What it is. Bittensor is a network that rewards people for doing machine-learning work, and it runs entirely on the kind of digital locks a future quantum computer is expected to pick open.
What we found. The people who grade that work re-sign their scores with the same personal key every round, so those keys stay out in the open, and coins that have sat untouched for years are just as easy to reach as ones in daily use.
Why it matters. A capable quantum computer could copy those keys to drain funds or rewrite the on-chain record of who graded whom, and the network has set no date and no plan to swap in stronger locks before that day comes.
Bittensor (subtensor) forked from the Polkadot SDK in March 2023 and operates governance-independently. Substrate cryptographic toolkit inheritance is real (forkless runtime upgrade, multi-scheme SS58, pluggable crypto pallet) but Polkadot's PQ governance roadmap does not transfer. Subtensor would need to merge upstream Substrate PQ pallets when they exist AND run its own runtime upgrade, none on a public schedule. Yuma Consensus runs on individual Sr25519 votes rather than BFT signature aggregation; QBittensor Labs subnets (SN48, SN63) operate quantum-compute marketplaces at the application layer, not chain-level PQC posture.
Summary
Bittensor (subtensor) is a Substrate-based L1 running Aura block authoring + GRANDPA finality with three classical signature primitives in production: Sr25519 (Schnorr over Ristretto255 / Curve25519) for accounts and block authoring, Ed25519 for GRANDPA finality voting, and ECDSA secp256k1 for the Bittensor EVM (H160 wallets, ECRecover precompile). All three are Shor-break-via-DL-without-pairings. BLAKE2b-256 is the runtime hash (Grover-weaken). No PQ primitive is shipped, in test, in spec, or in foundation announcement. The chain forked from the Polkadot SDK in March 2023 and does not share governance with Polkadot, Polkadot's published PQ roadmap does not transfer. wTAO custodial bridge (single-signer, ECDSA) and Tensorplex tTAO are the cross-chain surfaces. The dTAO upgrade (Feb 13, 2025) and the July 2024 $8M malicious-package exploit demonstrate coordination capability but no cryptographic-scheme migration precedent. Migration Stage 0 (Unaware). Raw QRI ~23. Caps bind at 60 but raw is far below. Gate 1a-Sig FAIL, Gate 1a-KEM FAIL. Band 3 Planning (mechanical) / Band 1 Unaware (substantive), Substrate inheritance propels Dim 4 mechanically; foundation primary-source signals support Band 1.
What the gates say
- Gate 1a, Hybrid signature: FAIL , no documented hybrid signature composition AND or OR at the consensus, account, or EVM signature paths
- Gate 1a, Hybrid KEM: FAIL , libp2p Noise X25519 and RPC TLS use classical KEM; no documented hybrid KEM
- Gate 1b, Commit-to-hash: COND , no OR-composition exists
- Gate 2, Evidence reconstruction: PASS , all sub-scores reconstructible from public artifacts in 48h; 5f voided due to no PQ scheme to evaluate
- Gate 3, Primitive naming: PASS , Sr25519/Schnorrkel/Ristretto255/Curve25519, Ed25519/Edwards-Curve25519, ECDSA/secp256k1, BLAKE2b-256, Keccak256 named with mechanism
Burn-vs-rescue policy on file
Declared option f, Undeclared. No Opentensor Foundation document addresses how legacy classical-only TAO holdings or validator hotkey histories would be handled at any future PQ sunset. The Substrate forkless-upgrade primitive supports an optional-migration path architecturally, but no such policy is published.
Seven dimensions
Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.
1 Cryptographic Exposure weight 15% 24 / 100
Opentensor Foundation does not maintain a primitive-inventory document equivalent to Polkadot's wiki cryptography page; primitives are inferred from the polkadot-sdk lineage and from the Bittensor EVM precompile documentation. Not deployed: BLS12-381, Bandersnatch VRF, zk-SNARK in consensus.
