Sui

Main Takeaways
tZERO is expanding its regulated digital securities infrastructure to support Sui, including issuance, custody, transfer agency, trading, and settlement.Sui’s object-centric architecture allows permissions and participant requirements to be programmed directly into digital assets.tZERO’s expansion gives institutions, issuers, and developers more infrastructure for building regulated tokenized markets on Sui.
tZERO Group, Inc., a leader in blockchain-based financial infrastructure, today announced that its regulated digital securities platform will now be fully integrated with Sui, bringing support for issuance, transfer agency, custody, trading, and settlement to the ecosystem. The expansion gives institutions and issuers more options for bringing regulated securities onchain through tZERO’s tokenization and compliance framework, while also introducing Sui-native developers, builders, and ecosystem partners to tZERO’s broker-dealer-led platform for support across projects that require compliant access to US infrastructure.
Moving securities onchain involves more than tokenizing an asset. Institutions still need to manage how those assets are issued, held, transferred, traded, and settled within established regulatory frameworks. Thanks to this collaboration, tZERO is bringing seven-plus years of regulated digital securities infrastructure to Sui, backed by SEC registrations and FINRA membership.
Mustafa Al Niama, Head of Capital Markets at Mysten Labs and former Americas Head of Digital Assets at Goldman Sachs, added: “Institutional adoption of tokenized assets depends on infrastructure that bridges blockchain innovation with regulatory frameworks. tZERO’s expansion to Sui gives issuers and developers access to regulated issuance, custody, and trading capabilities designed to support that transition, while also taking advantage of Sui’s unique architecture that is built to support institutional workflows.”
Building infrastructure for regulated digital securities
For regulated financial applications, programmability is only part of the picture. Sui’s object-centric architecture allows permissions and participant requirements to be built directly into an asset and enforced onchain. For digital securities, this can support controls such as transfer restrictions, whitelisting, and participation verification
The underlying blockchain also needs to support the day to day workflows of financial markets. Sui’s high-throughput, low-latency execution can support near real-time settlement, ownership updates, and corporate actions, while tZERO provides the regulated market infrastructure surrounding those assets.
“Sui’s object-centric architecture offers a unique approach to regulated digital assets by making assets and their permissions programmable,” said Alan Konevsky, Chief Executive Officer of tZERO. “Combined with Sui’s performance, that design creates a strong foundation for the development of next generation regulated financial applications onchain as we look to make our end-to-end infrastructure stack natively interoperable with best-of-breed technology standards."
For institutions, issuers, and developers, tZERO’s expansion creates another path for bringing regulated financial assets onchain. For developers, it adds regulated infrastructure that tokenization, secondary trading, and digital securities applications can build on or alongside.
For more information about tZERO, please visit: https://www.tzero.com.
‍
FAQs
What does tZERO’s expansion to Sui enable?
tZERO’s expansion brings its regulated digital securities infrastructure to Sui, including support for issuance, transfer agency, custody, trading and settlement. This gives issuers and institutions another blockchain option for building and managing tokenized securities within tZERO’s regulated market infrastructure.How does Sui support institutional financial applications?
Sui combines an object-centric architecture with high-throughput, low-latency execution. These characteristics can support financial workflows such as near real-time settlement, ownership updates, and corporate actions while providing developers with the programmability needed to build sophisticated financial applications.How can compliance requirements be built into an onchain asset?
On Sui, assets and permissions can be represented as programmable objects. For regulated assets, this architecture can support requirements such as transfer restrictions, whitelisting, and participant verification at the asset level, allowing rules governing an asset to be incorporated into how that asset operates onchain. What are tokenized securities?
Tokenized securities are financial securities represented on a blockchain. Bringing these assets onchain can enable more programmable financial workflows, including how ownership, transfers, settlement, and other asset functions are managed.
About tZERO Group, Inc.
tZERO Group, Inc. (tZERO) and its broker-dealer subsidiaries provide an innovative liquidity platform for private companies and assets. We offer institutional-grade solutions for issuers looking to digitize their capital table through blockchain technology, and make such equity available for trading on an alternative trading system. tZERO, through its broker-dealer subsidiaries, democratizes access to private assets by providing a simple, automated, and efficient trading venue to broker-dealers, institutions, and investors. All technology services are offered through tZERO Technologies, LLC. For more information, please visit our website.
‍
About tZERO Digital Asset Securities, LLC
tZERO Digital Asset Securities, LLC is a broker-dealer registered with the SEC and a member of FINRA and SIPC. It is the broker-dealer custodian of all digital asset securities offered on tZERO’s online brokerage platform. Digital asset securities may not be “securities” as defined under the Securities Investor Protection Act (SIPA)-and in particular, digital asset securities that are “investment contracts” under the Howey test but are not registered with the Securities and Exchange Commission are excluded from SIPA’s definition of “securities”-and thus the protections afforded to securities customers under SIPA may not apply. More information about tZERO Digital Asset Securities may be found on FINRA’s BrokerCheck.

Main Takeaways
Sui is adding two NIST-approved post-quantum signature schemes: ML-DSA-65 as a native protocol signature scheme for everyday accounts, and hash-based SLH-DSA-SHA2-128s inside Move smart contracts for high-value vaults.Because Sui keys derive deterministically from a seed, users will be able to move to a quantum-safe key using the recovery phrase they already hold. Address aliases, already live on Sui, let an existing account update its authorization key without transferring assets out.Quantum-safe vaults are targeted for Mainnet this year and native ML-DSA-65 accounts for Testnet by end of year, with native account authentication on Mainnet targeted for Q1 2027. Timelines remain open while independent audits and Testnet feedback continue.
