Starknet Voted 93.52% for Post-Quantum Research. Its Accounts Still Sign With ECDSA.

Starknet's governance portal closed a poll on post-quantum Layer 1 research at 93.52% support, and the timeline is already drafting the headline: Starknet goes quantum-safe.

Run the autopsy on that sentence and it comes apart. Nothing was approved — the vote is explicitly non-binding and does not authorize a network migration. Nothing exists to approve — the whitepaper draft isn't scheduled until November, which makes the technical object at the center of this vote a title rather than a document. And the part that actually matters: Starknet's proof layer has been post-quantum-friendly since the first STARK paper, while its account layer — the surface every user touches — still leans on the elliptic-curve discrete logarithm problem that Shor's algorithm was built to eat.

We didn't get a quantum-safe Starknet. We got a governance signal that a research program might one day exist, wrapped in a number that means nothing until we know how much voting power bothered to show up.

That gap — between what the ballot says and what the code does — is the entire story. And almost nobody is pricing it correctly, in either direction.

What Actually Passed

Starknet is a validity rollup on Ethereum. StarkWare, the Israeli development company behind it, published the original STARK construction back in 2018 — a proof system that is transparent (no trusted setup) and built on hash functions rather than on the elliptic-curve assumptions that underwrite most of the industry. The network executes transactions off-chain in Cairo, generates a STARK attesting to the correctness of that execution, and posts the proof plus state diffs to Ethereum L1 for settlement and data availability. STRK is the native token, carrying governance rights, fee payment, and — since the staking rollout — a staking function with inflationary rewards.

The proposal in question asked token holders to endorse the pursuit of post-quantum Layer 1 research. It cleared with 93.52% support. It carries no funding commitment, no roadmap obligation, and no execution force. A whitepaper draft is expected in November.

That is the whole fact pattern. Four data points, no parameters, no supply figures, no on-chain metrics, no budget line.

I have watched this movie before, from closer than I'd like. In 2017 I was running 48-hour whitepaper sprints in Tokyo, decoding tokenomics for Status and Cindicator and publishing before anyone else had finished reading the abstract. The lesson I paid for in reputation was that a document titled research and a document titled specification are different species, and the market never distinguishes them until it is forced to. I built a verification checklist after the 2021 NFT metadata mess specifically because speed without a technical spine produces confident nonsense. So let me be precise about what this vote is and is not, and where the actual signal lives.

The timing is not accidental. NIST finalized its first post-quantum standards in August 2024 — FIPS 203 for key encapsulation, FIPS 204 for digital signatures, FIPS 205 for the stateless hash-based scheme. Google's Willow chip in late 2024 demonstrated error correction below threshold, which is a genuine engineering milestone and also the exact kind of headline that detonates a narrative cycle in a market that reads abstracts and skips the appendix. Ethereum's own researchers have been circulating proposals for quantum-resistant externally owned accounts and for aggregating post-quantum signatures via recursive proofs. Every large chain has a PQC line item now.

Which raises the question that actually deserves an answer: why would Starknet, a rollup with a contested market position, spend governance bandwidth on a research direction that its own architecture already half-solves?

The L1 Ambiguity Is Not Pedantry

The proposal's language says post-quantum Layer 1. Starknet is not a Layer 1. It settles on Ethereum. Anyone who has read the architecture docs knows this, which means the phrasing is doing work — and we should figure out what work.

Three readings are live. The charitable one: the research target is post-quantum Layer 1 architecture as an abstract technical subject, a contribution to the field that need not bind Starknet itself. The strategic one: Starknet is quietly signaling a path toward independent L1 status, and post-quantum security is the flag it plants first. The sloppy one: a copywriter meant post-quantum cryptography at the network layer and typed Layer 1 because it scans better.

My read sits with the third, with meaningful probability mass on the first, and very little on the second. Here's why. A pivot to independent L1 would require Starknet to solve data availability, consensus, and validator economics from scratch — and to abandon the settlement guarantees that are its primary institutional selling point. No serious team floats that in a non-binding poll with a November whitepaper placeholder. But a team absolutely does float research framing that happens to make its brand legible to Ethereum's own PQC working groups.

