What it is. BNB Chain is a public blockchain that carries roughly 850,000 transactions an hour and holds close to five billion dollars of deposits.
What we found. Its own engineers now state in writing that every address which has already spent has exposed what a future quantum computer would need, and the fix they propose carries no date on any step.
Why it matters. Holders and builders carry that exposure until the network itself upgrades, so the fact to track is whether a chain that ships upgrades several times a year puts a date on its first quantum step.
No post-quantum primitive runs on BNB Chain mainnet or testnet: accounts and Parlia block seals sign with ECDSA secp256k1, BEP-126 fast finality aggregates BLS12-381 vote attestations, RLPx v4 derives session keys from secp256k1 ECDH, and code search across bnb-chain/bsc and bnb-chain/reth returns no merged post-quantum code. Every 2026 post-quantum artifact is unmerged: the core proof-of-concept using ML-DSA-44 (FIPS 204) closed on 2026-05-11 without merging, and drafts BEP-707 (three-phase hybrid roadmap, no account signature scheme named) and BEP-708 (RLPx v5 hybrid X25519MLKEM768) are open with no human review recorded, which is why Gate 1a-Sig fails.
Summary
BNB Chain scores QRI 21, Band 3 Planning, Migration Stage 1, scoring BSC as the active L1. Production cryptography is entirely classical: ECDSA secp256k1 (EVM accounts, Parlia block seals), BLS12-381 aggregated vote attestation (BEP-126), secp256k1 ECDH at the RLPx v4 handshake, KZG over BLS12-381 (BEP-336 blobs), BN254 precompiles 0x06-0x08, Keccak-256 and SHA-256. The core migration report of 2026-05-14 measured ML-DSA-44 (FIPS 204) transaction signatures at 110 B growing to about 2.5 KB and cross-region throughput falling from 4,973 to 2,997 TPS. Its proof-of-concept replaced BLS12-381 vote aggregation with STARK-aggregated ML-DSA-44 behind a fork gate and added transaction type 0x05, which is substitution, not hybrid composition; that pull request closed unmerged. Draft BEP-707 (2026-08-11) defers account signatures to a Phase 2 described as hybrid with ECDSA while naming no scheme and no combiner, so Gate 1a-Sig fails. Draft BEP-708 (2026-08-14) specifies RLPx v5 X25519MLKEM768 (X25519 per RFC 7748, ML-KEM-768 per FIPS 203, HKDF-SHA256 over three concatenated secrets) and passes Gate 1a-KEM on the documented path only. Post-quantum signing traffic is 0%, which voids 5d and holds Stage at 1; no QRI cap binds at 21.
Forge. Forge-dominant: this chain secures value and operations with signatures, so the principal quantum risk is forgery of spends/attestations once Shor breaks the curve. There is no harvest-now component for forgery, the public key alone enables it. Decrypt/HNDL applies only to transport/RPC confidentiality.
3 announced → 0 shipped on mainnet under a named primitive. >1.5 deduction (three core-team announcements in the trailing 12 months: the 2026-05-14 BSC Post-Quantum Cryptography Migration Report naming ML-DSA-44 and STARK vote aggregation, draft BEP-707, and draft BEP-708 naming X25519MLKEM768, against zero shipped bytes on mainnet or testnet. Ratio recorded as 2.0 by convention because shipped = 0 leaves the literal quotient undefined; under the alternative reading that records the announced count itself (3.0) the >2.0 QRI cap 65 would also apply, non-binding at QRI 21. No narrative-only tag: every announcement names exact primitives and itself states that nothing is deployed).
What the gates say
- Gate 1a, Hybrid signature: FAIL , draft BEP-707, open and unmerged, declares that Phase 2 will run post-quantum account signatures 'hybrid with ECDSA' via an opt-in, address-preserving key-bind, but names no scheme and specifies no combiner construction, no AND/OR composition, no commit-to-hash, and no SUF-CMA/non-malleability treatment; the Phase 2 Standards BEP has not been opened. BEP-575 (Falcon-512/1024 precompile, open draft since 2025-05, unmerged, not referenced by BEP-707) likewise describes a dual-signature window only as a migration convenience, not a specified hybrid composition.
