Quantum computing is not coming in five years. It is already here, quietly repricing the assumptions underneath every SNARK ever deployed. On September 10, 2024, a16z Crypto open-sourced Lattice Jolt, a general-purpose zkVM built on lattice-based polynomial commitments rather than the elliptic curves that have underwritten virtually every zero-knowledge system since 2018. The release arrived less than a month after NIST formally published its first three post-quantum standards — FIPS 203, 204, and 205. That timing is not coincidence. It is positioning.
Most of the market did not notice. There was no token, no airdrop, no listing. There was only a GitHub repository, a research paper, and a cryptographic primitive called Akita. Code does not lie, but incentives often do — and the incentive here was to claim a standard before anyone else could.
I have watched this movie before. In 2017 I audited forty-plus ERC-20 whitepapers in São Paulo and learned that the loudest projects rarely built the deepest foundations. In 2020 I ran the numbers on Curve and SushiSwap yield programs and concluded that most "organic" yields were just liquidity subsidies dressed in code. Lattice Jolt is the opposite kind of signal. It is quiet, technical, and boring to the people who trade on headlines. That is exactly why it matters.
Context: Why the Ground Under SNARKs Is Shifting
Every major zero-knowledge proving system in production today rests on one of two cryptographic assumptions. The first is the discrete logarithm problem over pairing-friendly elliptic curves — the foundation of Groth16, PLONK, and most recursive SNARK stacks. The second is symmetric assumptions over hash functions — the foundation of STARKs, which are considered post-quantum friendly but carry a different cost profile.
The problem is straightforward. Elliptic-curve discrete logarithms fall to Shor's algorithm on a sufficiently large quantum computer. Hash-based systems survive, but they generate larger proofs and typically require more verification cycles on-chain. For a decade, the industry simply kicked this can down the road. Quantum machines were theoretical, and elliptic curves were fast.
Then NIST finalized FIPS 203, 204, and 205 in August 2024, standardizing ML-KEM, ML-DSA, and SLH-DSA — all lattice-based or hash-based primitives. Overnight, "post-quantum" stopped being a research curiosity and became a procurement checkbox. The NSA, financial regulators, and enterprise security teams began drafting migration timelines.
Crypto did not move first. This is the part the industry keeps getting wrong. Blockchain is not leading the post-quantum transition — it is lagging it. Every bridge, every rollup, every verifier contract deployed today is part of a cryptographic legacy that will eventually need to be replaced.
Lattice Jolt enters precisely at this inflection. Its core innovation is Akita, a polynomial commitment scheme built on the Module-SIS hard assumption — a structured lattice problem that the broader cryptographic community considers post-quantum secure at a target level of 128 bits. Akita was co-developed with the LayerZero Research team alongside academic collaborators from Carnegie Mellon and the University of Southern California. That combination — a top-tier venture research lab, a cross-chain interoperability protocol, and two elite cryptography departments — is not an accident. It is a supply chain being assembled.
The reported performance numbers are aggressive. On CPU, the system claims over two million RISC-V cycles per second. On GPU, using Apple Metal, it claims over ten million cycles per second. Proof sizes stay under one hundred kilobytes. Memory consumption is reportedly two hundred bytes per cycle. The team frames this as a two-to-three-times speedup over the prior elliptic-curve version of Jolt.
Read that framing carefully. The improvement is measured against its own predecessor, not against RISC Zero, SP1, or any competing zkVM. A benchmark is only as honest as its reference point. When a team compares itself to itself, the number is real but the conclusion is not yet drawn.
Core: What Akita Actually Changes
To understand why this matters, you have to understand what a polynomial commitment scheme does. A zkVM does not prove a computation directly. It reduces the computation to a set of polynomial identities, then commits to those polynomials in a way that can be checked cheaply. The commitment scheme is the load-bearing wall. Change it, and you change the security assumptions of the entire structure.
Elliptic-curve commitments are fast and compact, but structurally quantum-vulnerable. Hash-based commitments are quantum-resistant but bulky. Lattice-based commitments sit in a third category — potentially quantum-resistant, structurally efficient, but relatively unproven in production.
