A quantum computer does one thing to Ethereum: from the public key a wallet published with its first transaction, Shor's algorithm recovers the private key. We can't run it yet, so this page plays its result. The attacker gets the victim's ECDSA private key and tries to take everything. FORS+C keys have no such shortcut: their secret sits behind keccak, which no quantum algorithm inverts.
1The victim, before Q-Day
One click makes a fresh MetaMask-style wallet and gives it what people really hold. Run it before you record; it takes about two minutes on Sepolia.
A wallet with ETH and tUSDCfunded by Opaque's faucet
A FORS+C guard keyregistered once, with an ordinary transaction
Money in the Q-Day vault0.01 ETH and 50 tUSDC
Two protocolsone owned by the wallet, one handed to its PQAdmin
The owner's new walleta little gas, for after Q-Day
Two stealth paymentssecp256k1 (ERC-5564) and ML-KEM-768
2What the victim holds
Without Opaque
The walletREADY—
A protocol it ownsREADY—
A secp256k1 stealth paymentREADY—
With Opaque
The Q-Day vaultREADY—
A protocol behind PQAdminREADY—
opaque.ethREADYheld by PQNameController, which obeys only FORS+C
An ML-KEM-768 stealth paymentREADY—
3Q-Day
public key, on chain since its first transaction: private key, as Shor's algorithm would return it:
Takenthe wallet's ETH and tUSDC · the protocol it owned · who was paid secp256k1 stealth payments
Refused by the chainthe vault · the protocol behind PQAdmin · opaque.eth · ML-KEM stealth payments
4The owner, after Q-Day
The cracked key took the wallet. The guard key still decides everything Opaque protects: it signs in this page, and a brand-new wallet submits, because paying authorises nothing.
Testnet only, with throwaway keys made in this page. The private key shown is the victim's own, generated here: that is the simulation. FORS+C keys never leave the page.