- Gate 1a, Hybrid KEM: PASS , on the documented-path criterion only (draft BEP-708, core-authored, specifies RLPx handshake v5 with hybrid X25519MLKEM768: X25519 per RFC 7748 combined with ML-KEM-768 per FIPS 203; the key schedule is HKDF-SHA256 (RFC 5869) over the concatenation of three shared secrets, ML-KEM-768 || X25519 || the retained secp256k1 ECDH secret, with the salt derived from both nonces and the info field bound to a Keccak-256 hash of the full auth/ack transcript; this is the shared-secret-concatenation construction of the IETF hybrid TLS drafts, with a kem-group registry aligned to IANA TLS NamedGroup codepoints and explicit downgrade-detection rules. Session authentication stays classical secp256k1 by design. Caveat carried on the verdict: the spec is an open unmerged draft with no human review recorded and zero implementation; the deployed P2P key agreement remains pure-classical secp256k1 ECDH (RLPx v4). Gate 1a consequences unchanged because Gate 1a-Sig fails.
- Gate 1b, Commit-to-hash: COND , no OR-composition documented at production-spec level
- Gate 2, Evidence reconstruction: PASS , all sub-scores reconstructible from public artifacts in 48 hours: the BEPs repository and its pull requests, the bsc client repository and its releases, the BNB Chain blog, documentation and forum roadmap thread, public JSON-RPC and TLS endpoints, BscScan
- Gate 3, Primitive naming: PASS , every primitive named with parameter set: ECDSA secp256k1, BLS12-381 with the BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_ scheme, secp256k1 ECDH, KZG over BLS12-381, BN254 precompiles 0x06-0x08, Keccak-256, SHA-256, ML-DSA-44 per FIPS 204, ML-KEM-768 per FIPS 203, X25519MLKEM768, STARK aggregation of ML-DSA-44 votes, Falcon-512/1024
Burn-vs-rescue policy on file
Declared option f, Undeclared. Public materials do not address what happens to legacy quantum-vulnerable balances post-migration. Given the small validator set and the October 2022 Token Hub precedent (chain suspended by contacting validators individually, hotfix hard fork within the day), a core-team-coordinated rescue path is the operational base case but is not declared policy. Draft BEP-707's Phase 2 describes an opt-in, address-preserving key-bind migration for active accounts but takes no position on balances that never migrate.
Seven dimensions
Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.
1 Cryptographic Exposure weight 15% 28 / 100
BSC publishes its primitives across the staking/consensus docs, BEPs, and the bsc go-ethereum fork, and since 2026-08 the core team's own draft BEP-707 consolidates the vulnerable surface in a single table (P2P ECDH, ECDSA secp256k1 account/tx signatures, BLS12-381 fast-finality aggregation, KZG, BN254 precompiles 0x06-0x08). A consolidated core-authored inventory now exists, though it lives in an unmerged draft rather than a maintained cryptography reference page.
ECDSA secp256k1 (EVM transaction signatures, validator block-seal signing under Parlia: 65-byte signature suffix in the header extra-data, recovered with ecrecover) · BLS12-381 with BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_ scheme (BEP-126 fast finality vote signing and aggregated attestation, via the Prysm bls package over blst) · secp256k1 ECDH (RLPx v4 P2P session-key agreement, the only deployed transport key exchange) · KZG commitments over BLS12-381 (BEP-336 / EIP-4844 blob transactions) · BN254 pairing precompiles (addresses 0x06-0x08) · BLS12-381 EVM precompile (BEP-439 / EIP-2537, general-purpose, distinct from the consensus vote path) · Keccak-256 (state/tx hashing per EVM, address derivation) · SHA-256 (system-contract hashing surfaces) · Merkle Patricia trie hashing (Keccak-256) Every deployed signature, key-exchange, and commitment primitive is quantum-vulnerable; zero PQ-safe primitives in production. The classification is now core-corroborated: draft BEP-707's own vulnerability table tags the same five surfaces.