Akita commits to polynomials using the Module-SIS assumption. Structured lattices are more efficient than generic lattices, which is why NIST selected lattice-based schemes for its primary post-quantum standards. By routing this assumption into a zkVM commitment scheme, a16z has done something genuinely novel. Most post-quantum work in crypto has focused on signatures, key encapsulation, and wallet-level migration. Applying structured lattices at the commitment layer of a general-purpose virtual machine is a different order of ambition.
The engineering claims deserve scrutiny but also respect. Sub-100KB proofs at two million CPU cycles per second, and ten million on GPU, would place Lattice Jolt within striking distance of production-grade proving for many workloads. The mobile angle is more interesting still. The original material notes the ability to prove millions of cycles on a mobile device. If that holds under independent reproduction, it collapses the hardware barrier that has historically kept proof generation confined to data centers.
But here is the part the announcement buried. The current open-source version of Lattice Jolt does not yet fully implement the zero-knowledge property. The team states that "more zero-knowledge features will be integrated in a subsequent paper." That single sentence reframes the entire release.
A succinct argument proves that a computation was executed correctly. Zero-knowledge additionally hides the inputs. These are not the same thing, and conflating them is the most common error I see in technical due diligence. What a16z shipped is, at minimum, a verifiable computation system. Whether it is a privacy-preserving proving system is a question deferred to a future document.
This matters because it changes the addressable market. Verifiable computation serves bridges, oracles, and rollup state proofs — infrastructure that cares about correctness, not secrecy. Zero-knowledge serves privacy applications: confidential transactions, private voting, dark-pool settlement. Lattice Jolt today plausibly serves the first category. The second category remains roadmapped.
There is a second implication that is more subtle and more important for anyone modeling the economics of this sector. Adding zero-knowledge to a lattice-based system will almost certainly introduce performance overhead. Proving systems trade off soundness, succinctness, and confidentiality against one another; you rarely get all three for free. The current two-to-three-times speedup is not the final performance of the system — it is the performance of the easier half of the system.
If I were allocating capital against this narrative, I would model a meaningful performance regression when full zero-knowledge integration lands. That regression is not a failure. It is the cost of the actual product.
The upstream dependencies are worth noting too. Lattice Jolt relies on RISC-V, which is open, stable, and battle-tested — a genuine strength. It relies on the Module-SIS assumption holding against future cryptanalysis, which is a research-grade bet, not a settled fact. And it relies on the continued participation of a consortium of academic and industrial researchers whose incentive alignment is opaque. None of these are red flags. All of them are unknowns that a serious analyst should price.
Contrarian: The Post-Quantum Narrative Is Over-Hyped and Under-Estimating Risk Simultaneously
Everywhere I look, I see the same two errors being made about post-quantum crypto, and they are opposites.
The first error is dismissing it. Traders see "quantum-resistant" and file it under marketing. The wallets and signatures in use today will function for years, they reason, so why bother? This view ignores that cryptographic migration is measured in decades, not quarters. The organizations that begin now will hold the standard-setting power that the organizations that begin in 2032 will have to adopt. If you have ever watched a blockchain migrate a cryptographic primitive under live load, you know how brutal the coordination problem is. Stability is a feature, not a market condition — and cryptographic stability is the least stable feature of all.
The second error is over-crediting it. The same traders, when they do engage, treat a lattice-based release as a finished product. They assume "quantum-resistant zkVM" means the problem is solved. It does not. Lattice Jolt is a research-grade prototype with no independent third-party audit disclosed, no reproducible open benchmark suite published, and no production history. The Module-SIS assumption is well-studied, but parameter choices under specific implementations are exactly where lattice deployments have historically failed. Side-channel attacks against lattice schemes are a live research area, and a zkVM running on consumer hardware introduces a very large side-channel surface.
Here is my genuine contrarian position, and it cuts against the a16z-friendly reading of this release. The Data Availability layer is overhyped, and the Commitment layer is underhyped. Everyone has spent two years arguing about where rollup data lives. Almost no one has asked what cryptographic assumption secures the proofs that make rollups trust-minimized in the first place. Lattice Jolt is one of the few projects pointed at the right layer of the stack. It deserves attention precisely because it is not solving a fashionable problem.
