Discrete is a standalone proof-of-work chain whose ownership has been post-quantum since genesis — ML-DSA-65 spend authorization, ML-KEM-768 output delivery, and no elliptic-curve outputs anywhere that would have to be migrated later. Mainnet has been running since 15 July 2026.
Harvest-now-decrypt-later is only the opening move. Nearly every coin in circulation rests its ownership authorization on elliptic-curve signatures. Given a cryptographically relevant quantum computer, Shor’s algorithm recovers a private key from any public key the chain has exposed — and the balances behind those keys can then be spent by someone else. The same break reaches whatever else a chain has put on the same curve: checkpoint keys, treasury controls, bridges, governance.
ECDSA and EdDSA decide who may spend. Once the private key behind an exposed public key can be recovered, an adversary can forge the signatures that authorize spending and drain the balances behind them — together with any checkpoint, treasury, bridge, or governance authority held on the same curve. Proof-of-work issuance is a separate mechanism: a node checks each coinbase against the emission formula, not against an ownership signature.
Existing cryptocurrencies can migrate to post-quantum ownership. Discrete takes another approach: post-quantum ownership from genesis, with no legacy elliptic-curve outputs that must later be migrated — and so no permanent tail of un-migrated coins whose owners are inactive, unreachable, or gone.
Every spend is authorized by an ML-DSA-65 signature (FIPS 204) over the transaction digest, bound to the output through a SHA3-256 commitment. There is no elliptic-curve operation anywhere in the validation path, and no vulnerable legacy state.
The sender encapsulates to the recipient’s ML-KEM-768 view key (FIPS 203). An unspent output carries no recipient public key — only a hash commitment and a ciphertext — so unspent outputs are not linkable to an address. Amounts are public, and spending reveals the long-term spend key.
One seed derives the whole identity: the ML-KEM view key, the ML-DSA spend key, and every deposit address under it. Recovery is the same scan run from genesis — no address counters to lose and no wallet-local bookkeeping needed to find your own outputs.
DiscretePower binds each mining candidate to the reward identity and injects its ML-DSA signature throughout the memory-hard computation, adding friction to conventional delegated mining. It does not make powerful servers equal to desktop CPUs, and it does not make pooling mathematically impossible.
Each node refuses any reorganization more than ten blocks behind the history it actually witnessed, however much work the competing chain carries. The rule is weak-subjective and node-local: a partition can leave groups on incompatible histories, and recovery is an explicit operator step.
A short checksummed number such as 4821-7-KQ9D-X points at a registration on chain, so people can exchange something shorter than a full post-quantum address. It is a usability layer over the address: resolution needs a trusted, synced node, and a wallet refuses the number unless the resolved keys reproduce its key fingerprint.
Every client is open source. Verify the build, read the code, or just grab a wallet and start. Discrete does not sell XDS — the only ways to hold it are to mine it or be paid in it.
Full node and wallet in one app for Windows, macOS, and Linux. Send, receive, and mine with a click.
Headless daemon, wallet CLI, and miner for operators and power users. Scriptable, auditable, server-ready.
Lightweight wallet for the browser, iOS, and Android. Keys stay on your device.
Mainnet runs Phase 1 today: post-quantum ownership with public amounts and a public spend graph. Confidential amounts are the one planned refinement and are roadmap, not a shipped feature — they ship only after independent review. The transaction graph stays transparent by design; Discrete is post-quantum cash, not an anonymity system.
A focused set of primitives — standardized, conservative, and post-quantum by default. The figures below are the frozen mainnet consensus parameters; changing any of them after launch is a hard fork.
These are deliberate, documented costs of the design. They are stated here for the same reason they are stated in the whitepaper: a protocol assessment is only useful if it includes what the protocol gives up.
Run a node. Mine it. Inspect the chain. Benchmark the proof-of-work. Read the whitepaper and review the code. Discrete does not sell a coin — it invites you to examine a network.