Stealth addresses
Privacy that outlives the quantum computer.
Record.Wait.Decrypt.
Blockchains are public and permanent. Anyone can keep a copy of every transaction and wait for a quantum computer that can run Shor's algorithm. On that day, the elliptic-curve math behind today's privacy coins stops protecting anything that was ever recorded.
Record
Year 2026
A privacy coin today
- From
- To
- Amount
- Memo
On chain
XYRA
- From
- To
- Amount
- Memo
On chain
Note encryption
Key images
Value commitments
Spend proofs
Signatures
A fork can fix theft and inflation. It can't fix privacy, because the old data is already out there. That's why XYRA is post-quantum from the first block.
Meet the primitives that replace every curve with hashes and lattices:
On chain,a paymentis a gap.
A shielded transaction proves that a payment happened without saying who sent it, who received it, or how much moved. Here's what a wallet does to make one, and what the chain keeps.
-
01 · Share an address
The recipient hands over a post-quantum address
The address carries an ML-KEM-768 public key. At about 1,900 characters it's long, so wallets share it as a QR code or a payment request.
-
02 · Seal the note
The sender's wallet makes a fresh secret
It encapsulates a shared secret for that key and uses it to encrypt the note, which holds the amount, a memo, and what the recipient needs to spend it later.
-
03 · Prove the spend
The wallet builds a STARK
The proof shows it owns an unspent note in the tree, that inputs equal outputs plus the fee, and that the proof belongs to this exact transaction.
-
04 · Verify and mine
Nodes check the proof, miners fold it
Every node confirms the nullifier has never been seen before. Miners fold all the proofs in a block into a single block proof.
-
05 · Receive
One key opens one note
The recipient's wallet tries its key on each new note. One opens. Nobody else can tell that anything arrived.
Same goal.Different math.
Three shielded designs, one question that matters once the ciphertext has been copied: does what was recorded stay private?
XYRA
Holds
Past privacy after Q-day
- Privacy
- Every transaction shielded
- Stealth addresses
- ML-KEM-768, lattices
- Proofs rely on
- Hash functions
- Trusted setup
- None
Zcash
At risk
Past privacy after Q-day
- Privacy
- Optional shielded pools
- Stealth addresses
- Elliptic-curve Diffie-Hellman
- Proofs rely on
- Discrete log, Halo 2
- Trusted setup
- None for Orchard
Monero
At risk
Past privacy after Q-day
- Privacy
- Private by default
- Stealth addresses
- Elliptic-curve Diffie-Hellman
- Proofs rely on
- Discrete log
- Trusted setup
- None
Lasting privacyhas a size.
Post-quantum parts are bigger than the elliptic-curve parts they replace. These are the numbers, and how we keep them manageable.
-
Per transaction · estimate
50–200 KB
STARK spend proof, before it's folded into the block proof.
-
Per block
1 proof
Miners fold every transaction proof into one, so nodes verify a single proof per block.
-
Per address
~1,900
Characters in an address. The ML-KEM-768 key alone is 1,184 bytes, so wallets use QR codes.
-
Trusted setups
0
STARKs are transparent. There's no ceremony and no secret that someone has to destroy.
Theroadmap.
-
Shielded pool library. Keys, ML-KEM notes, the note tree, nullifiers, and STARK spend proofs, with a working private send and receive.
-
Devnet. Peer-to-peer networking, CPU mining, a mempool, and a command-line wallet.
-
Block proofs. Recursive proofs that fold every transaction in a block into one.
-
Spec and audits. A full written specification, review by outside cryptographers, and security audits.
-
Testnet, then mainnet. An incentivized public testnet. Mainnet launches only after the audits are done.
Questions.Answers.
- Is anything really quantum-proof?
- Nobody can promise forever. XYRA uses NIST's post-quantum standards and hash-based proofs, the most studied options available, and every part is designed to be upgraded if the research moves.
- Why not ring signatures like Monero?
- Post-quantum ring signatures exist, but they're large and hide each spend among only a small group. A shielded pool hides every spend among every note on the chain.
- Can I prove a payment when I need to?
- Yes. A viewing key shows chosen transactions to an auditor or an exchange without giving anyone the ability to spend.
- When does mainnet launch?
- After the specification is public and outside audits are complete. Follow along for testnet dates.
Specification
Published before testnet, after outside review.