ECDSA-secp256k1→ Shor-break-via-DL-without-pairingssecp256k1-ECDH (RLPx v4 P2P)→ Shor-break-via-DL-without-pairings (harvest-now-decrypt-later relevant: recorded session ciphertext decryptable once the curve breaks)BLS12-381 (BEP-126 fast finality)→ Shor-break-via-pairings (consensus fast-finality aggregation)KZG over BLS12-381 (BEP-336 blob transactions)→ Shor-break-via-pairings; blob data-availability commitments are retention-window-bounded (data pruned after the blob window), so long-term shelf life is limited per the blob-DA refinementBN254 pairing precompiles (0x06-0x08)→ Shor-break-via-pairings (application-layer zk/BLS proof verification)Keccak-256→ Grover-weaken-128bitSHA-256→ Grover-weaken-128bit
0 PQ-safe families deployed. BEP-575 (Falcon-512/1024 verification precompile) is an open draft since 2025-05 by a recurring bsc client contributor; it is unmerged and the core roadmap (BEP-707) does not reference it. BEP-CequreX (PR #596) was closed unmerged on 2025-08-05. Core-authored drafts BEP-707 and BEP-708 (2026-08) propose ML-KEM-768 hybrid key exchange and leave the Phase 2 signature scheme unselected; both are unmerged, so deployed PQ families remain zero.
No PQ primitive deployed. The Falcon proposal in BEP-575 would map to NIST Category 1 (Falcon-512) and Category 5 (Falcon-1024) if accepted. Voided to 0 because no production PQ primitive exists. The closed PoC (PR #3660) exercised ML-DSA-44 (FIPS 204, NIST Category 2) and draft BEP-708 specifies ML-KEM-768 (FIPS 203, Category 3), but neither is in production, so the sub-score remains voided.
Production primitives use libsecp256k1 via the go-ethereum cgo binding (with a pure-Go secp256k1 fallback) for ECDSA, and supranational/blst through the Prysm bls package for BLS12-381 aggregation, the same blst library used by Ethereum consensus clients and by Aptos. The BSC client is a go-ethereum fork; bnb-chain/bsc inherits geth's cryptographic library provenance and audit history. No formal-verification artifacts were found for BSC-specific consensus modifications.
2 Quantum Recovery Exposure weight 10% 23 / 100
BSC inherits the Ethereum-style EOA model: the secp256k1 public key is revealed when an account first signs a transaction. Transaction volume is large in absolute terms (14.3 billion cumulative transactions and roughly 850K transactions in the trailing hour at the 2026-08-19 ChainSpect snapshot), producing a very large revealed-pubkey surface. DeFiLlama BSC chain TVL was ~$4.9B on 2026-08-18. Draft BEP-707 concedes the exposure directly: 'because addresses are reused, any address that has transacted has an exposed public key.' No verifiable percentage of exposed supply exists; large unlabeled balances of unknown transaction history sit among the top holders.
BSC mainnet block 1 is timestamped 2020-08-29 UTC (roughly six years operational by this evaluation). EVM-style accounts that never signed retain Keccak-256-derived address indirection and remain quantum-resistant in the cold state, but the share of dormant-yet-unrevealed addresses is small relative to the active surface. Sizable exchange-labeled hot/cold wallet balances are a concentrated cold-key target.
All historical secp256k1 EOA signatures and all BLS12-381 fast-finality aggregated vote attestations (BEP-126, in production since the Luban and Plato hard forks of June and August 2023) are forgeable post-Shor.
Validator and full-node gossip runs RLPx v4 with secp256k1 ECDH session-key agreement, pure-classical. Public RPC is split: the official bnbchain.org dataseed endpoints and NodeReal terminate TLS 1.2 with classical ECDHE-RSA (observed 2026-08-19), while several third-party BSC endpoints (Ankr, QuickNode, Chainstack, dRPC, PublicNode) negotiate the hybrid group X25519MLKEM768 under TLS 1.3, so the wallet-to-RPC path is partially hybrid-protected depending on provider; no provider declares this as a BSC commitment. Bridge relay channels use standard classical TLS. Draft BEP-708 (unmerged) both inventories the harvest-now-decrypt-later surface in detail (pre-inclusion mempool reconstruction, validator-sentry topology mapping, node-identity-to-IP correlation, private-order-flow channels) and specifies the hybrid X25519MLKEM768 replacement for the RLPx handshake; nothing is implemented, so the deployed in-protocol exposure is unchanged. The only mitigation credited here is the observed hybrid TLS at third-party RPC edges.
3 Metadata, Anonymity & Confidentiality weight 13% 17 / 100
Transparent EVM ledger; identical pseudonymity model to Ethereum mainnet. No native shielded pool. The transaction rate (roughly 850K per hour at the 2026-08-19 ChainSpect snapshot, 14.3 billion cumulative) makes graph analysis dense in absolute terms.
