--- title: Is Dilithion quantum-safe? chain: Dilithion ticker: DIL hardy_score: 93.5 rank: 2 of 80 tier: "1: Native" url: "https://hardyindex.com/chains/dilithion" updated: 2026-10-23 reviewed: 2026-11-13 methodology_version: 1.8 --- # Is Dilithion quantum-safe? **Hardy Score 93.5 / 100. Rank 2 of 80. Tier 1: Native. Last editorial review 23 October 2026; sources checked 13 November 2026.** Yes, on the measure this index uses. Dilithion is a Bitcoin-style UTXO chain with its own RandomX proof-of-work consensus, and the signature its script interpreter checks is the one Dilithion calls CRYSTALS-Dilithium3. We read the node source to see which version that is, because the name could mean either the pre-standard round-three scheme or the final standard. It is the final standard: the node builds the CRYSTALS reference code at mode 3 and calls its FIPS 204 verify function with an empty context string, and the signature size fixed in the script code is 3,309 bytes, the ML-DSA-65 size, where round-three Dilithium3 signatures are 3,293. The chain agrees. On 23 October 2026 the explorer showed block 110,779 produced at 05:22 UTC, and a spend in block 110,588 carries a 3,309-byte signature and a 1,952-byte public key. Block 1 is timestamped 28 January 2026, after a reset in January that invalidated the coins and wallets of an earlier soft launch. No consensus path in the node calls an elliptic-curve verifier. The qualification is review: no audit or outside review of Dilithion's implementation has been published, and an engagement with Hacken is described as planned. > This is a security-readiness assessment, not investment advice. ## Summary Dilithion is a RandomX proof-of-work chain, live since January 2026, whose script interpreter verifies ML-DSA-65 signatures and no classical scheme, so every coin on its mainnet is protected by a FIPS 204 parameter set. ## Where we are making a judgement call Dilithion qualifies on the deployment test, a post-quantum signature running on its mainnet, and its size plays no part in the score. The current chain began on 28 January 2026, nine months before this review, after a reset in January that invalidated the coins and wallets of a soft launch two weeks earlier. Three readings are ours and are stated with what the other reading gives. One: Dilithion names its scheme CRYSTALS-Dilithium3, which could mean the pre-standard round-three scheme; we score it as FIPS 204 ML-DSA-65 because the code and the on-chain signature size both show that, and a reading of the name alone would put NIST at 7 and the score at 89.0. Two: exposure is 9 for the 160-bit address hash; a 10 gives 94.5. Three: migration is 8 rather than the 9 a chain with nothing outstanding could hold, because of that reset and the emergency consensus releases since; a 9 gives 95.0. Separately from the score, the project holds two kinds of standing control. Since height 40,000 registering a new miner identity requires attestations from three of four seed nodes whose keys are fixed in the node source, nodes Dilithion says it operates, so the project can decline to admit new miners. And 2% of every block subsidy is paid by consensus to two project addresses, a dev fund and a developer reward. This profile covers the DIL chain; DilV, a separate chain from the same team that shares the explorer, is not rated here. ## Score breakdown | # | Dimension | Score | Weight | Contribution | |---:|---|---:|---:|---:| | 1 | Signature scheme | 10/10 | 30% | 30.0 | | 2 | Deployment stage | 10/10 | 25% | 25.0 | | 3 | NIST alignment | 10/10 | 15% | 15.0 | | 4 | Migration path | 8/10 | 15% | 12.0 | | 5 | Exposure | 9/10 | 10% | 9.0 | | 6 | Verification | 5/10 | 5% | 2.5 | | | **Hardy Score** | | | **93.5** | ### 1. Signature scheme: 10/10 Anchor band 10: A post-quantum signature is the mandatory scheme for all accounts on mainnet. The script interpreter's signature check calls pqcrystals_dilithium3_ref_verify, the CRYSTALS reference implementation built at DILITHIUM_MODE 3, and no