On September 9, 2026, a16z Crypto released Lattice Jolt, a zero-knowledge virtual machine (zkVM) that replaces elliptic-curve cryptography with lattice-based primitives aligned to NIST post-quantum standards. The system produces proofs of 65–80 KB — two to eight times smaller than hash-based post...
"If quantum computers suddenly appear, we lose the finality guarantee, but the chain keeps chugging along." — Vitalik Buterin, Ethereum Co-Founder, February 2026
On September 9, 2026, a16z Crypto released Lattice Jolt, a zero-knowledge virtual machine (zkVM) that replaces elliptic-curve cryptography with lattice-based primitives aligned to NIST post-quantum standards. The system produces proofs of 65–80 KB — two to eight times smaller than hash-based post-quantum alternatives — while running 2–3x faster than its predecessor. The underlying polynomial commitment scheme, Akita, was co-developed with LayerZero, Carnegie Mellon University, and the University of Southern California.
The release arrives at a moment of compressing timelines. Three papers published between May 2025 and March 2026 reduced the estimated physical qubit count needed to break elliptic-curve cryptography from 9 million to fewer than 500,000. NIST has set a 2030 deprecation date for ECDSA. Bitcoin merged its first post-quantum proposal (BIP-360) in February 2026. Ethereum's Strawmap targets quantum-resistant consensus by 2030. The zero-knowledge proof market, valued at $1.7–1.9 billion in 2026 according to The Business Research Company and Grand View Research, now faces a forced migration of its cryptographic foundations — and Lattice Jolt is the first production-grade system to ship with quantum-resistant primitives baked in.
Jolt, first released by a16z Crypto in April 2024, is an open-source zkVM built on the Lasso lookup argument and sumcheck-based techniques. It compiles programs written in standard Rust into RISC-V instructions and generates proofs of correct execution. The original version relied on Dory, a polynomial commitment scheme built on elliptic-curve pairings — the same class of cryptography that Shor's algorithm renders vulnerable to quantum attack.
Lattice Jolt replaces Dory with Akita, a polynomial commitment scheme constructed on the Module-SIS (Module Short Integer Solution) lattice problem. Module-SIS is the same mathematical foundation that underpins ML-DSA (FIPS 204) and ML-KEM (FIPS 203), the signature and key encapsulation standards NIST finalized in August 2024. The system operates on 128-bit values rather than 256-bit values, which contributes to the performance gains.
Akita supports transparent setup, meaning it requires no trusted ceremony — a property that matters for decentralized deployments where no single entity can be trusted to generate and destroy setup parameters. According to LayerZero, Akita is "the first production-ready, lattice-based polynomial commitment scheme for post-quantum security."
The remaining components of Jolt's proof stack carry information-theoretic security, meaning they do not rely on any computational hardness assumption and are secure against adversaries with unlimited computing power, including quantum computers. This makes Akita the single cryptographic chokepoint: replacing it with a quantum-resistant primitive renders the entire system quantum-resistant.
The initial deployment target is LayerZero's Zero blockchain, a Layer-1 network designed for institutional finance that claims a throughput target of 2 million transactions per second. Zero has secured backing from Citadel Securities and ARK Invest, according to LayerZero's February 2026 announcement.
The following figures come from a16z Crypto's published benchmarks. Independent verification has not been completed at time of writing.
| Metric | Previous Jolt (Dory) | Lattice Jolt (Akita) | Change | |---|---|---|---| | Prover speed (CPU) | ~1M RV64IMAC cycles/sec | 2M+ RV64IMAC cycles/sec | ~2x faster | | Prover speed (GPU) | Not disclosed | 10M+ cycles/sec | N/A | | Proof size | Not disclosed | 65–80 KB | 2–8x smaller than hash-based PQ | | Memory per cycle | ~300 bytes | ~200 bytes | ~33% reduction | | Field size | 256-bit | 128-bit | 50% reduction | | Proving overhead | ~10,000x execution | ~10,000x execution | No change |
For context, hash-based post-quantum proof systems typically produce proofs exceeding 200 KB. Lattice Jolt's 65–80 KB range is significant because proof size directly affects on-chain verification costs — larger proofs consume more gas or computation when verified by a smart contract.
The codebase remains under 25,000 lines of Rust, which a16z has cited as a security advantage: fewer lines of code reduce the surface area for implementation bugs. Individual CPU instructions are implemented in as few as 50 lines.