RPC traffic concentrates on the official bsc-dataseed endpoints and a small set of providers (NodeReal, Ankr, QuickNode, Chainstack). The validator set is structurally small, 21 Cabinet + 24 Candidate = 45 active, with a 21-validator working set per epoch, making mempool gossip observable to a tight set of actors. ChainSpect records a Nakamoto coefficient of 7 (2026-08-19).
Primary bridges into and out of BSC are LayerZero (omnichain messaging), Wormhole, Stargate (built on LayerZero), and the legacy Binance Bridge / Token Hub system (also the source of the October 2022 exploit in which 2 million BNB were withdrawn and the chain was suspended). All bridges are observable by passive cross-chain indexers.
BSC has no shielded-pool layer, so the standard Shor-on-secp256k1 + Shor-on-BLS12-381 retroactive risks apply but no additional ring-signature, ElGamal, or zk-SNARK encryption layer exists. KYC linkage from centralized-exchange activity to BSC addresses is the primary realistic de-anonymization vector.
No on-chain mixer, commit-reveal batch-ordering, or cryptographic shuffle layer exists for BSC; BEP-322's builder model eliminates the relay role and requires the validator to execute the builder's transactions, so full transaction content is disclosed builder-to-validator with no confidentiality intermediary. The BEP index (checked 2026-08-19) contains no privacy, mixing, or shielded-transaction proposal. 3e is scored explicitly at 0.
4 Migration Architecture weight 10% 62 / 100
BSC is a go-ethereum fork and inherits Ethereum's EVM precompile and hard-fork pathway for adding new cryptographic primitives; BEP-439 already added a BLS12-381 precompile pattern that draft BEP-575 (Falcon) explicitly cites as its template. BEP-441 (EIP-7702, account code on EOAs) is Status: Enabled (activated in the Pascal hard fork, mainnet 2025-03-20), giving BSC a live versioned-account mechanism. Draft BEP-708 adds a concrete wire-level agility design (a kem-group registry aligned to IANA TLS codepoints, letting a future BEP swap in X25519MLKEM1024 with no wire-format change beyond share lengths), but it is unmerged, so only the precompile/hard-fork pathway and EIP-7702 count as in-production agility.
BSC supports ERC-4337 account abstraction (the client has carried an EIP-4337 bundler API since 2023), and BEP-441 (EIP-7702 account code on EOAs) is Enabled, satisfying the AA-support component. No documented client-layer PQ migration path exists: draft BEP-707's Phase 2 sketches an address-preserving bind of a new post-quantum key using the existing key but names no scheme and cites no mechanism (it does not reference EIP-7702 or BEP-441), and validator keys (ECDSA block-seal plus BLS12-381 vote keys) have no on-chain rotation primitive. Scored below the AA-only ceiling for those gaps.
Mainnet hard-fork cadence is dense: Pascal (2025-03-20, EIP-2537/2935/7702/7623 ports), Lorentz (2025-04-29, block time to 1.5 s), Maxwell (2025-06-30, block time to 0.75 s), Fermi (2026-01-14, block time to 0.45 s plus extended fast-finality voting rules), Osaka/Mendel (2026-04-28, 9 BEPs), with Pasteur scheduled for 2026-08-25; the public roadmap thread counts 21 mainnet hard forks since 2021. Each activated at the time pre-announced in the client release notes, and no contested fork or rollback appears in the release history or roadmap thread. The October 2022 Token Hub exploit triggered a chain suspension and a same-day hotfix hard fork, demonstrating crisis-coordination capacity (also a centralization signal).
Materially improved, with a precise reading of what the PoC showed. The core team's PoC (PR #3660, closed unmerged) was fork-gated: after the fork it replaced BLS12-381 vote aggregation wholesale with ML-DSA-44 votes aggregated by a STARK proof, and it added a new PQ transaction type (0x05, explicit ML-DSA-44 key and signature, registry precompile at 0x70) next to the legacy ECDSA transaction types, with a parallel PQ vote subprotocol next to the existing BLS vote messages. That demonstrates that PQ types can be added next to classical ones under a fork gate with published cost measurements; it does not demonstrate a classical+PQ hybrid composition, and the report's own table says 'Replaced'. Draft BEP-707 commits every phase to hybrid mode ('coexisting with the existing classical mechanisms during transition rather than replacing them abruptly') and draft BEP-708 is a complete hybrid key-agreement specification for the P2P layer. Held well below the top of the range because no signature-combiner construction exists, the Phase 2 Standards BEP is unopened, and nothing is merged.
