readiness in the architectural sense the rubric asks for. At the signature and consensus layers the answer is no. No construction exists that would let a classical and a post-quantum signature co-verify, no combiner is specified, no scheme is selected, and the one implementation that was attempted replaced BLS12-381 votes with ML-DSA-44 outright rather than composing them. The roadmap's coexistence rule, that no proposal removes a classical path in the same change that introduces its replacement, keeps unupgraded nodes and wallets working across an activation, which is a compatibility guarantee rather than a hybrid signature.

Full credit under the stateless-only default, not for any state-management engineering. No stateful hash-based scheme is deployed or proposed: no XMSS or XMSS^MT per RFC 8391 with the approval status of NIST SP 800-208, no LMS or HSS per RFC 8554, and no Winternitz construction appears in any chain document. The signature candidates named in the roadmap are ML-DSA-44 per FIPS 204, one hash-based option under FIPS 205 named without its hash family, and Falcon-512 from the round-3 submission, all of them stateless, so no signing state can be reused, no state-tracking protocol is required, and no backup-restoration hazard arises. If a stateful scheme is ever selected, this sub-score becomes a real test and the Stage 5 requirement for a 90-day operational record without a state-reuse incident attaches with it.

In scope, because consensus depends on Shor-vulnerable aggregation: validator votes are BLS over BLS12-381 and are aggregated into the fast-finality attestation under BEP-126, and those validator public keys are public for as long as their holder sits in the validator set, so a forged vote or a fabricated quorum does not have to race a confirmation window and a 0.45-second block interval is no defense. A direction is declared, hash-based replacements for the pairing family, and an implementation of one exists: the proof-of-concept branch replaced the BLS aggregate with a recursive STARK proof over the validator committee, carried it on its own peer sub-protocol, and reported roughly 43 to 1 compression of the vote payload, measured over six validators' signatures rather than over a full consensus set. The score stays low because the rubric's first paid band requires a merged specification and there is none: both roadmap documents are unmerged Information-type drafts, the BSC-specific one states in its own text that it specifies no algorithms, parameters or wire formats, the aggregation line item in its series index carries no proposal number and the status Research-gated, the family-level status index records this phase as not started and research-gated, and the pull request that carried the prototype was closed without merging. The roadmap states the reason plainly, that post-quantum aggregate signatures remain an industry-wide open problem and that a replacement must aggregate a full validator set's votes within the vote deadline at a 0.45-second interval.

Zero percent. No post-quantum primitive signs or encapsulates anything on mainnet. All transaction signing is ECDSA over secp256k1, all vote signing is BLS over BLS12-381, and all peer key agreement is secp256k1 ECDH. No named public testnet runs a post-quantum scheme either: the one implementation was exercised only in the chain's own benchmarking and reported as a proof of concept, and its pull request was closed without merging. The upgrade activated on 2026-08-25 contains no cryptographic-primitive change, and the upgrade assembled on 2026-09-20 schedules four proposals, none of them post-quantum. Migration Stage derives from this sub-score.

Nothing is merged. The client's dependency manifest on the default branch contains no post-quantum library, no Open Quantum Safe binding and no lattice or hash-based signature package, and the precompile set contains no post-quantum verifier. Real code was written and is public: a draft pull request opened on 2026-04-28 against the development branch carried roughly 4,800 added lines across 58 files, introducing an ML-DSA-44 transaction type with an on-chain public-key registry, an ML-DSA-44 vote manager and pool, a STARK-based vote attestation and a new peer sub-protocol to carry post-quantum votes, behind an operator opt-in flag. It was closed on 2026-05-11 without being merged, so it is neither in a release nor on a public testnet. The single point records that the code exists and is inspectable, which is more than a specification and less than testnet-only code, which the rubric already discounts.

Zero percent of the validator set holds or uses a post-quantum key. The daily election ranks candidates by stake into a 45-validator set, and each epoch draws a 21-validator consensus set from it; every one of those operators signs with BLS over BLS12-381 for votes and holds an ECDSA secp256k1 identity. The opt-in post-quantum vote key that the proof-of-concept branch added never reached a release. This is a real zero rather than a not-scored sub-score, because key-holding block producers exist and their keys could have been migrated. No credit is taken here for user-transaction signing, which is measured in 5a.

Zero on two independent grounds. This sub-score is voided whenever 5a is zero, because milestone discipline without shipped mainnet traffic is publishing rather than engineering. Independently, there is no dated milestone to score. The roadmap of 2026-09-10 publishes no target date for any phase: the crypto-agility phase and the signature phase are listed as not started with no proposal numbers, the transport phase is a draft, and the pairing phase is declared to have no fixed activation date because it is gated on unresolved research. The family-level status index lists every phase for this chain as not started. No protocol-enforced deadline binds any of it, and with no prior published post-quantum date there is no hit, slip or miss record to weigh.