A companion paper on full zero-knowledge properties (the ability to hide private inputs, not just prove correct computation) has been announced but not yet published. The current release provides succinctness — small proofs of correct execution — but does not hide the inputs to the computation.
Three research papers between May 2025 and March 2026 materially reduced the estimated resources needed to break elliptic-curve cryptography:
Paper 1 — Gidney (Google Quantum AI, May 2025): Estimated RSA-2048 breakable with fewer than 1 million physical qubits in under a week, a 20x reduction from a 2019 estimate of 20 million qubits, achieved through algorithmic improvements including approximate residue arithmetic and magic state cultivation.
Paper 2 — Iceberg Quantum (Sydney, February 2026): Proposed RSA-2048 breakable with fewer than 100,000 physical qubits using quantum low-density parity-check (QLDPC) codes. The result was validated through simulation; it requires qubit connectivity not yet demonstrated at scale.
Paper 3 — Google Quantum AI (March 2026): Co-authored with Justin Drake of the Ethereum Foundation and Dan Boneh of Stanford. Estimated 256-bit elliptic-curve cryptography breakable with fewer than 500,000 physical qubits in minutes. The paper was published as a zero-knowledge proof of the result itself — the actual circuits were withheld for responsible disclosure.
Current quantum hardware operates at approximately 1,000–1,200 physical qubits (2026), representing a gap of roughly 400–500x. Expert consensus places the arrival of a cryptographically relevant quantum computer (CRQC) at 10–20 years from now, though some researchers project under 10 years. Google has set a 2029 internal deadline for migrating its own systems to post-quantum cryptography.
The blockchain-specific concern differs from generic encryption threats. Attackers could derive private keys during transaction confirmation windows. According to the March 2026 Google paper, breaking the secp256k1 curve that secures Bitcoin and Ethereum could take approximately nine minutes under ideal conditions — less than Bitcoin's average block time.
BIP-360, authored by Hunter Beast, Ethan Heilman, and Isabel Foxen Duke, was merged into Bitcoin's official proposal repository on February 11, 2026. It introduces Pay-to-Merkle-Root (P2MR), a new output type that removes the key-path spend from Taproot, eliminating the exposed public key a quantum computer could target. Different branches of the Merkle tree can carry different signature algorithms — ML-DSA, FN-DSA, SLH-DSA — enabling crypto-agility.
BIP-361 proposes a three-phase sunset of ECDSA and Schnorr signature spends once a quantum-resistant output type exists. A working testnet from BTQ Technologies has produced quantum-resistant transactions since March 2026. Mainnet activation has not occurred. Co-author Ethan Heilman has estimated full migration would take seven years from the day consensus forms.
Ethereum's approach relies on account abstraction rather than a single protocol-wide migration. EIP-8141, under consideration for the Hegota hard fork in the second half of 2026, decouples account authentication from ECDSA, allowing individual accounts to adopt quantum-resistant signature schemes independently.
Vitalik Buterin published a "Strawmap" on February 26, 2026, targeting quantum-resistant consensus by 2030 through approximately seven forks over four years. The Ethereum Foundation formed a dedicated Post-Quantum Security team in January 2026, led by Thomas Coratger, with $2 million allocated for research prizes. Buterin has noted that ECDSA verification costs about 3,000 gas while quantum-resistant signature checks may reach 200,000 gas — a roughly 67x increase in verification cost.
NIST IR 8547 (initial public draft, November 2024) proposes deprecating RSA-2048 and ECC-256 by 2030 and disallowing them after 2035. Three independent deadlines converge in late 2026 and early 2027: NIST's FIPS 140-2 historical transition on September 21, 2026, the EU NIS Cooperation Group's national strategy milestone on December 31, 2026, and the NSA CNSA 2.0 acquisition deadline.
Lattice Jolt enters a market with two established competitors: SP1 (Succinct Labs) and RISC Zero. Neither has shipped post-quantum primitives as of September 2026.
A June 2025 benchmarking study by Fenbushi Capital evaluated eight zkVMs — SP1, RISC Zero, OpenVM, Pico, ZKM, Jolt, Nexus, and Novanet — across four computational tasks. SP1 with GPU acceleration showed the most gradual increase in proving time at scale. RISC Zero and OpenVM demonstrated moderate scaling. Jolt, ZKM, and Pico showed the steepest performance degradation under increasing workloads.
At its initial 2024 release, a16z claimed Jolt was 5x faster than RISC Zero and up to 2x faster than SP1 on preliminary benchmarks. SP1's team noted at the time that Jolt did not yet support recursion or most real-world benchmark programs.