consensus path calls a secp256k1, ECDSA or Ed25519 verifier; the vendored OpenSSL headers are not used for signatures. Every spend on mainnet is authorised by ML-DSA-65, and a mainnet spend read on 23 October 2026 carries a 3,309-byte signature and a 1,952-byte public key. Source: https://github.com/dilithion/dilithion/blob/main/src/script/interpreter.cpp ### 2. Deployment stage: 10/10 Anchor band 10: Tier 1: Native. Tier 1: Native. Dilithion's current mainnet has used Dilithium signatures since block 1 on 28 January 2026, whose coinbase reads "Dilithion Mainnet v2.0.0 - Fair Launch Reset", so no unit of its supply was ever behind a classical key. The genesis block itself carries the timestamp 1737158400, 18 January 2025, although the chain launched in 2026, and its hash does not match the one Dilithion's mainnet page publishes. The explorer showed block 110,779 produced at 05:22 UTC on 23 October 2026. Source: https://explorer.dilithion.org/api/stats.php?chain=dil ### 3. NIST alignment: 10/10 Anchor band 9 to 10: The scheme in use is covered by a final NIST standard (FIPS 204, FIPS 205, or SP 800-208). Dilithion's own pages name CRYSTALS-Dilithium3 and cite NIST FIPS 204, and the code bears out the standard rather than the round-three name. The vendored reference code carries FIPS 204's context-string interface and 64-byte public-key hash, the node calls it with an empty context, and script.h fixes signatures at 3,309 bytes, the ML-DSA-65 size, where round-three Dilithium3 signatures were 3,293. Placement in the band: A 10 rather than a 9: the scheme in use on mainnet is ML-DSA-65 as FIPS 204 defines it, confirmed by signature size on-chain. A 9 would fit a FIPS 204 scheme named but not shipped, and pre-standard round-three Dilithium would sit lower still. Source: https://github.com/dilithion/dilithion/blob/main/src/script/script.h ### 4. Migration path: 8/10 Anchor band 6 to 8: A credible published plan exists with a mechanism identified, but key parts are unbuilt or undated. Holders have no quantum migration to make, because no output on the current chain has ever been locked to a classical key. The governance record is mixed. Dilithion ran a mainnet soft launch from release v1.4.0 on 14 January 2026, and then reset it: the v1.4.2 notes say coins mined on the previous chain would not be valid, and the v2.0.0 notes of 17 January say all existing mainnet wallets were invalidated. Since then consensus changes have activated at fixed heights, including emergency releases such as v2.0.12, a stability rollback, and v3.0.7, which softened parameters. Placement in the band: An 8 rather than a 9: nothing is outstanding, but the chain's record includes a reset that stranded the coins of its first holders, which weighs against how a future change between schemes would be handled. Not a 7, because no migration is pending and every coin on the current chain is behind ML-DSA-65. Source: https://github.com/dilithion/dilithion/releases/tag/v2.0.0 ### 5. Exposure: 9/10 Anchor band 9 to 10: No quantum-vulnerable public keys are exposed on-chain, or the exposed keys protect nothing. No Dilithion public key is a quantum liability. Outputs pay to a hash of an ML-DSA-65 public key, a 20-byte hash in the usual form and a 32-byte SHA3-256 hash in a second standard form, and the key a spend reveals is a lattice key that Shor's algorithm does not break. Placement in the band: A 9 rather than a 10: the usual address is a double SHA3-256 hash truncated to 160 bits, so a search for any key pair matching an unspent address costs about 2 to the 80 steps with Grover's algorithm, short of the margin the ML-DSA-65 signature itself is set at. Source: https://github.com/dilithion/dilithion/blob/main/src/script/interpreter.cpp ### 6. Verification: 5/10 Anchor band 3 to 5: A post-quantum component exists, on mainnet, on a persistent testnet or as a merged implementation, but is unreviewed. The post-quantum component is open source under the MIT licence and its use is checkable on-chain, where