Pinned Tweet
$ZILENT is live on Ethereum. 🕵️
Your wallet talks. More than you think.
Zilent is a quantum risk scanner for any wallet or contract. Paste an address and see which keys are exposed on-chain, what's at risk, and how to move before Q-Day.
CA: 0x5c79c154b8d70fd3a0d16706f0edbfaab9be1923
🌐 zilent.xyz
Silence is not hiding. It's choosing what leaves.
This is the part most chains miss: quantum doesn't only threaten keys. It threatens privacy retroactively.
Anything that leaks today can be unlinked later. On EVM, it starts with every address that has already revealed its key.
The piece of AA that matters most for quantum: separating who pays gas from who authorizes.
In Zilent's PQ account, a normal wallet pays gas but has no right to move assets. Only the ML-DSA-65 key can authorize.
Now, account abstraction.
We have been talking about account abstraction ever since early 2016, see the original EIP-86: github.com/ethereum/EIPs/iss…
Now, we finally have EIP-8141 ( eips.ethereum.org/EIPS/eip-8… ), an omnibus that wraps up and solves every remaining problem that AA was intended to address (plus more). Let's talk again about what it does.
The concept, "Frame Transactions", is about as simple as you can get while still being highly general purpose. A transaction is N calls, which can read each other's calldata, and which have the ability to authorize a sender and authorize a gas payer. At the protocol layer, *that's it*.
Now, let's see how to use it.
First, a "normal transaction from a normal account" (eg. a multisig, or an account with changeable keys, or with a quantum-resistant signature scheme). This would have two frames:
* Validation (check the signature, and return using the ACCEPT opcode with flags set to signal approval of sender and of gas payment)
* Execution
You could have multiple execution frames, atomic operations (eg. approve then spend) become trivial now.
If the account does not exist yet, then you prepend another frame, "Deployment", which calls a proxy to create the contract (EIP-7997 ethereum-magicians.org/t/eip… is good for this, as it would also let the contract address reliably be consistent across chains).
Now, suppose you want to pay gas in RAI. You use a paymaster contract, which is a special-purpose onchain DEX that provides the ETH in real time. The tx frames are:
* Deployment [if needed]
* Validation (ACCEPT approves sender only, not gas payment)
* Paymaster validation (paymaster checks that the immediate next op sends enough RAI to the paymaster and that the final op exists)
* Send RAI to the paymaster
* Execution [can be multiple]
* Paymaster refunds unused RAI, and converts to ETH
Basically the same thing that is done in existing sponsored transactions mechanisms, but with no intermediaries required (!!!!). Intermediary minimization is a core principle of non-ugly cypherpunk ethereum: maximize what you can do even if all the world's infrastructure except the ethereum chain itself goes down.
Now, privacy protocols. Two strategies here. First, we can have a paymaster contract, which checks for a valid ZK-SNARK and pays for gas if it sees one. Second, we could add 2D nonces (see docs.erc4337.io/core-standar… ), which allow an individual account to function as a privacy protocol, and receive txs in parallel from many users.
Basically, the mechanism is extremely flexible, and solves for all the use cases. But is it safe? At the onchain level, yes, obviously so: a tx is only valid to include if it contains a validation frame that returns ACCEPT with the flag to pay gas. The more challenging question is at the mempool level.
If a tx contains a first frame which calls into 10000 accounts and rejects if any of them have different values, this cannot be broadcasted safely. But all of the examples above can. There is a similar notion here to "standard transactions" in bitcoin, where the chain itself only enforces a very limited set of rules, but there are more rules at the mempool layer.
There are specific rulesets (eg. "validation frame must come before execution frames, and cannot call out to outside contracts") that are known to be safe, but are limited. For paymasters, there has been deep thought about a staking mechanism to limit DoS attacks in a very general-purpose way. Realistically, when 8141 is rolled out, the mempool rules will be very conservative, and there will be a second optional more aggressive mempool. The former will expand over time.
For privacy protocol users, this means that we can completely remove "public broadcasters" that are the source of massive UX pain in railgun/PP/TC, and replace them with a general-purpose public mempool.
For quantum-resistant signatures, we also have to solve one more problem: efficiency. Here's are posts about the ideas we have for that: firefly.social/post/lens/1gf… firefly.social/post/x/202740…
AA is also highly complementary with FOCIL: FOCIL ensures rapid inclusion guarantees for transactions, and AA ensures that all of the more complex operations people want to make actually can be made directly as first-class transactions.
Another interesting topic is EOA compatibility in 8141. This is being discussed, in principle it is possible, so all accounts incl existing ones can be put into the same framework and gain the ability to do batch operations, transaction sponsorship, etc, all as first-class transactions that fully benefit from FOCIL.
Finally, after over a decade of research and refinement of these techniques, this all looks possible to make happen within a year (Hegota fork).
firefly.social/post/bsky/qma…
Native AA in Hegotá is the long-term home for post-quantum signatures on Ethereum.