Sr25519, Schnorrkel (Schnorr signatures) over Ristretto255 built on Curve25519. Default Substrate account-key and Aura block-authoring key type · Ed25519, EdDSA over Twisted Edwards Curve25519. Substrate-supported account-key type; default GRANDPA finality voter key type. Bittensor EVM exposes Ed25519 verification precompile at 0x0000…0402 · ECDSA over secp256k1, used for EVM (H160) wallets on the Bittensor EVM and for the ECRecover precompile at 0x0000…0001 · BLAKE2b, Substrate runtime hash (FRAME default) · Keccak256, used in the Bittensor EVM tutorial signing flow and as standard EVM opcode Sr25519→ Shor-break-via-DL-without-pairings (discrete log on Curve25519 / Ristretto255)Ed25519→ Shor-break-via-DL-without-pairings (discrete log on Curve25519)ECDSA secp256k1→ Shor-break-via-DL-without-pairingsBLAKE2b-256→ Grover-weaken (256→128-bit pre-image security)Keccak256→ Grover-weaken (256→128-bit pre-image security)
0 PQ families, chain is fully classical. Polkadot's W3F roadmap (June 2025) covers Polkadot-the-chain and JAM, not Bittensor.
No PQ scheme is named for subtensor in primary sources reviewed.
Schnorrkel (sr25519) and ed25519-dalek are audited but not machine-checked. Constant-time via curve25519-dalek; standard Substrate inheritance. Library provenance: schnorrkel (w3f), ed25519-dalek (dalek-cryptography). Frontier provides the Substrate EVM secp256k1 precompiles. No PQ library referenced. As of December 2024, Bittensor had no publicly disclosed third-party security audit; OTF announced (July 2024) intent to increase audit frequency following the $8M malicious-package exploit.
2 Quantum Recovery Exposure weight 10% 21 / 100
Bittensor accounts use the SS58 address format, which encodes the raw public key (multi-scheme). Once any account signs a transaction, the public key is on-chain in plaintext. Subnet validators register persistent hotkeys/coldkeys on-chain. Yuma Consensus weight votes are signed by hotkeys with each block, so validator pubkeys are continuously exposed. Effectively 100% of active TAO holders and validators have exposed Shor-break public keys.
SS58 addresses encode the raw public key directly, there is no hash-based address scheme that hides the public key prior to first spend. Cold (never-moved) TAO has the same exposure as active TAO. Bittensor mainnet has been live since November 2021. Lost-coin or never-spent dormant balances are forgeable post-Shor without requiring any prior spend transaction.
Substrate session-key rotation is available for validators (a native protocol feature). Subnet hotkeys can in principle be rotated via re-registration but persistent hotkey usage is the dominant pattern in Yuma Consensus. Account coldkeys do not rotate by default. Historical signatures on past blocks are forgeable post-Shor for retroactive history attestation.
libp2p validator-to-validator gossip uses Noise (X25519 ECDH). Subtensor RPC endpoints (port 9944 websocket; OnFinality / Opentensor RPC) use TLS with classical key exchange. No PQ KEM (e.g., ML-KEM hybrid) is announced for the subtensor transport layer.
3 Metadata, Anonymity & Confidentiality weight 13% 24 / 100
Bittensor is pseudonymous and fully transparent at the ledger level. All TAO transfers, subnet stake operations, and Yuma Consensus weight vectors are visible on-chain. Validator emissions, miner emissions, weight matrices, and stake distributions are publicly queryable via taostats.io and Subscan-style explorers.
Bittensor's primary public RPC providers are OnFinality and Opentensor-operated endpoints (entrypoint-finney.opentensor.ai). Opentensor Foundation operates default endpoints used by btcli and the Bittensor SDK out-of-the-box. No formal validator metadata-retention policy is published at protocol level.
wTAO (the original Bittensor → Ethereum bridge by 'CreativeBuilts') is a custodial single-signer bridge, every redemption from wTAO back to TAO requires a manual signature from the bridge operator, providing a complete correlation trail between Ethereum H160 addresses and Bittensor SS58 addresses. Tensorplex tTAO and the Opentensor Foundation EVM bridge introduce additional cross-chain trace surfaces.
All on-chain signatures use Shor-break primitives (Sr25519, Ed25519, ECDSA secp256k1). Post-Shor, every historical Bittensor sender and validator public key is recoverable; existing pseudonymity becomes linkable via deterministic key-graph analysis across SS58 and H160 surfaces. Yuma Consensus weight vectors signed by validator hotkeys provide an unusually rich on-chain behavioral fingerprint that becomes fully attributable post-Shor.