This matters because the ambiguity determines the nature of the entire narrative. If reading one is correct, the value is reputational and long-dated. If reading two were correct, it would be a structural repricing event for STRK. The fact that the market cannot tell the difference from the announcement alone is itself the finding.

STARK Is Post-Quantum. Starknet Is Not.

Here's the part nobody priced.

Starknet's marketing has a legitimate technical foundation: STARKs are hash-based, and hash-based cryptography degrades gracefully under quantum attack. Shor's algorithm breaks RSA and elliptic-curve discrete logarithms — the mathematics underlying ECDSA, the signature scheme that secures nearly every account in this industry. Grover's algorithm only halves effective security on hash preimages. A hash-based proof system is therefore in a structurally different risk class from an ECDSA-secured one.

But a network is a stack, not a proof system. Walk it.

The proof layer is the strongest link, with a caveat that the marketing never surfaces. Starknet's modern hash functions are algebraic constructions like Poseidon, designed for efficiency inside the field. Its legacy Pedersen hash, however, was built on elliptic-curve operations over the Stark curve. If Pedersen remains anywhere in the commitment path — and historically it has — then Shor's algorithm applies to that component directly. Migrating hash functions inside a proof system is not a find-and-replace; it changes constraint counts, proof sizes, verifier gas, and every circuit that depends on them.

The account layer is the weak link, and it is the one users actually live inside. Starknet accounts are contracts, and the default signature scheme is ECDSA over secp256k1. That is the exact primitive Shor's algorithm targets. Every wallet, every hardware signer, every custody integration in the ecosystem inherits that exposure.

The settlement layer is outside Starknet's control entirely. Bridging and L1 verification depend on Ethereum's own signature infrastructure — ECDSA for accounts, BLS for consensus aggregation. Starknet can be perfectly post-quantum internally and still inherit Ethereum's quantum surface at the boundary.

So the sentence Starknet's marketers want to write — STARK is quantum-resistant — is true and irrelevant. The sentence that matters is: Starknet's users sign with elliptic curves, and its bridge trusts a chain that signs with elliptic curves. The proof system was never the problem. The research vote, if it is worth anything, is worth it precisely because it targets the layer that the existing narrative conveniently skips.

That is the information gain in this story, and it took three layers of architecture to reach.

The Signature Tax Nobody Has Budgeted For

Assume the November whitepaper is serious and proposes migrating the account layer to a NIST-standardized scheme. Now the engineering starts, and the numbers are brutal.

An ECDSA signature over secp256k1 is 64 bytes, with a 33-byte compressed public key. Falcon-512, the compact lattice option, runs roughly 666 bytes per signature with a 897-byte public key. ML-DSA-44 — FIPS 204's baseline parameter set — is about 2,420 bytes per signature and 1,312 bytes per public key. ML-DSA-65 pushes past 3,300 bytes. The stateless hash-based SLH-DSA at its smallest parameter set is around 7,856 bytes, and the higher-security variants are multiples of that.

Put plainly: a post-quantum signature is between ten and a hundred and twenty times larger than the one it replaces.

On a rollup, data is the cost center. Every byte of calldata or blob space is paid for. If every transaction in a Starknet block suddenly carries a 2.4-kilobyte signature instead of a 64-byte one, the DA bill does not rise by a rounding error — it rises by an order of magnitude in the signature component of the payload. And that is before verification. Lattice signature verification is cheap relative to signing but still thousands of field operations; stateless hash-based verification is worse. Running either natively in a verifier contract on Ethereum is not economically viable at scale.

The escape route is the one Starknet is uniquely positioned to take: do not verify post-quantum signatures on-chain at all. Verify them inside a STARK. Aggregate thousands of ML-DSA or SLH-DSA signature checks into a single recursive proof, post the proof, pay one verification cost. This is the same trick that makes validity rollups work in the first place, applied one level down at the signature scheme.