Until then, smart-contract accounts are the bridge. That's how Zilent's PQ wallet works today: the contract checks an ML-DSA-65 signature before anything moves.
AA update: The Frame Transactions EIP was moved today to Scheduled status for the Hegotá upgrade. It was proposed as a headliner and moved in March of this year to Considered status. There was strong consensus that it was important to ship Account Abstraction in Hegotá even if the specific implementation was still up for debate.
There's been a lot of progress in the past few weeks as another implementation, EIP-8130, became a contender. This EIP is scheduled to be shipped on @base in September. It spurred productive conversation async and in a breakout this past Tuesday about the best way to not fracture standards across the ecosystem by shipping two incompatible Account Abstraction implementations between the L1 and L2s.
The crux of the issue is arriving at a shared transaction type that both preserves flexibility and future-proofness for the L1 and allows L2s to statically analyze transactions for performance and DoS-resistance reasons. At a minimum, we should make sure that the AA scheme we adopt for the L1 is flexible enough that 8130, or any future account system, can be built on top of it so that from the user's perspective the same account can work across L1 and L2s.
Authors of both EIPs, core devs, researchers, and testing teams have been working toward a solution that respects the imperative to get Account Abstraction in the next fork without delay but avoids fracturing ecosystem standards.
That said - Account Abstraction _will_ ship in Hegotá, so core devs decided today to move EIP-8141 from Considered to Scheduled today. This was made with the caveat that the version of Account Abstraction that ships in Hegotá may significantly change from what's on the Hegotá Meta EIP right now: potentially the EIP number, the transaction type, etc.
The move to Scheduled doesn't materially change the conversation that's been happening over the past few weeks or enshrine the current spec. When an EIP is proposed as a headliner and moved to Scheduled, it just signals an intention to make the fork schedule dependent on that feature being shipped. It's more common than not for the implementation to change significantly between being Scheduled and shipping.
Big appreciation to @_chunter of @base, @Offchain, @EthLabs_org, and client teams for moving the conversation forward. Progress is ongoing and can be followed at the AA breakouts on Tuesdays at 14:00 UTC or asynchronously on Forkcast.
Chain-level recovery is the backstop. Account-level recovery is what users can set up today.
Zilent's PQ accounts keep owner and recovery keys separate, with a 48-hour window before a key change completes.
Same NIST standard, EVM side: Zilent accounts verify ML-DSA-65 signatures on Ethereum mainnet, no hard fork.
Keys are generated in your browser. Next frontier is exactly this: keys in secure hardware.
He's right, and it applies to us too.
Post-quantum crypto doesn't help if the contract around it has a bug. New PQ code is new attack surface.
That's why Zilent PQ wallet is labeled experimental: small amounts, while the code gets the scrutiny it needs.
Drake's advice: move assets to fresh addresses whose keys are still hidden behind a hash.
Step one is knowing which of your addresses already revealed their key. On Ethereum, any address that has sent a tx has.
🚨 JUST IN: Ethereum researcher Justin Drake calls on the crypto industry to enter "bunker mode" as AI superintelligence could threaten standard ECDSA encryption faster than expected.
"My personal recommendation is to set in motion a controlled mass migration of assets to fresh addresses, i.e. addresses whose pubkeys remain hidden behind a hash."
Zilent Update: the post-quantum wallet is now on Ethereum mainnet (experimental) 🕵️
SCANNER: REAL MAINNET DATA
Reads Ethereum mainnet through public RPC:
- ETH balance + selected token balances
- Sender activity (account nonce)
- Contract code + proxy indicators
- Token approvals for the token–spender pairs you enter
It checks the scope you choose. It doesn't auto-search every token, approval or transaction.
PQ WALLET: LIVE ON MAINNET
- Keys + encrypted backups, generated in your browser
- Deploy your own PQ account
- Activate, send ETH, send ERC-20
- Key recovery with a 48-hour delay
Every user deploys their own account. Never send funds to an address shown on a page unless it matches your local key.
$Zilent
HOW IT WORKS
Your ML-DSA-65 key signs each operation. Your account contract verifies it before anything runs.
Your normal wallet only pays gas. Paying gas gives it no right to move your assets.
Owner and recovery keys are separate. Each signature is bound to the account, chain, nonce, operation, parameters and deadline, so it can't be reused for something else.
FIXED
Some tokens return false on a failed transfer instead of reverting. Zilent now treats that as a failure and reverts the whole operation, nonce included.
CHECKED
82 automated tests passed. Browser flows tested on mobile, tablet and desktop. No 404s, no console errors in the tested flows.
Use it to learn and experiment, with small amounts you can afford to lose.
Harvest now. Decrypt later.
Quantum computers that can break ECDSA don't exist yet. That doesn't make your exposed keys safe.
Everything on-chain is permanent. Every public key revealed today can be collected now and attacked the day the hardware arrives.
The time to move is before that day, not after.