L1 profile uses 4 sub-scores for Dim 3; this entry not scored.
4 Migration Architecture weight 10% 71 / 100
Subtensor inherits Substrate's WASM forkless runtime upgrade mechanism, the same primitive that gives Polkadot its strong crypto-agility profile. Crypto pallets are pluggable in principle; new signature schemes can be added via a runtime upgrade without a hard fork. SS58 multi-scheme address encoding is a native multi-algorithm address format. Bittensor has executed multiple runtime upgrades (dTAO Feb 13, 2025; Yuma Consensus 2.0 / Taoflow updates per 2026 reports; subnet capacity upgrade to 256 planned). Marginal deduction for the absence of any crypto-pallet-substitution precedent specifically.
Substrate proxy accounts and multisig are native (no contract layer required). Session-key rotation is native for validators. Bittensor's hotkey/coldkey separation is a native key-segregation primitive. EVM layer supports standard Ethereum AA paths in principle. No client-layer PQC migration path is documented for subtensor specifically.
Multiple coordinated runtime upgrades executed since the March 2023 fork from Polkadot SDK. dTAO (Feb 13, 2025) was a structural tokenomics overhaul executed without contested fork. Subnet mechanism updates (October 2025 per OTF announcement) executed cleanly. Substrate's forkless runtime upgrade machinery removes much of the hard-fork-coordination risk.
SS58 multi-scheme address format and pluggable Substrate crypto pallet make hybrid signatures architecturally feasible, Bittensor inherits the same architectural option Polkadot has. However, no Opentensor Foundation document describes hybrid composition for the subtensor signature path. Architecturally possible, not announced.
No stateful-hash scheme (XMSS, LMS, leanXMSS) is in scope for Bittensor's current or planned signature path. Default full credit per v3.1 rule for stateless-only chains.
N/A, Bittensor consensus does not use BLS signature aggregation. GRANDPA finality uses Ed25519 (no aggregation). Aura block authoring uses Sr25519 (no aggregation). Yuma Consensus weight vectors are signed by individual validator hotkeys with Sr25519, the algorithm aggregates weights (stake-weighted median calculation) but the underlying signatures remain individual. Per v3.1 4f scope rule, N/A for chains using non-aggregating signatures at consensus.
5 Deployment Execution weight 22% 12 / 100
0%. No PQ signature, KEM, or VRF is live on Bittensor mainnet. Every transaction is signed under Sr25519, Ed25519, or ECDSA secp256k1.
Zero PQ code in the opentensor/subtensor repository. No merged pallet for ML-DSA, Falcon, ML-KEM, SLH-DSA, or any PQ primitive. No upstream Substrate PQ pallet that subtensor would inherit has shipped.
0% of subnet validators sign with PQ keys. All hotkey signing on Yuma Consensus weight submissions uses Sr25519. All EVM-side activity uses ECDSA secp256k1.
VOIDED per v3.1 (5a = 0). The published roadmap content (dTAO, Yuma Consensus 2.0, Taoflow, subnet expansion to 256) is economic/mechanism-level, not cryptographic.
Announced count (trailing 12mo): 0 substantive PQ statements from Opentensor Foundation in primary sources. Shipped: 0 (mainnet); 0 (testnet PQ). Two ecosystem subnets (SN48 OpenQuantum, SN63 Enigma) operated by QBittensor Labs run quantum-compute workloads as application-layer subnets, but these are not OTF announcements about chain PQC migration. Strong score for low-washing, not making PQ claims, no announce-vs-ship gap.
VOID, no PQ scheme to evaluate. No PQ signature scheme is named for subtensor by the Opentensor Foundation. Per v3.1 scoring 'undisclosed → 0'.
6 Supply Chain Vendor Readiness weight 22% 7 / 100
Top-3: Bittensor Wallet (btcli + Bittensor SDK), Polkadot.js extension, Talisman. PQ-roadmap count among top-3: 0. SubWallet (Substrate-ecosystem multi-chain wallet) also supports TAO; no PQ roadmap. MetaMask is the dominant EVM-side wallet for the Bittensor EVM layer and has no Bittensor-specific PQ posture.