Near-full credit, because the gap between what is claimed and what is shipped is small and the engineering artifacts are real. One announcement in the trailing twelve months claims post-quantum work in the present tense, the migration report of 2026-05-14, which names ML-DSA-44 per FIPS 204 and a post-quantum STARK aggregation. The two roadmap drafts that followed it describe proposed work and state their own unmerged status, so they are not counted as announcements. Mainnet bytes signed under either are zero, so the ratio sits at the floor of the scale and triggers neither the 1.5 deduction, the 2.0 cap nor the 5.0 narrative-only tag. The report is candid about status in its own body, stating that the work reflects a forward-looking approach rather than a response to an immediate risk, reporting a throughput cost of roughly 40 to 50 percent in tests rather than a success, and it is accompanied by inspectable code and, four months later, by two roadmap documents that describe themselves as proposed and unmerged. Three points are withheld for one thing: the report's summary line says in the present tense that transaction signatures and consensus votes are migrated to ML-DSA-44 and post-quantum STARK aggregation, which describes a proof of concept in the grammar of a completed migration, and secondary coverage has repeated it as adoption.

The chain has measured the cost and published it, which is worth credit, and the number lands in a heavy band. Against a 65-byte ECDSA secp256k1 signature, the roadmap's own comparison gives ML-DSA-44 at 2,420 bytes, roughly 37 times, the FIPS 205 hash-based option at 7,856 bytes, roughly 121 times, and Falcon-512 at about 666 bytes, roughly 10 times. The candidate the implementation used, ML-DSA-44, falls in the 10-to-38 band. The measured effect was reported as transaction size rising from 110 bytes to about 2.5 kilobytes, block size to about 2 megabytes and throughput falling by roughly 40 to 50 percent in tests, at a 0.45-second block interval that the roadmap treats as a liveness constraint rather than a fee question. Credit is added for a documented aggregation route at consensus, the STARK vote attestation reported at roughly 43 to 1 compression, about 14.5 kilobytes of raw signatures reduced to about 340 bytes, which is the kind of batching that pushes an effective multiplier down. That ratio was measured over six validators' signatures, not over a full consensus set, and the roadmap's own constraint is a full set aggregated and verified inside the vote deadline. No recalibration of transaction-weight or fee accounting is documented, so a post-quantum transaction would carry its full size as cost to the user, and none of this is deployed, so every figure is prospective.

One named vendor in this tile publishes a post-quantum program with a date: the Ledger embedded-OS SDK, documented June 2026, implements ML-KEM-512, ML-KEM-768 and ML-KEM-1024 per FIPS 203 and ML-DSA-44, ML-DSA-65 and ML-DSA-87 per FIPS 204 as device primitives, with ML-DSA-87 off by default because it exceeds the stack budget on one device family without the low-RAM build flag. That is the whole of the credit, and it is thin for three reasons: the document addresses the primitives on the device and not the signing of blockchain transactions, no chain-side verifier exists for such a signature to be checked against, and the same document states that version 1 carries only algorithmic protection, constant-time comparison and zeroization, with no hardware countermeasure against fault injection or side-channel attack and masking and shuffling deferred to a future version. No other major wallet in this chain's path publishes a post-quantum roadmap; industry surveys describe software and hardware wallets as signing with ECDSA or Ed25519 today and treat wallet-side quantum resistance as conditional on the chain activating a post-quantum scheme first. The chain's own report confirms the dependency runs the other way as well, since its proof of concept preserved the address format and required no wallet or SDK change.

Zero. The canonical bridges are described by third-party protocol-risk analysis as resting on an off-chain multi-signature and MPC signer set rather than a trust-minimized light client, so bridge security depends on the key management of that signer set, and no post-quantum plan for those keys is published by anyone. On the chain side, the verification path is the light-client precompile at 0x67, which checks Ed25519 signatures from a CometBFT validator set together with a BLS12-381 relayer key; the change activated on 2026-08-25 made it reject a validator set that lists the same validator more than once when counting toward the signature threshold, which removes a double-counting route to the supermajority and leaves both algorithms unchanged. No third-party bridge operating on this chain publishes a post-quantum roadmap for its verifier or its signer set.