BSC has no stateful-hash scheme deployed or proposed. Falcon (proposed in BEP-575) is stateless. Default 15 applies. The primitives in the 2026 core drafts (ML-DSA-44 in the PoC, ML-KEM-768 in BEP-708) are likewise stateless.
BSC uses BLS12-381 aggregated vote attestation in BEP-126 fast finality across the 21-validator working set selected each epoch from the 45 active validators, with validator vote keys epoch-public, so the consensus-layer standing-exposure flag applies regardless of finality speed. Recent movement: the migration report's PoC replaced BLS vote aggregation with STARK-aggregated ML-DSA-44 votes in a test deployment with published benchmarks, and draft BEP-707 Phase 3 formally declares the pairing family (BLS aggregation, KZG, BN254 precompiles) as a migration target toward hash-based alternatives while stating the path is research-gated: 'BLS aggregation has no mature post-quantum equivalent', 'start when research-ready', no fixed activation date. Scored 4: a declared target plus a closed prototype, below the merged-spec bar because no Phase 3 spec is merged or even opened.
5 Deployment Execution weight 22% 6 / 100
0% of BSC mainnet signing traffic uses PQ primitives. BEP-575 is an unmerged draft; no Falcon precompile is callable on mainnet. The core PoC (PR #3660, ML-DSA-44 + STARK vote aggregation) was closed unmerged on 2026-05-11; BEP-707 and BEP-708 are open drafts, and BEP-708's own rollout table starts at Stage 0 (implementation merged, testnet-only enablement, off by default), which requires a merged implementation that does not exist. No PQ primitive is callable on mainnet or testnet.
No PQ code merged into bnb-chain/bsc (Geth fork) or bnb-chain/reth (Rust client). Code searches against both repositories return zero hits for falcon, dilithium, ml-dsa, mldsa, or mlkem, and the bsc go.mod carries no post-quantum dependency. Re-verified 2026-08-19: the issue/PR search for 'quantum' returns only the closed PR #3660, and client releases v1.7.5 through v1.8.0-alpha (2026-07-07 to 2026-08-13, including the Pasteur releases and a go-ethereum v1.17.3 upstream sync) contain no PQC line item.
No validator runs a PQ consensus key. The 21-Cabinet + 24-Candidate set (45 active) all sign with secp256k1 (block proposal under Parlia) and BLS12-381 (BEP-126 fast-finality vote attestation).
VOIDED to 0 per v3.1 because 5a = 0. Draft BEP-707 deliberately publishes no dates (Phase 3 is 'start when research-ready' with no fixed activation date, and Phases 1-2 carry no dates either); draft BEP-708's rollout stages are gated on adoption thresholds (PQ session share >= 90% for 4 consecutive weeks, then >= 99% for 6 months), not calendar milestones. The sub-score would remain 0 on the dated-milestone criterion even if it were not voided.
Announced-vs-shipped ratio 3:0. Trailing-12-month core announcements: the 2026-05-14 BSC Post-Quantum Cryptography Migration Report (ML-DSA-44, STARK vote aggregation), draft BEP-707, draft BEP-708 (X25519MLKEM768); shipped PQC bytes on mainnet or testnet: zero. A deduction applies for the announced-versus-shipped delta. Held above the floor because each announcement is technically precise, names exact primitives with honest cost measurements, and itself states that nothing is deployed; no quantum-safety marketing claim was found in any core channel.
No PQ signature deployed, so no live multiplier exists. The migration report publishes measured footprint data from the PoC (transaction size 110 B to ~2.5 KB under ML-DSA-44, roughly 23x; signature 65 B to 2,420 B, 37x; block size ~130 KB to ~2 MB at 2,000 TPS; cross-region TPS 4,973 to 2,997), and the PoC exercised STARK aggregation for ML-DSA-44 vote signatures (six raw votes of 14.5 KB into a ~340-byte proof), which the rubric credits as documented aggregation work. BEP-575 (unmerged draft) separately cites Falcon-512 at ~666-byte signatures (~10-11x raw bytes). Nearly all points withheld pending any deployment or a fee-accounting de-penalization mechanism.
