The Problem Every Other Blockchain Has
In every major blockchain network today, making a transaction requires you to prove ownership of your funds by producing a digital signature. To verify that signature, the network needs your public key. Once verification is complete, that public key lives on-chain — forever, immutably, accessible to anyone who cares to look.
On classical hardware, this is a reasonable tradeoff. Deriving a private key from a public key using elliptic-curve math is computationally infeasible — it would take longer than the age of the universe. But on a quantum computer running Shor's algorithm, the same operation takes hours. Every public key sitting on Bitcoin's or Ethereum's blockchain is a ticking clock, waiting for hardware that doesn't yet exist to render it exploitable.
There is no patch for this on existing networks. The public keys are already out there, already being archived by adversaries pursuing a "harvest now, decrypt later" strategy. The only real solution is to build a wallet architecture that never exposes public keys on-chain in the first place.
That is precisely what TADEQS does.
What TADEQS Stands For
TADEQS — Threat-Adaptive Dynamic Encryption and Quantum Security — is QuanChain's wallet and key management system. It is not a layer on top of the blockchain; it is a core architectural component integrated at the protocol level. Every wallet on QuanChain is a TADEQS wallet. There is no classical alternative.
The Parent/Child Wallet Architecture
A TADEQS wallet has two logical components: a parent wallet and a rotating set of child wallets.
The parent wallet is the persistent identity anchor. It holds the master key material from which all child keys are derived, using a hierarchical deterministic scheme similar in concept to BIP-32 but built entirely on post-quantum primitives (Dilithium-5 and SPHINCS+-256f rather than secp256k1). The parent wallet's public key is never published on-chain.
Child wallets are the operational layer. When you want to receive funds, you generate a fresh child wallet derived from your parent. When you want to spend, you use a child wallet — and here is the critical part — you spend and rotate in a single atomic operation.
SpendAndRotate: Key Rotation Made Atomic
In a traditional blockchain wallet, spending is a two-step conceptual process: (1) produce a signature proving ownership, (2) broadcast the transaction. The public key required for step one stays on-chain after step two completes.
TADEQS replaces this with SpendAndRotate: an atomic transaction type that combines the spend authorization and the key rotation into a single indivisible operation. Here is what happens under the hood:
- A new child key pair is derived from the parent wallet.
- A commitment to the new child key (a hash, not the key itself) is included in the transaction.
- The transaction is signed with the current child private key and broadcast.
- The network validates the signature using the current child key commitment already registered on-chain (again, a hash — not a public key).
- Upon confirmation, the current child key is cryptographically retired and the new child key commitment replaces it.
The result: the public key used to authorize the spend is never published. The network validates against a hash commitment, not a raw public key. By the time a quantum adversary could attempt to derive a private key from a public key, there is no public key to derive from — it was never there.
SpendAndRotate doesn't just protect your keys going forward. It means there was never a window in which your key was exposed. The attack surface is zero, not small.
Twenty Security Levels
TADEQS supports 20 discrete security levels, numbered 1 through 20. Higher levels use stronger parameter sets for both Dilithium and SPHINCS+ signatures, larger key derivation trees, and more aggressive rotation schedules.
The appropriate security level depends on the use case:
- Levels 1–5: Suitable for low-value consumer payments where transaction speed is the primary concern. Signature sizes are minimized and rotation overhead is kept low.
- Levels 6–12: General-purpose range appropriate for most DeFi interactions, smart contract deployments, and institutional accounts up to moderate value.
- Levels 13–18: High-security configuration for treasury accounts, validator nodes, and high-value custodial wallets. At these levels, keys rotate more aggressively and additional SPHINCS+ hardening is applied.
- Levels 19–20: Maximum security. Designed for multi-signature governance accounts, protocol treasuries, and any wallet that must remain secure against quantum adversaries with near-future hardware capabilities. The Quantum Oracle can automatically escalate accounts to Level 19 or 20 when threat signals cross defined thresholds.
Importantly, users do not need to manually manage their security level. The default for new wallets is calibrated by the Quantum Oracle to be appropriate for current threat conditions. As the threat landscape evolves, the Oracle can recommend or trigger automatic escalation.
How Migration Happens Invisibly
One of the most operationally important properties of TADEQS is that cryptographic migrations are invisible to end users. When the Quantum Oracle determines that the network should upgrade to a stronger parameter set — say, escalating from Dilithium-3 to Dilithium-5 across all wallets, or moving from SPHINCS+-128f to SPHINCS+-256f — the migration is bundled into the next SpendAndRotate operation each wallet performs.
Users do not receive a notification that says "your cryptography is being upgraded." They simply make a transaction, and the upgraded parameters are applied atomically as part of that transaction. Wallets that have not transacted recently are proactively upgraded by a background process managed by the TADEQS parent wallet layer, which can generate and broadcast upgrade transactions without requiring the user to initiate a spend.
This is possible because TADEQS maintains a clean separation between the user's logical identity (the parent wallet) and the cryptographic material in active use (the child wallet layer). The parent is the anchor; the children are disposable and replaceable. Swapping out an entire cryptographic scheme is, from the parent wallet's perspective, simply generating a new child with different parameters.
What This Means for Quantum-Resistant Wallet Design
A quantum-resistant wallet needs more than post-quantum signature algorithms. It needs an architecture that never creates the attack surface those algorithms are meant to protect against. ECDSA with a quantum-resistant signature scheme wrapped on top is still ECDSA — the public key still lives on-chain, and Shor's algorithm still applies to it.
TADEQS rethinks the architecture from first principles. The key that signs a transaction is never the key the network validates against — only a hash commitment is ever published. The signing key itself rotates atomically on every spend, retiring the moment it is used. And the whole system is built on post-quantum primitives at every layer.
The result is a wallet system where the answer to "what public key can an adversary attack?" is not "a very hard one to crack" but simply: "none."
TADEQS is live on the QuanChain testnet. Developers can explore the parent/child architecture, observe SpendAndRotate transactions in the block explorer, and test wallet migration across security levels at quanchain.ai.