What it is. Midnight is a privacy chain sold to banks, hospitals, and payroll providers as a place to keep sensitive records secret.
What we found. Its secrecy holds against attackers today, but it rests on math a future quantum computer can unwind, so every private record stored since the chain opened in spring 2026 could later be unlocked and read.
Why it matters. Anyone copying that data now could one day expose the payroll, health, and identity details the chain was picked to guard, and the team has published no plan to stop it.
Cardano partner chain (mainnet 2026-03-31) with programmable-privacy zk-SNARKs over BLS12-381 (Plonk+KZG via the midnight-proofs Halo2 fork). Every signing, proof-binding, and note-encryption primitive is Shor-vulnerable; no PQ migration plan published. Confidentiality subtotal 1/40, every historical Midnight private record is HNDL-decryptable.
Summary
Midnight launched the Kūkolu federated mainnet on 2026-03-31 with named launch validators (Google Cloud, Vodafone, eToro, Blockdaemon and others). The proving system migrated from Pluto-Eris to BLS12-381 on testnet 2025-05-12, a real crypto-agility precedent, but mainnet runs entirely on Shor-vulnerable curves and pairings. Note/state encryption is bound to BLS12-381; recipient privacy depends on the discrete-log/pairing problem. Cardano-stack consensus signing inherits Ed25519-class signatures. Gate 1a-Sig FAIL, Gate 1a-KEM FAIL, no PQ KEM, no hybrid composition, no announced sunset. The 3-Confidentiality subtotal of 1/40 is the dominant exposure: Midnight's regulated-industry pitch (payroll, healthcare, KYC) becomes one-shot mass-decryptable post-Shor. Mainnet age is short (~2 months) and Foundation has issued no PQ position. QRI 22 ± 8, Band 3 Planning (borderline Band 2 Acknowledged), Migration Stage 1.
What the gates say
- Gate 1a, Hybrid signature: FAIL , no documented hybrid signature composition; Cardano-stack Ed25519-class consensus signing
- Gate 1a, Hybrid KEM: FAIL , note/state encryption uses BLS12-381-derived PK encryption with no hybrid PQ KEM; transport TLS classical X25519/RSA/ECDH
- Gate 1b, Commit-to-hash: COND , no OR-composition declared
- Gate 2, Evidence reconstruction: PASS , every live sub-score has ≥ 3 evidence sources; reconstructible in 48h
- Gate 3, Primitive naming: PASS , BLS12-381, KZG, Plonk, Pluto-Eris legacy, Ed25519, Poseidon, SHA-256, Blake2b
Burn-vs-rescue policy on file
Declared option f, Undeclared. Midnight Foundation has not published a policy on dormant balances or on legacy private records that become readable post-Shor. The privacy-chain analogue is 'what do we do about every historical encrypted note that becomes publicly readable on Q-day', no statement issued.
Seven dimensions
Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.
1 Cryptographic Exposure weight 12% 27 / 100
Proving-system primitives explicitly named; consensus-signing primitive implicit (inherited from Cardano partner-chain framework, not specified in a Midnight foundation document).
BLS12-381 (proving-system curve) · KZG polynomial commitments over BLS12-381 · Plonk arithmetization (Halo2-derived constraint system, midnight-proofs crate) · Pluto-Eris (legacy, deprecated 2025-05-12) · Ed25519-class consensus signing (Cardano-stack inheritance) · Poseidon (ZK-friendly hash, BLS12-381 field) · SHA-256 / Blake2b (non-circuit hashing) BLS12-381→ Shor-break-via-pairingsKZG over BLS12-381→ Shor-break-via-pairingsPlonk-KZG→ Shor-break-via-pairingsPluto-Eris (legacy)→ Shor-break-via-DLEd25519 (consensus)→ Shor-break-via-DLPoseidon→ Grover-weaken (research-grade ZK hash)SHA-256 / Blake2b→ Grover-weaken (effective 128-bit)
Zero PQ families deployed. Pre-cap state.