The post-quantum upgrade changes the competitive calculus. If NIST's 2030 deprecation timeline holds and federal mandates extend to blockchain infrastructure, zkVM providers will need to migrate away from elliptic-curve assumptions. Lattice Jolt is the first to ship with that migration complete. SP1 and RISC Zero — both built on STARK-based architectures — rely on hash functions rather than elliptic curves for their core security, which are generally considered quantum-resistant but produce larger proofs.
According to Electric Capital's Developer Report (2024), over 78% of ZKP implementations in blockchain use SNARK-based systems, which typically rely on elliptic-curve assumptions. STARK adoption is growing, particularly where quantum resistance matters, but STARKs carry a proof-size penalty.
The ZK proof market is projected at $1.7–1.9 billion in 2026, growing to $5.12 billion by 2030 at a CAGR of approximately 31%, according to The Business Research Company. Grand View Research estimates $7.6 billion by 2033. Over $28 billion in assets are secured by ZK-based blockchain systems, according to industry reports.
The economic question is who bears the cost of post-quantum migration. Larger proofs mean higher on-chain verification costs. Buterin's estimate of 67x higher gas costs for quantum-resistant signature verification on Ethereum illustrates the trade-off. Lattice Jolt's 65–80 KB proof size partially mitigates this — it is the smallest post-quantum ZK proof reported to date — but proving overhead remains at approximately 10,000x normal execution cost.
For the approximately 85–90% of blockchain economic activity sustained by subsidies rather than organic fee revenue — as documented in webthreepedia's foundational economic value research — adding quantum migration costs compounds the sustainability challenge. Networks already running deficits between fee revenue and infrastructure costs will need to fund cryptographic upgrades from the same subsidy mechanisms: token inflation, foundation grants, and venture capital.
The absence of a token announcement alongside Lattice Jolt is notable. a16z Crypto positioned the release as infrastructure, not a token launch vehicle. LayerZero's Zero blockchain, the first deployment target, has not announced a token either, though the involvement of Citadel Securities and ARK Invest as backers signals institutional distribution channels.
Lattice Jolt is the first production-grade zkVM with post-quantum cryptographic primitives. It produces proofs of 65–80 KB, 2–8x smaller than hash-based post-quantum alternatives, while running 2–3x faster than its elliptic-curve predecessor.
The quantum threat timeline has compressed significantly. Three papers in 12 months reduced the estimated qubit cost of breaking ECC from 9 million physical qubits to fewer than 500,000, though current hardware remains at ~1,200 physical qubits.
NIST has set a 2030 deprecation deadline for ECDSA. Blockchain networks relying on elliptic-curve cryptography face a regulatory forcing function independent of when a quantum computer actually arrives.
Bitcoin and Ethereum have different migration strategies. Bitcoin's BIP-360 removes exposed public keys via P2MR. Ethereum's EIP-8141 uses account abstraction for per-account signature flexibility. Both remain pre-mainnet.
The cost of quantum migration is material. Ethereum's estimated 67x increase in signature verification gas costs and the proving overhead of post-quantum ZK systems will compound the existing subsidy dependency of most blockchain networks.
The zkVM market now has a post-quantum first mover. SP1 and RISC Zero have not shipped equivalent quantum-resistant upgrades. The competitive dynamics of the $1.7–1.9 billion ZK proof market may shift if regulatory timelines accelerate adoption requirements.
Lattice Jolt does not solve the quantum threat to blockchains. It solves one component — zero-knowledge proving — while the larger challenges of signature migration, consensus-layer upgrades, and governance coordination remain open. Bitcoin's BIP-360 co-author estimates seven years for full migration after consensus forms. Ethereum's Strawmap targets 2030. Neither has begun mainnet deployment.
What Lattice Jolt demonstrates is that post-quantum ZK proving is technically feasible at competitive performance levels. The 65–80 KB proof sizes and 2 million cycles per second on CPU are within the range needed for production workloads. Whether the broader ecosystem migrates before a quantum threat materializes — or after — remains a governance and economic question, not a technical one.
The clock is running. NIST's 2030 ECDSA deprecation deadline is four years away. The "harvest now, decrypt later" threat means data and transactions exposed today could be retroactively compromised. For an ecosystem where 85–90% of economic flows are already subsidy-driven, the cost of adding quantum migration to the infrastructure burden is not trivial. But the cost of not migrating is existential.