Which reframes the entire vote. The interesting question was never whether Starknet becomes quantum-safe. It is whether Starknet becomes the proof-aggregation layer that makes post-quantum signatures affordable anywhere. Those are different businesses with different customers.

If that is the actual research direction — and the November document will tell us — then this poll is not a security upgrade announcement. It is a positioning statement aimed at the one customer that matters: Ethereum itself.

Grover Doesn't Care About Your Marketing

A necessary correction to the hash-based triumphalism, because I have watched this get mangled in three separate research notes this quarter.

Hash-based does not mean quantum-immune. It means the attack model is Grover rather than Shor, and Grover imposes a quadratic — not exponential — reduction in security. A 256-bit hash delivers roughly 128 bits of security against a quantum adversary running an optimal search. That is still adequate. But a 128-bit security parameter delivers roughly 64 bits, which is not. Any STARK system that chose parameters for classical convenience now has to re-examine them under a quantum cost model.

Starknet's field is a 252-bit prime. Its security margins are tuned for classical hardness assumptions. A genuinely post-quantum proof system likely needs larger fields, longer hashes, more rounds, or all three — and each of those increases proof size and verifier cost. So even the part of the stack that everyone agrees is quantum-friendly requires re-parameterization work that has not been scoped, budgeted, or scheduled.

This is what forensic skepticism buys you. The claim STARK is post-quantum is directionally true and operationally incomplete. The honest version is: STARK's underlying hardness assumption survives Shor, subject to parameter upgrades that will make proofs bigger and verification more expensive, which is precisely the cost problem the signature layer also faces. Both problems point to the same solution — recursive aggregation — and the same conclusion: this is a multi-year engineering program wearing a research label.

Account Abstraction Cuts Both Ways

Starknet's native account abstraction is usually sold as the ecosystem's crown jewel, and for signature agility it genuinely is. On Ethereum, changing the account signature scheme means changing the protocol — a hard fork touching every client. On Starknet, accounts are contracts. A new signature scheme is a new account implementation. Users migrate by deploying a different contract. The protocol does not fork; the ecosystem iterates.

That is a real structural advantage, and it is the strongest technical argument that Starknet could lead on post-quantum account migration rather than follow.

Now the liability, which I have not seen raised anywhere.

Contract-based accounts store state. A Starknet account contract typically holds its public key in storage, readable by anyone, from the moment the account is deployed. An Ethereum externally owned account, by contrast, exposes its public key only after it has signed a transaction — the address itself is a hash of the key, so an untouched account keeps its public key hidden.

Under a quantum threat model where an adversary can derive private keys from exposed public keys, that difference is not academic. Starknet's account abstraction is a quantum asset in its agility and a quantum liability in its transparency — and the transparency problem arrives years earlier than the agility benefit. Every deployed Starknet account with a public key sitting in storage is a candidate for retroactive key recovery in a post-Q-day world, and there are far more of them than there are Ethereum accounts that have already spent.

That asymmetry is the kind of thing a whitepaper written by people who understand their own stack would address in the first ten pages. If the November document doesn't mention it, we will know the research program is a brand exercise.

93.52% of What?

Now the governance forensics, because the headline number is doing more rhetorical work than the technical content.

A 93.52% support rate is meaningless in isolation. It is a ratio. The denominator — participation — is not in the announcement, and without it we cannot distinguish a community consensus from a delegate cascade. If five percent of circulating voting power showed up and split 94 to 6, the proposal passed on the strength of a handful of addresses. If thirty percent showed up, it is a genuine signal.

I have seen this exact failure mode repeatedly since the Compound governance experiments of 2020. Turnout in token governance routinely lands in single digits, and delegated voting concentrates further still — a foundation, a few funds, and a handful of large delegates can produce a number that reads as unanimous while representing almost no one. Starknet governance is delegate-based, and StarkWare plus the Starknet Foundation hold substantial influence over the agenda. The realistic structure here is that the development company proposed a research direction and the community ratified it, which is normal for L2 governance and also nothing like grassroots consensus.

