Hey Q fam!
Here is a summary of the latest live stream with
@cass_on_mars (
@QuilibriumInc founder).
✨ Quilibrium: What's new, 2.1.0.23, and more!
Cassandra Heart covers node rewrites, service updates, and a sharp critique of recent industry security failures.
▶️ Watch it on YouTube (English captions):
youtube.com/watch?v=KVVNQtHd…
▶️ Watch it on X:
x.com/QuilibriumInc/status/2…
✅ Key topics:
⦿ Node rewrite from Go to Rust (2.1.0.23)
⦿ Quorum Mobile App Store release and major UI overhaul
⦿ MegaRPC, QKMS SDK, QStorage, Klearu, and MetaVM updates
⦿ Industry security incidents: Vercel breach,
eth.limo DNS hijack, Layer Zero exploit
✅ Business Update: Zapme Social Goes Decentralized
Zapme Social has fully migrated its storage onto Q Inc. and is planning to move additional infrastructure components onto Q as new features of QConsole and Q web services are released.
✅ Node Release 2.1.0.22: What Was Fixed
The 2.1.0.22 release shipped earlier this month and included several bug fixes: improvements to the TUI, an activity eviction bug fix, a seniority merge bug fix, and heavy bandwidth fixes.
✅ The Big Change: Node Rewrite in Rust (2.1.0.23)
The 2.1.0.23 update represents the most significant architectural shift in Quilibrium's history: the node is being rewritten from Go to Rust.
The root cause was Go's garbage collector. Deep profiling via PPROF revealed that the GC's "stop the world" behavior was causing the BlossomSub pub/sub layer to drop messages, RPC resource access to halt, and the submission layer to stall — all due to the same underlying issue with message processing loops hanging at irregular intervals.
This is not the first time Go's GC caused problems. Every performance-sensitive component of the crypto stack, including BLS48581 and the Wesolowski VDF, had already been moved to Rust for the same reasons. The protocol's multi-instance worker model (master capped workers) was itself a workaround for Go's inability to pin cores to single threads and its unpredictable GC behavior.
The move to Rust also enables a simpler architecture: in non-clustered mode, a single process can now manage all worker threads rather than requiring separate isolated worker instances.
Important clarifications:
⦿ QClient remains in Go and is not being migrated
⦿ All corresponding Go libraries remain compatible and unaffected
⦿ RocksDB migration from Pebble is straightforward
⦿ Most of the Rust groundwork was already done since ~version 0.18, when services like QNS and Quorum Mobile features were already being written in Rust
The 2.1.0.23 branch will be published as soon as all major deployment scenarios have been validated internally to minimize surprises during community testing.
✅ Quorum Mobile: App Store Release Incoming
Quorum Mobile has completed a major overhaul and is currently going through the App Store approval process. A TestFlight / Google Play beta update is also being released alongside the App Store version.
Key improvements:
⦿ Full UI redesign, including a space explorer for discovering public user spaces
⦿ All encryption, decryption, and network communication moved from JavaScript to native code, eliminating the React Native bridge overhead
⦿ Deep performance pass: memoization fixes, background thread optimization
⦿ Voice and video calls routed through Quilibrium's onion routing layer, preventing IP address and location leakage
⦿ Support for public profiles
⦿ Free Farcaster account onboarding built into the app
⦿ Ability to receive and send offers for QNS names directly in the app
⦿ iOS 26 "Liquid Glass" visual treatment supported
Users upgrading from TestFlight to the App Store version will need to go through two upgrade steps due to how Apple separates TestFlight and App Store app data. Cassandra acknowledged this is unavoidable but is working to make the migration as seamless as possible.
✅ MegaRPC: Now Live
MegaRPC has officially launched. It is a privacy-preserving RPC service that uses ORAM-based queries so user data cannot be linked or shared. It is described as "the first RPC service that can't be evil."
Wallet teams are already in discussions to integrate MegaRPC as an alternative to public RPC providers that charge high fees and cooperate with government data requests. Teams that do not want to run their own MegaRPC node can access the service via QConsole API keys.