every spend carries an ML-DSA-65 signature and key. No outside review or audit of Dilithion's implementation has been published: its README says pre-audit hardening is complete and an engagement with Hacken is planned, with no findings published yet. Placement in the band: The top of the band rather than a 4: the component is live, licensed and built on the CRYSTALS reference code rather than a bespoke construction. Not a 6, because the review behind that reference code is upstream review, which does not count, and nobody outside the team has reviewed Dilithion's integration. Source: https://github.com/dilithion/dilithion/blob/main/README.md ## Nearest chains in the ranking The chains Dilithion sits among, out of 80 rated. The last column is the gap in Hardy points from Dilithion. | Rank | Chain | Tier | Hardy | vs DIL | |---:|---|---|---:|---:| | 1 | [Quantus Network](https://hardyindex.com/chains/quantus) | 1: Native | 94.0 | +0.5 | | 2 | **Dilithion** | 1: Native | 93.5 | this chain | | 3 | [Quantum Resistant Ledger](https://hardyindex.com/chains/qrl) | 1: Native | 92.5 | -1.0 | | 4 | [Mochimo](https://hardyindex.com/chains/mochimo) | 1: Native | 89.0 | -4.5 | | 5 | [Tidecoin](https://hardyindex.com/chains/tidecoin) | 1: Native | 89.0 | -4.5 | | 6 | [QoreChain](https://hardyindex.com/chains/qorechain) | 2: Shipping | 84.5 | -9.0 | | 7 | [Abelian](https://hardyindex.com/chains/abelian) | 1: Native | 84.0 | -9.5 | | 8 | [NEAR Protocol](https://hardyindex.com/chains/near) | 2: Shipping | 80.0 | -13.5 | | 9 | [Algorand](https://hardyindex.com/chains/algorand) | 2: Shipping | 77.0 | -16.5 | ## Signature scheme - **On mainnet today:** ML-DSA-65 (FIPS 204), which Dilithion calls CRYSTALS-Dilithium3, for every spend, through pay-to-public-key-hash scripts; RandomX proof-of-work consensus with no validator signatures - **Post-quantum scheme:** ML-DSA-65 itself, since genesis. Seed-node attestations and miner identity keys are signed with the same scheme. - **NIST standard:** FIPS 204 (ML-DSA-65) - **Readiness tier:** Tier 1: Native. Post-quantum secure at mainnet today, with quantum-resistant signatures built in from genesis. ## Cryptography in use - **Account signatures:** [ML-DSA](https://hardyindex.com/algorithms/ml-dsa.md) (ML-DSA-65). Mainnet, mandatory. Read through the explorer API on 23 October 2026: the spend in block 110,588 has a 5,265-byte scriptSig, a 2-byte length, a 3,309-byte signature, a 2-byte length and a 1,952-byte public key. Source (read on-chain): https://explorer.dilithion.org/api/tx.php?txid=cb86f68488750f17e306112bef3b81ec8b242cd7b97142dd790d4a43e6fef021&chain=dil - **Account signatures:** [ML-DSA](https://hardyindex.com/algorithms/ml-dsa.md) (ML-DSA-65). Mainnet, mandatory. OP_CHECKSIG calls pqcrystals_dilithium3_ref_verify with an empty context; the Makefile builds the reference code with DILITHIUM_MODE 3. Source (source code or release): https://github.com/dilithion/dilithion/blob/main/src/script/interpreter.cpp - **Identity layer:** [ML-DSA](https://hardyindex.com/algorithms/ml-dsa.md) (ML-DSA-65). Mainnet, mandatory. Miner identity key registration requires three of four seed-node attestations, each a Dilithium signature, from height 40,000. Source (source code or release): https://github.com/dilithion/dilithion/blob/main/src/core/chainparams.cpp A role not listed here is not evidenced either way. See https://hardyindex.com/algorithms.md. ## Roadmap - **14 January 2026** (shipped): Release v1.4.0 starts a mainnet soft launch. Source: https://github.com/dilithion/dilithion/releases/tag/v1.4.0 - **17 January 2026** (shipped): Release v2.0.0 resets the chain: its notes say all existing mainnet wallets are invalidated, and coins mined on the previous chain are not carried over. Source: https://github.com/dilithion/dilithion/releases/tag/v2.0.0 - **28 January 2026** (shipped): Dilithion mainnet begins from a reset genesis, with Dilithium signatures for every spend and RandomX proof of work. Source: https://dilithion.org/mainnet.html - **14 August 2026** (shipped): Node and wallet release v4.5.1 is published, the software a holder installs to create Dilithium keys and sign spends. Source: https://github.com/dilithion/dilithion/releases/tag/v4.5.1 - **No date published** (planned): A security audit engagement with Hacken, described in the README as planned, with no findings published yet. Source: https://github.com/dilithion/dilithion/blob/main/README.md ## If holders never migrate **Not applicable.