No primitive maps to NIST PQC categories 1-5. BLS12-381 ~128-bit classical; Poseidon ~128-bit classical. Shor breaks all curve/pairing primitives; Grover halves hash levels.
midnight-proofs crate (fork of Halo2 v0.3.0, BLS12-381 backend). Galois collaboration on recursive ZK tooling. No formal verification, no constant-time validation cited. Plonk+KZG Tier 3 maturity; Poseidon Tier 4 research-grade. Audits referenced in launch communications; no centralized public audit-report URL at evaluation date.
2 Quantum Recovery Exposure weight 10% 17 / 100
Cardano-stack accounts derive from Ed25519-class public keys. Federated launch validators (Google Cloud, Vodafone, eToro, Blockdaemon, others) hold consensus-signing keypairs that sign every block, concentrated active-Forge surface.
Mainnet age ~2 months; cold exposure small relative to longer-running chains. Address-equals-public-key convention publishes pubkey on-chain. NIGHT Glacier Drop airdrop to 8 ecosystem holder bases means a substantial unclaimed long-tail of NIGHT addresses is already published.
All transaction-authorizing signatures on the chain since 2026-03-31 are forgeable post-Shor. No PQ attestation layer.
Validator gossip and RPC (Ankr, Foundation, validator-operated) follow Cardano partner-chain transport convention with classical TLS (X25519/RSA/ECDH). No PQ-hybrid TLS announced.
Note encryption bound to BLS12-381. An adversary harvesting ciphertexts today can decrypt every Midnight private state transition once Shor lands, exposing the regulated-industry data Midnight is pitched to protect (payroll, KYC, healthcare). No PQ KEM, no hybrid testnet, no historical re-encryption plan.
3 Metadata, Anonymity & Confidentiality weight 25% 31 / 100
Kachina-based architecture shields private contract state behind zk-SNARK proofs; only proof + public state delta + encrypted note payload on-chain. Selective disclosure via view keys (Compact DSL forces explicit private/public state declaration). Address reuse persists.
Top-3 RPC: Ankr, Midnight-foundation infra, validator-operated. Federated phase concentrates RPC observability among launch validators. Mempool gossip observable to federated validator set. Validator metadata retention undeclared.
Cardano-Midnight partner-chain interface observable on Cardano side. NIGHT Glacier Drop publishes correlatable cross-chain identity material from BTC/ETH/SOL/XRP/BNB/AVAX/BAT claimants. Source-to-destination linkability high.
Dominant confidentiality risk. Recipient view-key derivation, note-encryption ECDH-equivalent on BLS12-381, proof-system binding all rest on DL/pairing problem on BLS12-381. Once Shor lands, every historical Midnight private record encrypted to a published address is decryptable. One-shot mass de-anonymization since 2026-03-31.
No protocol-level mix network or cryptographic shuffle. Privacy comes from SNARK-based Kachina record model itself. Wallet-level operations across multiple shielded transitions provide some indistinguishability.
No Midnight Foundation, IOG, or community announcement specifies post-quantum migration of note encryption or shielded-state payload encryption. January 2026 State-of-the-Network covers federated mainnet, NIGHT distribution, DUST mechanics, no PQ KEM, no hybrid testnet, no announced sunset.
4 Migration Architecture weight 12% 33 / 100
Pluto-Eris → BLS12-381 proving-system migration (2025-05-12 testnet) is a real algorithm-switch event. Verification time 12ms→6ms, transaction size 6KB→5KB per proof. Real crypto-agility precedent; no formal crypto-agility specification covering future swaps.
Cardano-stack key derivation; no AA primitive comparable to ERC-4337 / EIP-7702 / native AA in zkSync/Starknet documented. View-key issuance enables selective disclosure but is not algorithm-rotation. No client-layer PQC path.
Short track record. Testnet operated from 2024 with multiple coordinated upgrades; Pluto-Eris → BLS12-381 (April 2025) was a coordinated proof-system swap; mainnet launched cleanly 2026-03-31. No contested forks. Sample size short.
No public hybrid PQ design. Plonk+KZG over BLS12-381 is the deepest agility constraint, replacing with FRI-based system requires re-instantiating Compact compiler, proving system, verifier circuits.
No stateful hash signature schemes. Default 15/15.