✅ QStorage Update: Sub-Account Ownership
QStorage now supports sub-account ownership, allowing developers to create cryptographically enforced, compartmentalized access controls. Write keys are tied to specific sub-accounts rather than the root account, meaning the root account owner cannot access user-uploaded content if the policy is set correctly. This is particularly useful for social applications where user data should only be accessible to the user themselves.
✅ QKMS Update: New SDK with Drop-In Compatibility
The QKMS SDK has been updated with sub-account ownership and a new developer-facing API that is intentionally designed to be drop-in compatible with wallet-as-a-service SDKs like Privy. Developers familiar with those tools will feel at home immediately.
The SDK supports multi-party computation (MPC) key generation on the fly, including 2-of-2 threshold signing and configurable T-of-N group wallets. Supported key types include:
⦿ BLS12381 (Ethereum validator keys, enabling programmatic group validator wallets)
⦿ BLS48581, DCAF448, and ED448 (Quilibrium-native keys)
The SDK is published at
github.com/quilibriumnetwork….
✅ Klearu Update: Multimodal and Classifier Expansion
Klearu, Quilibrium's MPC machine learning framework, now supports image classification via MPC. Use cases include verifying photo authenticity in crowdsourced apps (for example, filtering non-bird images in a bird-watching app) or pre-screening uploads in social media platforms for policy violations before content ever hits storage.
The LLM model has also been expanded to support multimodal input, allowing image submission to the model with text-based queries about the image content.
✅ MetaVM Update: EVM-to-Consensus Proofs Coming
MetaVM currently supports execution-layer zero-knowledge proofs. The upcoming update adds EVM-to-consensus proofs, enabling a full chain-of-custody proof for Ethereum transactions that covers:
⦿ Execution validity (Merkle-Patricia tree proof of the transaction and all SLOAD/SSTORE events)
⦿ Block production
⦿ Consensus layer binding
⦿ Epoch finality via Casper FFG (2/3 of total stake attested)
The practical outcome: when querying a transaction through MetaVM, developers will be able to verify the full economic security of Ethereum as part of the proof, leaving no reliance on RPC trust.
✅ Other Releases: Balance, Hypersnap, FFX
Balance, Quilibrium's Communicating Sequential Processes language that enforces CSP constraints at the language level, is now available on GitHub.
Hypersnap has shipped several updates including nightly builds, expanded API compatibility (webhooks and notifications), and a preview of Snap Compute and Emulator (FIP21). A token is planned; details are discussed in Hypersnap dev calls.
FFX, Quilibrium's equivalent to AWS Lambda (part of MetaVM), is launching public access this week with Node.js support.
✅ Industry Security Incidents
Vercel was compromised in a global account breach, with credentials and API keys now circulating on the dark web. Cassandra noted that full account isolation would have mitigated the damage, and positioned FFX as a more secure alternative for Node.js serverless workloads.
eth.limo's DNS account was compromised on EasyDNS via social engineering and redirected to attacker-controlled name servers; CoW Swap was also hit by a separate DNS hijack attack the same week. QNS is presented as a more proof-based and privacy-preserving alternative to traditional DNS.
The most substantial commentary was reserved for Layer Zero's incident report. A DAO exploit resulted in a compromised RPC node, attributed to Lazarus Group, that returned fraudulent transaction data. Two other Layer Zero-operated RPCs had been DDoSed offline, leaving a single compromised RPC that returned different responses depending on what was querying it.
Cassandra called out Layer Zero's statement that "RPC verification is a fundamental limitation of all off-chain services" as false and irresponsible, arguing that the real failure was not verifying execution proofs. Trusting an RPC without cryptographic proof of execution, inclusion, and finality is a design choice, not an inherent limitation. Full zero-knowledge proofs of the kind MetaVM provides make this class of attack obsolete.
The Q R-Bridge uses T-of-N MPC confirmation and is being upgraded to use MetaVM, making a single-node compromise insufficient to authorize any cross-chain action.
✅ Security Reminders
⦿ Do not trust links on Twitter/X claiming to be from Quilibrium, even if the URL appears correct. Short links can mask the real destination.
⦿ There is no wallet migration. Any Telegram group claiming otherwise is a scam. Report it immediately.
⦿ Always verify accounts before interacting.
$QUIL