** Every Dilithion output has been locked to a Dilithium key since the mainnet began on 28 January 2026, so there are no classical-key coins to migrate. As of 23 October 2026. ## Exposure Dilithion has no harvest-now-decrypt-later exposure in the sense this index usually means. Coins sit in pay-to-public-key-hash outputs, so an unspent output shows a hash and no key, and when a spend reveals the key, what an attacker records is an ML-DSA-65 lattice key that Shor's algorithm does not help with. The scheme is stateless, so there is no one-time key whose reuse leaks the private key. The residual point is the address, not the key: it is a 160-bit hash, which Grover's algorithm searches in about 2 to the 80 steps, a smaller margin than the signature's own. ## Frequently asked questions ### Is Dilithion quantum-safe? Yes, on the measure this index uses. Dilithion is a Bitcoin-style UTXO chain with its own RandomX proof-of-work consensus, and the signature its script interpreter checks is the one Dilithion calls CRYSTALS-Dilithium3. We read the node source to see which version that is, because the name could mean either the pre-standard round-three scheme or the final standard. It is the final standard: the node builds the CRYSTALS reference code at mode 3 and calls its FIPS 204 verify function with an empty context string, and the signature size fixed in the script code is 3,309 bytes, the ML-DSA-65 size, where round-three Dilithium3 signatures are 3,293. The chain agrees. On 23 October 2026 the explorer showed block 110,779 produced at 05:22 UTC, and a spend in block 110,588 carries a 3,309-byte signature and a 1,952-byte public key. Block 1 is timestamped 28 January 2026, after a reset in January that invalidated the coins and wallets of an earlier soft launch. No consensus path in the node calls an elliptic-curve verifier. The qualification is review: no audit or outside review of Dilithion's implementation has been published, and an engagement with Hacken is described as planned. ### Is Dilithion quantum-safe? On the measure this index uses, yes. Every spend on Dilithion is authorised by an ML-DSA-65 signature, a FIPS 204 parameter set, and no consensus path offers an elliptic-curve signature an output could use instead. We read the scheme in the node's script interpreter and confirmed it from the size of signatures in mainnet transactions on 23 October 2026. ### Is Dilithion's Dilithium3 the pre-standard scheme or FIPS 204? FIPS 204. Dilithion calls its scheme CRYSTALS-Dilithium3, the round-three name, but the reference code it builds has the context-string interface FIPS 204 added, the node verifies with an empty context as pure ML-DSA requires, and its signatures are 3,309 bytes, the ML-DSA-65 size. Round-three Dilithium3 signatures were 3,293 bytes, and that is not what the chain carries. ### Has Dilithion's implementation been audited? Not as of 23 October 2026. Dilithion's README says pre-audit hardening is complete and an engagement with Hacken is planned, with no findings published. The code it builds on is the CRYSTALS reference implementation, which has had wide review, but this index counts review of the chain's own component, so the verification score sits at 5. ### Can the Dilithion team control who mines? To a degree. Since block 40,000, registering a new miner identity needs signed attestations from three of the four seed nodes, whose keys are fixed in the node source and which Dilithion says it operates. That gives the project a way to decline new miners. It does