But the strategic read is darker than the technical one. a16z Crypto is the largest venture investor in this sector. Open-sourcing a post-quantum zkVM is simultaneously a public good and a competitive moat. If the firm's portfolio companies adopt this stack, they get an early lead on quantum-safe infrastructure. If outside teams adopt it, they build on foundation the firm controls. Either way, a16z gains standing in the standard-setting conversation.
This is not a criticism. It is a description of how standards get captured. The team that publishes the reference implementation often becomes the team that writes the specification. The reference implementation is being written now. The specification does not exist yet.
And there is an interoperability angle that most readers will miss. Akita was co-developed with LayerZero Research. Cross-chain bridges are, at their core, proof verification systems. A bridge verifies that some state existed on a source chain before releasing assets on a destination chain. If that verification is lattice-based and post-quantum secure, and if it can be verified cheaply on both ends, then LayerZero would possess a structural upgrade that most competing bridges cannot easily match. LayerZero has, in the industry's public record, had its own regulatory friction with the SEC. That friction does not touch the open-source project itself, but it shapes the commercial incentives around it. Follow the code, not the marketing — and the code points toward cross-chain verification as a first adopter.
Takeaway: Positioning Before the Consensus Forms
We are in a sideways market where narratives rotate faster than capital, and where most participants are waiting for a directional signal that will not arrive from price. The signal is arriving from cryptography, and almost nobody is reading it.
Liquidity is the only truth in a vacuum of trust. The next wave of institutional capital entering this sector will not ask whether a chain is fast. It will ask whether the chain is safe against the threats it will face in 2035. That question is currently unanswerable for almost every major protocol in production. Lattice Jolt is one early, imperfect, incomplete attempt to make it answerable — and imperfection at the right layer of the stack is worth more than perfection at the wrong one.
The measurable job for the next twelve to thirty-six months is not to price a token that does not exist. It is to track three things: whether independent audits of Akita materialize, whether the full zero-knowledge integration preserves or destroys the current performance claims, and whether cross-chain verification becomes the first real deployment surface. If all three resolve positively, the teams holding lattice-based proving capability will hold an asset that cannot be bought at current prices.
I spent 2022 designing hedges against liquidity collapse. I spent 2024 mapping ETF inflows into spot volatility. The pattern I have learned is consistent: the market rewards the participants who position during the boring phase, not the participants who react during the loud one. Lattice Jolt is boring. It is a repository, a research paper, and a five-hundred-word announcement. It is also a claim staked on the cryptographic layer of the entire industry, years before the industry will need it.
Yield without basis is just delayed liquidation. Infrastructure without security assumptions is just delayed crisis. The teams building the latter are not on any leaderboard yet. They are the ones worth watching.
Frequently Overlooked: Three Things the Announcement Did Not Say
One. No independent security audit was disclosed. For a new cryptographic primitive entering a production-intended system, this is the single largest gap between narrative and readiness. Module-SIS is studied. A specific parameter set implemented in a specific codebase running on specific hardware is not studied until someone attacks it.
Two. No reproducible benchmark harness was published. The performance figures — two million CPU cycles per second, ten million GPU cycles per second, under one hundred kilobytes per proof — are single-source claims. They may hold, but until an external party reproduces them under stated conditions, they are advertising, not measurement. The distinction between a claim and a result is the entire discipline of this profession.
Three. No licensing terms or governance model were detailed in the source material. An open-source project without a clear license and contribution model is a project whose long-term direction is controlled by its originators regardless of what the word public implies. Whether that matters depends on whether you plan to depend on it.
Put all three together and the honest classification of Lattice Jolt today is this: the strongest single research directional signal in the zkVM sector for 2024, wrapped in the weakest possible packaging for anyone who needs to deploy capital behind a standard. The gap between those two facts is the opportunity and the risk, at the same time, which is exactly where asymmetric bets live.
The question is not whether post-quantum cryptography will reach on-chain infrastructure. It will, because it must, and because regulators are already writing the timeline. The question is which stack gets adopted when it does — and whether the teams that adopt it early build on a foundation nobody audited, or wait for one that somebody did. Positioning is not the same as conviction. It never is.