Cardano partner-chain consensus signs blocks with Ed25519-class signatures; no BLS aggregation at consensus, no PQ aggregation path declared, no spec, no testnet pilot.
5 Deployment Execution weight 18% 15 / 100
0% of consensus signing, transaction signing, note encryption, or proof generation runs on a PQC primitive.
No PQC primitive in the Midnight client stack. midnight-proofs is Plonk+KZG over BLS12-381; no FRI, no ML-DSA, no SLH-DSA, no ML-KEM.
0 of federated launch validators run PQC consensus keys.
VOIDED to 0 per v3.1 rule (5a = 0). No dated, enforcement-mechanism-backed PQ milestone exists in any roadmap publication.
Announced PQC = 0 trailing 12 months. Shipped PQC = 0. Ratio 0/0 (undefined). Honest by silence.
Undisclosed. With no announced PQ scheme, bytes-per-block under PQ unknown.
6 Supply Chain Vendor Readiness weight 18% 17 / 100
Lace wallet (Cardano-native) is primary wallet path via partner-chain integration. No top-3 wallet has published a PQC roadmap covering Midnight key derivation. Hardware wallet support in development; no Ledger/Trezor PQ commitment for Midnight curves.
Canonical Midnight ↔ Cardano partner-chain bridge internal to IOG framework. External multi-chain bridges (Wormhole, LayerZero) not yet documented as live. No bridge has a published PQC roadmap.
Federated launch validators include Blockdaemon (custody-adjacent), Google Cloud, Vodafone, eToro. Top-tier institutional custody (Coinbase Custody, BitGo, Fireblocks, Anchorage) does not yet support Midnight native asset custody at scale. None has published PQC roadmap covering Midnight keys.
RPC: Ankr, Foundation, validator-operated. HSMs: no documented Ledger/Thales/YubiHSM PQC integration for Midnight curve material. TEEs: not in consensus path. None ships PQC.
7 Governance & Coordination weight 5% 36 / 100
Federated mainnet launch (Kūkolu): named-entity validator set (Google Cloud, Vodafone, eToro, Blockdaemon, others). Concentrated by design during federated phase. Mōhalu (mid-2026) opens validator participation more broadly.
Pluto-Eris → BLS12-381 proving-system migration (May 2025 testnet) is substantive coordinated cryptographic upgrade. Mainnet launch on schedule (2026-03-31). Two months of mainnet at evaluation date, short window. No demonstrated coordinated upgrade under live attacker pressure.
Midnight Foundation (Switzerland) and Input Output Global (IOG, core development). Public chain-leadership: Charles Hoskinson (Cardano-derived chain leadership). Cardano-derived cryptographic heritage. No named PQ migration WG or PQ-lead role.
No adversarial-pressure coordination event in short history. Proof-system migration was planned, not attack response.
No community honeypot, no rate-limited spending rule, no cryptographic tripwire, no automated-response mechanism.
X + Y vs Z, when does the math turn against you?
v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?
Verdict
X+Y reaches 2034–2041, Crisis Zone (vs Z10 2030); partial Outside risk window (vs Z25 2035)
Z-compliance
Outside compliance window, Ed25519 consensus and BLS12-381 note encryption non-compliant under NIST 2030 deprecation / 2035 disallowance
Source-disagreement disclosure
v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.
Industry coverage describes Midnight's privacy in absolute terms (regulated-industry-grade, rational privacy) without distinguishing classical confidentiality from post-Shor retroactive decryption. LayerQu separates the two: Kachina-based privacy is robust against classical adversaries today; against a future Shor adversary harvesting ciphertexts, the same guarantees fail retroactively.
Delta-QRI under alternative weighting
Under alternative weighting that increases Dim 3-Confidentiality from 10% to 15% (and reduces Dim 6 from 18% to 13%), Midnight's QRI drops from 22 to ~19, reinforcing the Stage-1 / borderline-Acknowledged read.
Announcement-to-shipped ratio
Announced: 0. Shipped: 0. Ratio: 0.
Tag: none, no announcement to falsify; Midnight honest by silence
Peers in the privacy-focused chain profile
9 chains closest to Midnight by Stage then QRI.