Zilent Update
Post-Quantum Wallet Foundation
We’ve added real ML-DSA-65 cryptography to Zilent’s new PQ wallet preparation tools.
What’s now available:
• Local owner and recovery key generation
• Separate encrypted backups with different passwords
• Vault save, unlock, lock, clear, and restore
• Local cryptographic signature self-checks
• Read-only Ethereum mainnet connectivity checks
Verification: 63 automated tests passed. Browser testing confirmed backup creation, restoration, signature verification, and Ethereum mainnet connectivity.
In local EVM testing, genuine JavaScript-generated ML-DSA-65 signatures were accepted by the Solidity verifier. Tampered signatures, wrong keys, and replayed authorizations were rejected. $ZILENT
Zilent Update Post-Quantum Wallet Foundation
We’ve added real ML-DSA-65 cryptography to Zilent’s new PQ wallet preparation tools.
What’s now available:
• Local owner and recovery key generation
• Separate encrypted backups with different passwords
• Vault save, unlock, lock, clear, and restore
• Local cryptographic signature self-checks
• Read-only Ethereum mainnet connectivity checks
**Verification:** 63 automated tests passed. Browser testing confirmed backup creation, restoration, signature verification, and Ethereum mainnet connectivity.
In local EVM testing, genuine JavaScript-generated ML-DSA-65 signatures were accepted by the Solidity verifier. Tampered signatures, wrong keys, and replayed authorizations were rejected.
Explore: zilent.xyz
#Zilent #Ethereum #PostQuantum
One scanner. Five chains.
Ethereum · Base · Arbitrum · Optimism · Polygon
Your address is the same on every EVM chain, and so is your key. Sign once on any of them and that public key is exposed on all of them.
Zilent lets you check each chain from one place.
$ZILENT
Your security history belongs to you.
Every scan, plan and step in Zilent goes into an audit log on your own device. Each entry links to the one before it, so you can verify nothing was changed. Export it anytime.
Quantum safety moved up the roadmap. Privacy became first-class.
They belong together. An exposed key is a security problem. An exposed lookup is a privacy problem.
Zilent checks your keys and hides your lookup among 7 decoys: zilent.xyz
Moving funds before Q-Day? Order matters.
Zilent's migration plan:
1. Revoke risky approvals first, so nothing can be drained mid-move
2. Move tokens to a fresh address
3. Move ETH last, in parts, keeping a gas reserve for the final sweep
Every step tells you which signer it needs before you start. $ZILENT
How Zilent Scan works:
Try “Active trading wallet” in Example data to explore 6 checks and 9 demo findings. Each result explains the issue and next step.
Live RPC is read-only. Unavailable checks say “Not checked.” No signing or transfers.
$ZILENT
🔥 $ZILENT supply burn
30,465,689 $ZILENT sent to the dead address.
That's ~3.05% of the 1,000,000,000 max supply, out of circulation for good.
Verify it on-chain, don't trust it:
etherscan.io/tx/0xc5b43b32d8…
Silence is not hiding. It's choosing what leaves.
Who can upgrade your contract?
Upgradeable proxies keep their admin address in a fixed storage slot (EIP-1967). Zilent reads it straight from the chain and shows you who holds that power.
If the admin is a plain wallet that has already signed transactions, your whole protocol sits behind one exposed key. Scan the admin address too.
Paste any contract → zilent.xyz
Native post-quantum accounts, live.
Chains are moving faster than most users realize. EVM wallets still sign with ECDSA.
Zilent shows which EVM addresses are exposed and the order to move them: zilent.xyz
Algorand has been shipping nonstop lately 🔥
• We have a new CEO, William Herkelrath
• He joins our Board of Directors alongside @alexanderfowler, CSO at @NexusLabs
• The major Algorand v5.0 upgrade was approved by node runners
• Native post-quantum accounts are live on mainnet
• You can create one now with @PeraAlgoWallet or @LuteWallet
• 1.3M+ PQ transactions signed in just a few weeks
• Fees now scale with resource usage
• Builders get bigger contracts + new AVM capabilities
• We launched AC2, an open protocol for safer AI agent approvals and credential isolation
• We partnered with @FlowTraders to deepen institutional liquidity for ALGO
• @PeraAlgoWallet v7 is live, their biggest update ever
• Algorand ranked #2 in agentic transaction volume in August, with $244K moved by AI agents
• 2.8K+ x402 endpoints are now live on Algorand
• @zerosignal_ai is live on mainnet
Why does this matter?
A wallet balance doesn't tell the whole story. Token permissions, address links and account security also matter.
Zilent's demo shows how to read these findings.
How Zilent Scan works:
Try “Active trading wallet” in Example data to explore 6 checks and 9 demo findings. Each result explains the issue and next step.
Live RPC is read-only. Unavailable checks say “Not checked.” No signing or transfers.
$ZILENT



















