A POST-QUANTUM LIGHTNING DESIGN TRUSTS THE FIRST KEY IT SEES — A NODE THAT FIRST MEETS A PEER AFTER A QUANTUM COMPUTER EXISTS CAN PIN AN ATTACKER’S KEY — ONE ORDINARY NODE IN THE MIDDLE AND THE PAYMENT FALLS BACK TO CLASSICAL

Four researchers led by Ahmet Kurt of East Texas A&M posted PQLN to arXiv on September 12, 2026, and they say it’s the first post-quantum design for Lightning that’s actually built and tested. It’s a fork of rust-lightning, the code is public, and it adds the lattice-based standards ML-DSA and ML-KEM next to Lightning’s existing keys in gossip, the peer connection, invoices, offers and payment onions. Someone can record Lightning’s encrypted traffic today and read it once a quantum computer exists, and the authors argue Lightning can fix that part without waiting for a Bitcoin fork.

What the September coverage skipped is how a node learns those new keys. It hears them through gossip and trusts the first one it sees for each peer. The authors flag it themselves: “a node that first meets a peer after a cryptographically relevant quantum computer exists can pin an adversary’s key.” So the protection holds for keys pinned before that day, and a node that shows up after it is taking gossip’s word. Their proposed fix is to have a channel’s funding key commit to its owner’s post-quantum keys, the way Taproot commits to a script tree, so a late joiner can check them against a transaction confirmed on-chain. That’s left to future work.

Rollout is the other wall. Today’s rust-lightning won’t relay gossip carrying more than 1,024 bytes it doesn’t recognize, so an ordinary node stores the new announcements and stops there. In the authors’ tests, one ordinary node in the middle of a route meant no pin formed across it and the payment ran classical, unless the sender set a flag to refuse that route. The bytes add up too. Each channel costs 8,111 bytes of gossip to download under PQLN against 799 now, so on the paper’s count of 33,000 public channels a new node pulls about 268 MB instead of about 26 MB. With Falcon, the smaller signature scheme, the paper puts it around 115 MB. The added crypto work is the cheap part, at most 0.33 milliseconds.

None of this protects the coins. “The keys and signatures behind channel funds live inside Bitcoin transactions, so they cannot change without a fork,” the paper says, and it calls Bitcoin’s own post-quantum proposals early stage. PQLN covers the messages: who you are, who you’re paying, what the invoice says. It’s only been tested against rust-lightning nodes, and its new message types still need numbers through the BOLT process, so it isn’t part of Lightning’s spec. The code is on GitHub, so the claims can be checked. At the time of this writing, bitcoin was $82,851.