See what
breaks when
the curve does.
Paste any Solana token or program. CURVEBREAK traces every power over it, from mint and freeze to seize and upgrade, down to the private keys that hold it, and counts how many an attacker would need.
The state of Solana's keys, right now.
Numbers from the latest audits of the largest tokens and programs on Solana, refreshed through the day.
Every power. Every key behind it.
Paste a mint or a program. Each authority it carries is followed through multisigs, Squads vaults and program-held addresses until it reaches the Ed25519 keys that actually sign.
- Mint, freeze, permanent delegate, hooks, pause, fees, metadata and upgrades
- Keys to break for each power, and an A–F grade for the asset
- The platform layer graded on its own: Token-2022, pump.fun, PumpSwap
loading…
One key. Everything it can break.
Turn it around: what can one address do? Programs it upgrades and stake it moves come from exact indexes; mints and metadata from its history, re-checked live.
- Connect the wallet that holds a power to revoke it, or hand it to a multisig
- Every change is checked on chain and simulated before your wallet sees it
- Typed confirmation before anything irreversible
Where the most value rests on the fewest keys.
Solana's largest tokens and programs, audited and ranked, and the keys behind them ranked by how much value they hold power over.
- USDC, USDT, PYUSD, JitoSOL, JLP, pump.fun, Jupiter, Raydium, Kamino and more
- Keys grouped by who really signs: one Squads multisig can hold a dozen programs
- Background refresh keeps every row within hours of the chain
One number: how many keys stand between an attacker and the power.
On Solana the address is the public key, so every key that holds power is already on display. What protects a power is how many of those keys someone needs.
One wallet
A single Ed25519 key. One leaked seed phrase today, or one run of Shor's algorithm later.
A multisig
SPL, Squads or Coral: an attacker must break the threshold, but every signer is still on display.
A program
Program-held addresses have no key. The power moves to whoever can upgrade the program.
Nobody
Revoked authorities and immutable code. No key exists to steal, now or after the curve breaks.
Launch a coin with a dev key that outlives the curve.
pump.fun launches signed by your wallet, plus a post-quantum binding written into the launch transaction itself: dated proof of who the dev is, even after Ed25519 falls.
- 01Your walletEd25519 · signs the text
- 02New PQ keyML-DSA-65 · made in your browser
- 03Bindingwallet + mint + PQ key, both signatures
- 04Memo in create_v2curvebreak:bind:v1:<sha-256>
- 05Dated by its slotcan't be backdated later
Breaking Ed25519 needs a machine far beyond today's. The same keys face leaks, phishing and bad storage right now, which is why the map matters already.
Audits read accounts and recent transactions. Off-chain custody and old powers a key never used again can be missed, and we say where.
A binding is dated proof of which post-quantum key belongs to a dev. It doesn't make Solana, a wallet or a coin quantum-resistant.