A public key onchain is different from a public key anywhere else. In most systems, an attacker needs a breach before they can start working on a key. Onchain, the key is already published, exposed permanently the moment an account transacts.
That changes what the quantum timeline means for a blockchain. Shor's algorithm breaks the elliptic-curve cryptography behind most onchain accounts today, the same math securing banking systems and most of the internet. Harvest-now-forge-later collection doesn't require quantum hardware; it requires a visible key and patience. The exposure is already accruing. In March 2026, Google Quantum AI estimated that exactly this attack, recovering a private key from an exposed public key, would run in minutes on a fault-tolerant machine of under half a million physical qubits.
The deadlines are also moving. NIST had planned to deprecate classical algorithms by 2030 and disallow them by 2035. Executive Order 14412, signed June 2026, pulls that forward for federal agencies’ sensitive systems: post-quantum key establishment by the end of 2030, digital signatures by the end of 2031.
Sui was built for cryptographic agility, which means signature schemes can be added without disturbing the fundamentals of the network. That property is the difference between a migration and a rebuild, and it is why the work described here is a routine protocol-feature update rather than a change to consensus or existing state.
Two schemes, two threat models
Rather than betting on one algorithm, Sui is adopting two, matched to different kinds of risk.
ML-DSA-65 (FIPS 204) for native accounts. For everyday transactions, ML-DSA-65 becomes a native protocol signature scheme. Sui is integrating Level 3 rather than the cheaper Level 1, following a July 2026 incident where an AI model halved the effective key strength of HAWK, a post-quantum signature candidate, in about 60 hours, after two years of expert human review had cleared it. While the finding does not affect ML-DSA, the speed of it is reason to carry margin rather than take the cheapest parameters on offer. Level 3 is also where Chrome and Cloudflare landed for the post-quantum encryption now protecting over half of human-initiated web traffic. The rest of the internet stack is converging on the same choice too: AWS KMS now offers ML-DSA signing in its hardware-backed key service, and Android 17's Keystore generates quantum-safe signatures inside the device's secure hardware starting at ML-DSA-65, skipping the 44 parameter set entirely.
SLH-DSA-SHA2-128s (FIPS 205) for smart contract vaults. For high-value assets, hash-based signatures are handled inside Move contracts rather than the protocol core. Hash-based security is the better-understood of the two families, and keeping it in-contract means Sui can stay compatible with whichever post-quantum standards the wider industry settles on, without a core protocol upgrade. Given Sui's bridges to other networks, that adaptability matters.
The two rest on different mathematics, one lattice-based and one hash-based, so a weakness found in one does not undermine the other. Both follow NIST's standardized post-quantum algorithms and the joint CISA/NSA/NIST quantum-readiness roadmap.
Users keep their recovery phrase, and their address
The core implementation is built and benchmarked. Quantum-safe vaults are targeted for Mainnet this year, with native ML-DSA-65 accounts reaching Testnet by end of year and native account authentication on Mainnet targeted for Q1 2027. Wallet, SDK, and CLI support will arrive alongside. Independent audits are underway, and timelines stay open while that review and Testnet feedback continue. This reflects current direction, not a finished, fully audited release.
Post-quantum accounts arrive as an additive, opt-in capability, through the same rollout path zkLogin and passkeys used. Nothing existing changes, and no application needs to do anything today.
For background on how each Sui primitive transitions to post-quantum cryptography, see Securing Sui in the Quantum Computing Era. More on Sui's approach to security lives at sui.io/security.
FAQs
‍
Is Sui quantum-resistant today? Sui is built for cryptographic agility, so it can adopt quantum-resistant cryptography as standards mature. Quantum-safe vaults and native ML-DSA-65 accounts are in development and progressing toward Testnet. This is an ongoing work, not a finished, fully audited release.
What is the actual quantum threat to my account? A public key is exposed the moment an account transacts. A sufficiently capable quantum computer could recover the private key from that exposed public key and forge signatures. Moving authorization onto quantum-safe signatures ahead of that point is what removes the risk.
Do I need to change anything in my app or account today? No. Existing accounts, contracts, and integrations continue to work unchanged. When quantum-safe accounts and vaults are available, they are additive and opt-in, and a quantum-safe key derives from the recovery phrase you already use.
Why two different algorithms? The two schemes are built on different mathematical families, one lattice-based and one hash-based. If an unexpected weakness is ever found in one, the other does not share its assumptions, so account and vault protection does not rest on a single scheme holding.
When will this ship? Quantum-safe vaults are targeted for Mainnet this year, native accounts for Testnet by end of year, and native account authentication on Mainnet in Q1 2027. Timelines are kept open while independent review continues.
Does this require a hard fork or risk downtime? No. Adding a signature scheme is a routine protocol-feature update, not a change to consensus or existing state, the same path zkLogin and passkeys followed. Vault support requires no core protocol change at all.
Can I secure an account with both a classical and a post-quantum key? Yes. ML-DSA-65 will also be supported in Sui's multisig authenticator, so an account can require both an Ed25519 key and an ML-DSA-65 key to authorize a transaction.