A future quantum computer can break today's signatures. Winternitz Vault is a quantum-resistant vault built from hashes alone. Let's find out why it's needed — hands-on.
Blockchain security rests on elliptic-curve signatures (Solana uses Ed25519). A future quantum computer could use Shor's algorithm to recover the private key from the public key. Hash functions, by contrast, only get a quadratic speedup from Grover — effectively still safe. So a quantum-resistant vault is built from hashes alone.
One quantum computer attacks two kinds of lock at once: an elliptic-curve lock and a hash lock. Which one breaks first?
Quantum computers don't exist yet — but the attack can start today. An adversary stores traffic and public keys now, and decrypts them in the quantum era. That's Harvest Now, Decrypt Later.
A normal Solana address is the Ed25519 public key itself (32 bytes, base58-encoded). So every account shows its public key on-chain the moment it's used to receive. If quantum computers become real, Solana addresses could be targeted across the board — which is exactly why hiding the key behind a hash-derived PDA (as the Vault does) matters.
On March 30, 2026, Google Quantum AI estimated in a whitepaper that a quantum circuit solving ECDLP-256 (the secp256k1 curve) could be compressed to ~1,200 logical qubits and 90M Toffoli gates — runnable on a standard superconducting machine with fewer than 500,000 physical qubits, in minutes (roughly a 20× reduction over prior estimates). It also drew attention as an industry-first "responsible disclosure," hiding the circuit details behind a ZK proof.
That estimate targets Bitcoin/Ethereum's secp256k1. Solana's Ed25519 (Curve25519) is a different curve, but the same elliptic-curve family — and equally vulnerable to Shor's algorithm.
Hash a secret value x over and over and you build a "ladder" of values. The top rung (step 15), H¹⁵(x), is handed out as the public key. To sign a number m, you reveal the value at rung m, Hm(x) — that's the signature. A verifier climbs the remaining (15−m) rungs themselves; if the top matches the public key, the signature is genuine.
Let's walk through signing and verifying one step at a time. Read each step and press Next.
We just said the signer reveals the value at rung m. But what actually travels to the verifier, and where does the verifier learn which rung it is? Answer that and the next demo clicks into place.
First see the weakness of a single ladder, then, step by step, how a second ladder — the checksum — defends against it.
The scheme is named after Robert Winternitz of Stanford. It refined the Lamport signature (1979) so one key could sign more bits, and spread through Ralph Merkle's work. Nothing to do with winter — the ❄️ motif here is just a play on the name.
A signature is made of several ladders (message + checksum). One signature is safe, but signing twice with the same key hands the attacker two sets of "parts" they can mix to assemble a fake signature. Let's try it.
Same setup as Tab 01 — two 16-rung ladders (message and checksum) with the rule that they always add up to 15. The attacker wants a signature for a number that was never signed.
The answer is simple: sign only once, then move to a fresh vault each time. A used key is never reused, so there's no "second signature" and no parts to mix. Next, we'll see how Solana's Vault makes that move.
The Winternitz Vault is a program on Solana. It has just three instructions — Open a vault, Split (pay and move), and Close. These three carry out the "key used once = move every time" idea from Tab 02.
Solana's runtime knows only one signature scheme: Ed25519. There is no field in a transaction that says this one is WOTS. So how does a WOTS signature get through at all?
Let's walk through Open, Split, and Close. Tap the term chips under the diagram to see what each means.
Every payment sends the change to a fresh vault. Used keys are never reused; you hop from vault to vault. This "unbroken chain" keeps quantum resistance intact.
To fit compute and data-size limits, the verification hash is truncated to 224 bits. Bit-widths are chosen per use so that enough security remains even after truncation.
Why Keccak, not SHA-256? When the hash is truncated, the two differ in resistance to length-extension attacks.
This vault can protect lamports (SOL) only. Other assets can't be deposited.
※ This is a spec limitation (a deliberate scope choice).
The program has an "update authority." Even if the vault itself is quantum-resistant, if that authority is left as a normal keypair, it remains a weak point. Toggle the button to change how it's protected.
Tap each date to expand the details. Use "Next" to step through in order.
Winternitz Vault (the opt-in vault) and Winterwallet (an end-to-end quantum-resistant wallet on devnet/mainnet).
Solana's own migration to Falcon. Phased roadmap: keep researching → PQ for new wallets → migrate existing wallets.
A "personal shelter" you can use today. Chosen individually by those who want long-term storage.
A future "building-wide seismic retrofit." Protects everyone at the protocol level — a slow, large project.