6 Supply Chain Vendor Readiness weight 22% 8 / 100
Top-3: Binance Web3 Wallet, Trust Wallet (self-reported 200M users), MetaMask. None has published a PQ key-derivation or PQ signing roadmap on BSC; re-verified 2026-08-19 for Trust Wallet (its blog carries no post-quantum content) and for the BNB Chain blog (no vendor-coordination announcement). Draft BEP-707's Ecosystem Considerations section concedes the gap: chain-level quantum resistance 'does not automatically protect applications', and the core team states it intends to publish migration standards, reference implementations, and guidance for wallets, bridges, custodians, and oracles, future tense, nothing published.
Top-3: LayerZero (omnichain messaging, the post-Token-Hub default route), Wormhole, Stargate (built on LayerZero). None publishes a PQ aggregation-key, PQ-validator, or hybrid-KEM transport roadmap for BSC routes.
Top-3: Ceffu (MPC-based institutional custody; self-described ISO 27001/27701 certified and SOC 2 Type 2 attested), BitGo, Fireblocks. Ceffu's public site and blog carry no post-quantum cryptography roadmap (checked 2026-08-19). No BSC-specific PQ key-management product is documented for BitGo or Fireblocks; vendor-wide forward-looking PQ statements were not verifiable and are not credited.
Top-3 RPC: BNB Chain official dataseed endpoints, Ankr, QuickNode (NodeReal, Chainstack, dRPC also material). Live TLS handshakes on 2026-08-19: the official bsc-dataseed endpoints on bnbchain.org and NodeReal terminate TLS 1.2 with classical ECDHE-RSA-AES128-GCM-SHA256; Ankr, QuickNode, Chainstack, dRPC and PublicNode BSC endpoints negotiate TLS 1.3 with the hybrid group X25519MLKEM768. No provider publishes a BSC-specific post-quantum roadmap, so the hybrid groups read as edge-stack defaults rather than commitments; credited at 4 of the 8 RPC points for two of three top providers with observed hybrid KEM and the official endpoint classical. HSM algorithm-support and TEE-attestation components: nothing documented as a PQ pilot anywhere in the BSC stack, 0.
7 Governance & Coordination weight 8% 41 / 100
45 active validators (21 Cabinet + 24 Candidate), re-elected daily at 00:00 UTC from staking rankings, with a 21-validator working set per epoch. ChainSpect records a Nakamoto coefficient of 7 (2026-08-19). The geth-fork bsc client is the reference implementation used in the official validator guide; bnb-chain/reth (Rust) publishes releases as a second execution client (v0.0.7 in 2025-12 through a v0.1.2 pre-release on 2026-08-19), and validator-level client-diversity figures are not published.
Four mainnet hard forks in the twelve months from 2025-04-29 to 2026-04-28 (Lorentz, Maxwell, Fermi, Osaka/Mendel), with Pascal on 2025-03-20 immediately before and Pasteur scheduled for 2026-08-25; 21 mainnet hard forks since 2021 per the public roadmap thread. The October 2022 Token Hub exploit response (chain suspension by contacting validators individually, hotfix hard fork the same day, Moran patch hard fork five days later) demonstrated crisis-pace coordination.
BNB Chain core team operates the BEP process via the bnb-chain/BEPs repository and maintains the mainnet upgrade roadmap as a public forum thread (institutional voice, no individual lead named, no post-quantum entry). Binance is the dominant ecosystem actor. Since 2026-08 the PQC track has an identifiable core author: the account that authored both BEP-707 and BEP-708 has 202 recorded contributions to the bsc client repository, including release-preparation and hard-fork-activation commits. No PQC working-group charter or published mandate exists, and the lead role is inferred from authorship of both BEPs, not from a published appointment.
October 2022 Token Hub exploit (2 million BNB withdrawn from the native cross-chain bridge, per BNB Chain's own incident post) triggered a coordinated chain suspension, a hotfix hard fork the same day that blacklisted the exploiter addresses and suspended the cross-chain precompiles, and the Moran patch hard fork five days later. Demonstrates rapid coordination under pressure but the precedent is a bridge-exploit response, not a coordinated cryptographic primitive change under active attacker presence.
No canary, honeypot, rate-limited spending rule, or in-consensus cryptographic tripwire documented for BSC. Draft BEP-708's rollout thresholds (PQ session share >= 90% / >= 99%) are deployment-progression gates, not CRQC-detection tripwires; no monitored legacy-key canary exists.