not touch which signature protects coins, so it is recorded in the caveat rather than in the score. ### Was there an earlier Dilithion mainnet? Yes. A soft launch began with release v1.4.0 on 14 January 2026, and release v2.0.0 on 17 January reset the chain: its notes say all existing mainnet wallets were invalidated, and coins mined before the reset were not carried over. The chain rated here began on 28 January 2026. ## What this rating means if you hold Dilithion Plain-language guidance from the same publication, with no product recommendation attached. - [Is my crypto safe from quantum computers?](https://hardyindex.com/guides/is-my-crypto-safe-from-quantum-computers.md) - [How to protect your crypto from quantum computers](https://hardyindex.com/guides/how-to-protect-crypto-from-quantum-computers.md) - [All guides](https://hardyindex.com/guides.md) ## Sources 1. [Dilithion node source: src/script/interpreter.cpp](https://github.com/dilithion/dilithion/blob/main/src/script/interpreter.cpp): Dilithion on GitHub (primary, checked 23 October 2026) 2. [Dilithion node source: src/script/script.h](https://github.com/dilithion/dilithion/blob/main/src/script/script.h): Dilithion on GitHub (primary, checked 23 October 2026) 3. [Dilithion vendored CRYSTALS reference code](https://github.com/dilithion/dilithion/tree/main/depends/dilithium/ref): Dilithion on GitHub (primary, checked 23 October 2026) 4. [Dilithion node source: src/core/chainparams.cpp](https://github.com/dilithion/dilithion/blob/main/src/core/chainparams.cpp): Dilithion on GitHub (primary, checked 23 October 2026) 5. [Dilithion node source: src/consensus/params.h](https://github.com/dilithion/dilithion/blob/main/src/consensus/params.h): Dilithion on GitHub (primary, checked 23 October 2026) 6. [Dilithion README](https://github.com/dilithion/dilithion/blob/main/README.md): Dilithion on GitHub (primary, checked 23 October 2026) 7. [Dilithion release v4.5.1](https://github.com/dilithion/dilithion/releases/tag/v4.5.1): Dilithion on GitHub (primary, checked 23 October 2026) 8. [Dilithion explorer API: network statistics](https://explorer.dilithion.org/api/stats.php?chain=dil): Dilithion (primary, checked 23 October 2026) 9. [Dilithion explorer API: spend in block 110,588](https://explorer.dilithion.org/api/tx.php?txid=cb86f68488750f17e306112bef3b81ec8b242cd7b97142dd790d4a43e6fef021&chain=dil): Dilithion (primary, checked 23 October 2026) 10. [Dilithion mainnet](https://dilithion.org/mainnet.html): Dilithion (primary, checked 23 October 2026) 11. [FIPS 204: Module-Lattice-Based Digital Signature Standard (ML-DSA)](https://csrc.nist.gov/pubs/fips/204/final): NIST (primary, checked 23 October 2026) 12. [Dilithion release v2.0.0](https://github.com/dilithion/dilithion/releases/tag/v2.0.0): Dilithion on GitHub (primary, checked 23 October 2026) 13. [Dilithion release v1.4.2](https://github.com/dilithion/dilithion/releases/tag/v1.4.2): Dilithion on GitHub (primary, checked 23 October 2026) 14. [Dilithion release v1.4.0](https://github.com/dilithion/dilithion/releases/tag/v1.4.0): Dilithion on GitHub (primary, checked 23 October 2026) ## How to cite this rating A rating is only true as of the day it was reviewed, so both forms carry the review date and the methodology version. If you are quoting the score, quote those too. The Hardy Index (2026). Dilithion: quantum readiness assessment. Hardy Score 93.5 of 100, Tier 1: Native. Methodology v1.8. Last reviewed 23 October 2026; sources checked 13 November 2026. https://hardyindex.com/chains/dilithion ```bibtex @misc{hardyindex_dilithion_2026, author = {{The Hardy Index}}, title = {Dilithion: quantum readiness assessment}, year = {2026}, howpublished = {\url{https://hardyindex.com/chains/dilithion}}, note = {Hardy Score 93.5 of 100, Tier 1: Native. Methodology v1.8}, urldate = {2026-11-13} } ``` --- Methodology: https://hardyindex.com/methodology (v1.8). Cite as: The Hardy Index, "Dilithion", https://hardyindex.com/chains/dilithion, as of 13 November 2026.