The countervailing point deserves equal weight: the team labeled the poll non-binding and explicitly stated it does not approve a network migration. That is good practice. Distinguishing a signal vote from an execution vote is exactly what mature governance looks like, and a team trying to manufacture hype would have written binding language into a headline. The restraint is evidence of institutional seriousness.

So: a serious team, a legitimate research direction, a genuine 93.52%, and an unknown denominator. Hold all four at once. Anyone collapsing this into either a triumph or a sham is doing the analysis wrong.

The Economic Null

The token economics of this event are, with precision, nothing.

A non-binding research poll does not spend treasury funds. It does not alter emission schedules, staking rewards, unlock cliffs, or fee parameters. STRK's supply structure, allocation, and vesting are not touched. There is no cash flow event, no burn, no buyback, no incentive program. The direct effect on STRK supply and demand is zero, and I will not manufacture a transmission channel to fill the space.

The indirect channel exists but is long and lossy: research credibility to developer confidence to ecosystem adoption to governance token value. Each link can break. Research programs that produce no deployable output break at the first link. Programs that produce a standard adopted by wallets and bridges — those compound, because standards are sticky and their authors accrue influence that outlasts a single network's market share.

What would change this assessment is a follow-on proposal attaching money. If November arrives with a research fund, a grants program, or ecosystem incentives tied to post-quantum migration, then we are talking about treasury deployment and inflationary pressure, and the analysis resets entirely. Until then, treat the token read as null and watch the governance queue, not the price chart.

The Strategic Read: This Is a Standards Play

Here is where I diverge from the consensus framing, and I think the consensus framing is wrong in a specific, identifiable way.

Everyone is reading this as a security upgrade announcement — Starknet moving toward quantum resistance. That reading is comfortable, legible, and almost certainly not what is happening.

Read it as a bid for a standards position instead. Ethereum will eventually have to migrate its account layer off ECDSA. When that conversation becomes real rather than theoretical, the binding constraint will not be which post-quantum scheme to adopt — NIST has already answered that — but how to make post-quantum signature verification affordable at Ethereum's transaction volume. A 2.4-kilobyte signature per transaction is not a scaling inconvenience. It is a scaling wall. The only credible way through is recursive proof aggregation: verify signatures inside a proof, verify the proof on-chain, amortize the cost across thousands of accounts.

Who writes the best recursive STARKs in this industry? The team that published the construction in 2018 and has been optimizing Cairo and its prover for six years. StarkWare is not competing to make Starknet quantum-safe. It is competing to be the aggregation layer that makes the entire industry's post-quantum migration economically possible — and to be the reference implementation when the Ethereum Foundation, wallet vendors, and custody providers start specifying.

That reframes the L1 language in the proposal entirely. A research program on post-quantum Layer 1 architecture is not a description of Starknet's own roadmap. It is a public-goods contribution to a problem every chain will face, made by a team whose commercial interest is being the default tool. This is StarkWare's established brand strategy — technical output as market positioning — and it is a smarter play than another round of throughput benchmarks.

We didn't get a security announcement. We got a land-grab in the standards layer, dressed as research, funded by nothing, ratified by an unknown number of tokens.

Contrarian: Q-Day Is a Marketing Calendar

The quantum threat narrative has a structural flaw that almost nobody in this industry wants to examine, and it goes like this.

The standard urgency argument is harvest now, decrypt later — adversaries capture encrypted traffic today and decrypt it when hardware matures. That argument is coherent for encrypted communications. It does not transfer cleanly to public blockchains, because there is nothing to harvest secretly. Every transaction, every signature, every public key that has ever touched a public ledger is already public. The harvesting already happened; it is called the blockchain.

The actual threat model is narrower and stranger. It is retroactive forgery: once an adversary can derive a private key from an exposed public key, they can sign. That threatens accounts whose keys are exposed — which, as established, is every deployed Starknet contract account and every Ethereum account that has ever spent. It does not threaten accounts whose public keys remain hidden behind a hash, and it does not require decrypting anything.