Top-3: wTAO (CreativeBuilts custodial bridge), Tensorplex tTAO, Opentensor Foundation EVM bridge / tao.app/bridge. PQ-roadmap count: 0. The wTAO bridge is single-signer custodial, every redemption requires the bridge operator's signature.
Top-3: Coinbase Custody, BitGo, Anchorage (TAO-supporting major institutional custodians). None has published a Bittensor-specific PQ migration plan.
Top-3 RPC: OnFinality, Opentensor Foundation RPC (entrypoint-finney.opentensor.ai), Tatum / QuickNode. PQ roadmap count: 0. HSM support for sr25519 / ed25519 is limited (Ledger's Polkadot/Substrate app supports both schemes; no PQ-firmware support announced for TAO). Note: ecosystem subnet SN48 (Quantum Compute / OpenQuantum.com) provides decentralized QPU access for compute workloads, relevant to PQ research but not a chain-infra PQC roadmap.
7 Governance & Coordination weight 8% 42 / 100
128+ active subnets at evidence cutoff (planned expansion to 256). Each subnet runs its own validator/miner economy. Stake concentration across major subnet operators is meaningful. Subtensor's underlying chain validator set is permissioned-leaning relative to large permissionless L1s, historical reporting notes Proof of Authority dynamics. Client diversity: only one production subtensor client.
dTAO launch (Feb 13, 2025) was a coordinated tokenomics overhaul executed without contested fork. Yuma Consensus 2.0 / Taoflow emissions tuning shipped per 2025–2026 reporting. October 2025 subnet mechanism update executed. July 2024 $8M malicious-package exploit was followed by published post-mortem and stated intent to increase audit cadence.
Opentensor Foundation is the institutional coordinator. Founders Jacob Steeves and Ala Shaabana are publicly named. No public PQ working group with a published mandate has been chartered. The 'Conviction' governance primitive (BIT-0011) introduced an on-chain governance mechanism for subnet ownership; chain-level cryptographic governance proposals are not visible in the BIT track.
July 2024 $8M exploit (malicious package upload to PyPI) was followed by a coordinated response, root cause identified, post-mortem published, audit cadence stated as increasing. This is a credible precedent of governance executing under adverse pressure. No precedent of cryptographic-scheme switch under active attacker.
No documented canary/tripwire mechanism for cryptographic posture. No rate-limited spending rule, no honeypot canary, no cryptographic tripwire embedded in consensus. Bittensor does not have a Kusama-equivalent canary network.
X + Y vs Z, when does the math turn against you?
v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?
Verdict
X+Y range 2033–2046, Outside risk window at upper bound; Crisis Zone (vs Z10 2030)
Z-compliance
Outside compliance window at any X+Y > 2035
Source-disagreement disclosure
v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.
Some third-party content (and the v2 baseline) attributes PQ-readiness to Bittensor 'via Polkadot ecosystem PQ path.' The opentensor/subtensor README confirms subtensor is a fresh FRAME-based Substrate node, not a Polkadot parachain, and the chain forked governance from Polkadot in March 2023. PQ inheritance is not automatic; it requires subtensor to merge upstream PQ pallets when they ship and execute its own runtime upgrade. v3.1 does not credit indirect-inheritance.
Community-side characterization frames SN48 and SN63 as Bittensor's 'structural hedge' on quantum. Foundation-side primary sources do not characterize these subnets as policy. v3.1 follows foundation-side primary sources for chain scoring; subnet-level activity is application-layer.
October 2025 OTF announcement covers subnet-ownership lock-up, not cryptographic governance. Some third-party coverage groups it with broader chain-governance reform; the BIT itself is scoped narrowly.
Delta-QRI under alternative weighting
Substituting a model that weights architecture more heavily (Dim 4 → 25%, Dim 5 → 10%) would lift QRI to ~28–30, still Band 3. Discounting inherited Substrate agility (Dim 4 → 50/100 with no demonstrated crypto-pallet swap) would lower QRI to ~21, Band 3 boundary. Headline QRI is mildly weighting-sensitive.
Announcement-to-shipped ratio
Announced: 0. Shipped: 0. Ratio: 0.
Tag: none, Bittensor's silence on PQ is the dominant pattern
Peers in the L1 profile
9 chains closest to Bittensor by Stage then QRI.