Source-disagreement disclosure
v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.
Official BNB Chain documentation states 21 Cabinet + 24 Candidate = 45 active validators elected daily; BEP-322 states 'approximately 40 validators' as of end-2023, and BNB Chain's October 2022 incident post cited 26 active and 44 total. The figures measure different things at different dates rather than contradicting each other; the 21/45 structure per BEP-131 and the current docs is the authoritative one, and the per-epoch working set that produces blocks and casts fast-finality votes is 21 validators drawn from the 45.
DeFiLlama BSC chain TVL: ~$6.9B at 2025-12-01, ~$5.4B at 2026-04-01, ~$4.9B at 2026-08-18. The ~$6.9B level is a 2025-12-01 reading, not a 2026 one. This card uses the 2026-08-18 figure.
Draft BEP-707 states that NIST has finalized ML-KEM, ML-DSA, and SLH-DSA 'with FN-DSA (Falcon) in final publication.' No draft or final FIPS for FN-DSA has been published as of this evaluation; FN-DSA remains NIST-selected (2022) with the round-3 submission specification as the only deployable reference. Draft BEP-575 similarly refers to 'FIPS-206 test vectors'. This card follows the checkable publication record, not either BEP's characterization.
Some sources describe BEP-575 (Falcon) as an external, non-core proposal. Repository evidence contradicts that: its author has 55 merged commits in the bsc client repository (2023-2026), authored several Enabled BEPs, and pushed the BEP-575 branch directly into the BEPs repository. BEP-575 remains an unmerged draft that the core roadmap (BEP-707) does not reference or adopt; this card describes it as a recurring-contributor proposal, not as core-adopted and not as external.
Press describes the May 2026 benchmark as run 'on a test fork'. The report itself names no network; it reports single-region and cross-region runs with six validators and links the unmerged PR. The PR is fork-gated and replaces BLS12-381 vote aggregation wholesale after the fork while adding a PQ transaction type next to legacy ECDSA types; the report's own table says 'Replaced'. This card therefore does not describe the PoC as a classical+PQ hybrid.
No RPC provider publishes a BSC-specific post-quantum roadmap, yet live TLS handshakes on 2026-08-19 show several third-party BSC endpoints (Ankr, QuickNode, Chainstack, dRPC, PublicNode) negotiating the hybrid group X25519MLKEM768, while the official bnbchain.org dataseed endpoints and NodeReal terminate TLS 1.2 with classical ECDHE-RSA. The rubric scores published roadmaps; this card credits the observed deployment modestly in 2d and 6d and records the tension here.
With shipped = 0 the announced:shipped quotient is undefined. This card records 2.0 (threshold convention); recording the announced count (3.0) would add the >2.0 QRI cap 65. Both are non-binding at QRI 21.
BEP-297 (BSC Native Governance Module) carries 'Status: Enabled' in its metadata header and repository index while its body text still reads 'Draft', an internal inconsistency in BNB Chain's own documentation. Noted because the BEP process itself is load-bearing for the governance sub-scores; not material to any score in this card.
Delta-QRI under alternative weighting
BNB Chain is now architecture-heavy and deployment-empty, so the score is sensitive to the Dim 4 / Dim 5 weight split: an alternative weighting that swaps their L1 weights (architecture 22%, deployment 10%) yields QRI ≈ 28, still Band 3 Planning. No alternative scorecard profile applies; BSC is structurally an L1.
Announcement-to-shipped ratio
Announced: 3. Shipped: 0. Ratio: 2.
Tag: >1.5 deduction (three core-team announcements in the trailing 12 months: the 2026-05-14 BSC Post-Quantum Cryptography Migration Report naming ML-DSA-44 and STARK vote aggregation, draft BEP-707, and draft BEP-708 naming X25519MLKEM768, against zero shipped bytes on mainnet or testnet. Ratio recorded as 2.0 by convention because shipped = 0 leaves the literal quotient undefined; under the alternative reading that records the announced count itself (3.0) the >2.0 QRI cap 65 would also apply, non-binding at QRI 21. No narrative-only tag: every announcement names exact primitives and itself states that nothing is deployed)
Peers in the L1 profile
9 chains closest to BNB Chain by Stage then QRI.