And the timeline remains genuinely unknown. Breaking 256-bit elliptic curves requires a cryptographically relevant quantum computer with millions of physical qubits under fault tolerance. Current devices are three orders of magnitude away and improving along a curve nobody can extrapolate with confidence. Credible estimates for Q-day span the 2030s through the 2050s, and the honest answer is that the confidence interval is wider than the point estimate.

So this is preventive research, not emergency response. That does not make it worthless — cryptographic migrations take a decade, and starting late is how you get caught. It makes it un-urgent. And an un-urgent problem is exactly the kind of problem that gets used as a narrative instrument by teams that need one.

Contrarian: Every Other Label Was Taken

Which brings us to the real reason this poll exists, and it is not cryptography.

Count the Layer 2 networks with meaningful deployment. Then count the distinct narratives available to differentiate them. Throughput was taken. Cheap fees were taken. Zero-knowledge was taken and then diluted until it meant nothing. Modularity was taken. Restaking was taken. Every legible category is crowded, and the underlying user base has not grown fast enough to justify the number of networks competing for it.

That is not scaling. That is slicing an already-thin pool of liquidity, developers, and attention into ever-smaller shares and calling the fragmentation progress. I have argued for years that most liquidity fragmentation discourse is a manufactured problem invented to sell routing products — but here the manufactured thing is the category itself. Quantum resistance was one of the last unoccupied labels. Now it is occupied.

This is not cynicism; it is the correct read of competitive dynamics. When differentiation space collapses, protocols reach for the most technically defensible remaining label. Quantum resistance is unusually good for this purpose because it is real, it is long-dated, it cannot be disproven in the near term, and it flatters the team making the claim. The STARK heritage makes it credible rather than absurd, which is more than most narrative grabs can say.

The tell will be in November. A whitepaper containing a migration timeline, a layered rollout across account, bridge, and proof layers, and a funding commitment is a research program. A whitepaper containing a survey of post-quantum schemes and a call for community discussion is a marketing document with footnotes. Watch which one lands.

What to Watch, and What Would Change My Mind

The November whitepaper is the only near-term catalyst, and its value is entirely in specificity. Three things would move my assessment. A concrete migration path for the account layer — naming a scheme, estimating the engineering surface across wallets, hardware signers, and the bridge, and sequencing the rollout — would signal a genuine program. A recursive aggregation design that lets post-quantum signatures be verified inside a STARK and amortized across accounts would be the strategically important artifact, because that is the piece with external commercial value. And any appearance of a budget line would convert this from a signal into an economic event for STRK.

The second thing to watch is the governance data that should have accompanied the announcement. Pull the participation rate and the delegate distribution from the governance portal. If turnout is under five percent and the top ten addresses control more than half the vote, the 93.52% is a formality and should be described as one. If turnout is substantial and distributed, I will revise upward — the community genuinely endorsed a direction.

The third is competitive velocity. Ethereum's own PQC research, Algorand's long-standing quantum-resistance claims, and a cluster of smaller chains built entirely around the label all compete for the same mindshare. If a larger ecosystem ships a usable post-quantum account standard first, Starknet's differentiation evaporates regardless of the quality of its research. Standards positions are winner-take-most, and being early is not the same as being first.

And the wildcard is hardware. Another Willow-class milestone, or a credible claim of a cryptographically relevant demonstration, would compress every timeline in this article and make the urgency argument real instead of rhetorical.

Here is the question I keep returning to, and it is the one I would put to the Starknet team directly. If the proof system was always the quantum-friendly part, and the accounts were always the exposed part, then why did it take a governance vote in 2026 to point research at the layer that actually breaks? Either the team has been quietly working this for years and the vote is ratification of a mature internal program — in which case November will show it — or the industry spent a decade marketing hash-based proofs as quantum-safe while the signature layer sat there, untouched and unmentioned, waiting for someone to look.

I know which answer my audit experience points to. But I have been wrong before, in public, on a 48-hour deadline, and I would rather be precise than first this time.