Zero. No custodian or exchange holding this chain's assets publishes a post-quantum roadmap for its signing or key-management stack, and none is named in any chain document. This is the highest-concentration surface on the chain, since exchange hot wallets, deposit and withdrawal signing and TLS termination sit in front of a large share of user balances, and the public record is empty on all of it. The scheme-choice question that usually constrains this tile does not yet arise, because no post-quantum signature scheme has been selected for the chain; when one is, the MPC-compatibility difference between a lattice scheme and a hash-based one becomes a custodian constraint rather than a protocol preference.

Zero. No RPC provider serving this chain publishes a post-quantum roadmap, no HSM vendor is named in any chain document for validator key storage, and no trusted-execution vendor attestation path is published for the block-building infrastructure. The observable state of the chain's own endpoints goes the other way: bsc-dataseed.bnbchain.org, bsc-dataseed1.bnbchain.org, bsc-dataseed-public.bnbchain.org and bsc-dataseed1.binance.org all terminate TLS 1.2 with ECDHE over P-256 and an RSA certificate, a configuration in which a hybrid key-agreement group cannot be negotiated at all, while an independent endpoint for the same chain, bsc-rpc.publicnode.com, already negotiates TLS 1.3 with the hybrid group X25519MLKEM768. The roadmap's operator-transport line item, which would address exactly this, has no proposal number and is listed as not started.

Concentrated by design. A daily election after 00:00 UTC ranks validators by stake and takes the top 45: the 21 highest-staked are Cabinets and the remaining 24 are Candidates, and each epoch draws a 21-validator consensus set of 18 Cabinets and 3 Candidates to produce blocks, with slashing for a missed turn. A set that small, selected by stake rank under a proof-of-staked-authority scheme, coordinates a migration quickly and concentrates the decision in few hands, which is a strength for execution speed and a weakness for the credibility of a contested change. Client diversity is a further constraint: the chain publishes one reference client implementation and each mainnet activation names a single required release of it, so a cryptographic change would be written once and audited once. No public source establishes a current Nakamoto coefficient for the stake distribution, and no public source measures the share of the validator set running any second implementation.

A dense and dated record. Seven mainnet activations between 2025-03-20 and 2026-08-25 landed at fixed timestamps, each with a required client release, and the most recent was security-focused: it closed a double-counting route in the cross-chain verification precompile, tightened consensus-key rotation so that a rotated key loses validator-admin authority and a pending slash eviction follows, rejected blacklisted addresses on the signature-based governance vote functions, and changed block building so a validator can sign a pre-executed block, with testnet throughput reported rising from 1,237 to 2,324 transactions per second at an unchanged 450-millisecond interval. It ran on testnet from 2026-07-21 and on mainnet from 2026-08-25. The points withheld reflect that the cadence has never been exercised on a cryptographic primitive, which is a different class of change from a gas rule or a timing parameter.

There is an author and there is no owner. The migration roadmap is a single individual contributor's pull request, opened on 2026-09-10 and still open, and no other public document names a working group, a lead, a mandate or a budget for the migration. Two things earn the partial credit: the roadmap assigns each phase to a named series of companion proposals with a status column, which is an accountable structure, and it states which phases need the standard governance process, the signature and pairing phases including a governance vote where required, and which does not, the transport phase, which ships through client releases. Neither of those is a named coordinator, and the status column currently reads not started for every line that matters.

A precedent exists for coordinating under live attack, and it is not a cryptographic one. On 2022-10-06 an attacker forged a low-level cross-chain proof against the native bridge between BNB Beacon Chain and BNB Smart Chain, the BSC Token Hub, and withdrew 2 million BNB, and the network was suspended while the exploit was in progress by contacting community validators one by one, which the chain reported kept the vast majority of the funds under control. The chain's own account of it records 26 active validators at the time and 44 in total across time zones. That demonstrates the set can be assembled and act within hours under pressure, and it also shows what that capability rests on, a short list of operators reachable out of band. The change that followed was to proof-verification logic and governance rather than to a cryptographic primitive, and a different precompile on the same cross-chain verification surface, the light-block validation at 0x67, was hardened again on 2026-08-25 against duplicate validator counting. Nothing in the record shows this chain replacing a signature scheme, or any primitive, while an adversary was actively exploiting it.

None. No document defines a trigger for any migration phase: no monitored honeypot at an exposed address, no rate-limited spending rule for keys with revealed public keys, no consensus-embedded tripwire with a published threshold, and no automated response. The one schedule contingency that exists is the opposite of a tripwire, since the pairing phase is declared to start when research is ready rather than when a measured condition is met, and the roadmap states no quantum-computing capability threshold, no dated go or no-go point and no monitoring commitment.