Whitepaper · Revised 2026-09-25
Money that outlasts the computer that breaks money. Mined by anyone.
xCoin is a proof-of-work currency with post-quantum signatures on every spend, a memory-hard mining algorithm that favors the laptop you already own, a hard cap of exactly 100,000,000 XID, no premine, and an emission schedule called the Annual Tenth: a short ramp to 50 XID per block, then a reward 10% smaller roughly every year, never below 1.5 XID for about 262 years, then a slow fade to the last coin around 2363. This paper is written for the people who will mine it, not only for the people who will audit it. Every number in it comes from the code and can be checked there. The thesis the design serves, one asset with everything else circulating on top of it as a claim, is stated on the one money page.
The whole design
00In one page
Every major cryptocurrency protects your coins with a signature scheme that a large enough quantum computer will break. The industry's plan is to migrate later, which means every holder has to move every coin before a deadline, and coins that never move stay exposed forever. xCoin never issues a classical key. Every spend, from block 1, is signed with ML-DSA-65, the lattice scheme the U.S. National Institute of Standards and Technology standardized as FIPS 204, or with its hash-based fallback, SLH-DSA-SHA2-128s (FIPS 205). There is no classical path, no hybrid mode, and no classical key to migrate away from.
Bitcoin also stopped being mineable by ordinary people within four years of its launch, when custom chips took over. xCoin runs on MetalDAG, a memory-hard proof-of-work in the Ethash family. Its 4 GiB launch dataset is the floor of a 16 GB Mac, and Apple Silicon’s unified memory is what keeps mining it efficient. The code calls it Apple-Silicon-favoring: it is meant to be mined from the Mac on your desk.
The money rules fit in a paragraph and never change: exactly 100,000,000 XID; a ramp of 6.25, 12.5, 25 and then 50 XID per block; from block 220,001 a reward 10% smaller every 110,000 blocks (about 382 days), never below 1.5 XID; after the floor era a fade of 10% a step to a 0.1 XID tail; the last coin around 2363; then nothing but fees. There is no premine and no founder allocation. There was no token sale and no venture round. Every coin comes from mining, including the founder’s.
If you read nothing else: xCoin is post-quantum money you can mine on the machine you already own, with rules simple enough to check against the code in five minutes. It is small, early, and live: mainnet genesis was mined September 26, 2026, 00:00 UTC. Section 10 tells you what can go wrong.
01Two problems the industry scheduled for later
The quantum expiry date
Elliptic-curve signatures, the kind Bitcoin, Ethereum, and nearly every other chain use, are safe against every computer that exists today and broken by a sufficiently large quantum computer running Shor's algorithm. This is not fringe. NIST published FIPS 204 precisely because of it. Several large chains have announced migration plans.
A migration is a promise to change the lock after the keys are already handed out. The earliest Bitcoin ever mined, coins whose keys were lost in 2011, the wallets of people who died, cold storage nobody has touched in years: none of it can be migrated by anyone. It sits there until a machine picks it up. The only complete fix is to never issue a vulnerable key in the first place, and that decision can only be made at genesis.
Mining left the garage
In 2009 you could mine Bitcoin on a laptop. By 2010 graphics cards took over, by 2013 ASICs did, and by 2016 mining had moved to warehouses next to power plants. The share of Bitcoin you can mine on a computer you own is, to several decimal places, zero. Every proof-of-work chain since has either accepted the warehouse or replaced mining with a system where the people who already hold the most coins earn the most new ones.
A currency that is supposed to belong to whoever shows up with a computer and electricity has to be designed so that it stays that way. That is a property of the puzzle, and xCoin chose its puzzle accordingly.
02The money rules
The supply schedule is deliberately boring, and boring is the point.
- No premine and no founder allocation. Block 0 mints nothing; its coinbase carries the charter commitment, not money. Supply starts at zero and every coin after it is mined under the same rule by everyone, the founder included. Block 1 is an ordinary block.
- The Annual Tenth. The reward ramps up over the first 220,000 blocks, then shrinks by a tenth roughly once a year. At the five-minute target, 110,000 blocks is about 382 days.
| Blocks | Reward per block | Approx. dates (300 s blocks) |
|---|---|---|
| 1 – 20,000 | 6.25 XID | Nov 2026 – Jan 2027 |
| 20,001 – 40,000 | 12.5 XID | Jan – Mar 2027 |
| 40,001 – 60,000 | 25 XID | Mar – May 2027 |
| 60,001 – 220,000 | 50 XID | May 2027 – ~Dec 2028 |
| 220,001 onward, every 110,000 blocks | 10% less each step: 45, 40.50, 36.45 … | ~Dec 2028 – ~2063 |
| 3,850,001 – 31,460,000 | 1.5 XID floor | ~2063 – ~2325 |
| 31,460,001 – 34,320,000 | fades 10% a step | ~2325 – ~2353 |
| 34,320,001 – 35,375,353 | 0.1 XID tail; last coin | ~2353 – ~2363 |
- Milestones. 25% of the cap is mined by about 2032, 50% by about 2046, 75% by about 2177 and 99% by about 2330. About 8,875,000 XID exist when the 50 XID phase ends in late 2028; about 157,788 XID a year are issued during the 1.5 XID floor.
- Exactly 100,000,000 XID. The 64 reward ranges plus a closing remainder of 1,660,000 sat (0.0166 XID), the rounding left by whole-sat rewards, sum to exactly 1016 sat. The canonical 65-row table (first block, last block, sat per block, plus the remainder) has SHA-256
356de0dce26aa5e5b9481c3936ecdefb1f81d14dd5e2ca2a43cc7b2775d0a230; the full schedule is on the overview. Miners are paid by transaction fees after the last coin. No transaction owes a settlement levy: the levy machinery in the code is dormant at zero rate and zero cap.
A ramp, a long gentle decline, a floor that keeps paying for centuries: the schedule is short enough to read in one table and slow enough that a miner who joins decades from now is still paid to show up. One XID divides into 108 base units, each called a sat. Off-chain ledgers may account in thousandths of a sat, called msat, but an msat is not an on-chain unit: whatever settles on chain is rounded to whole sats.
Written into genesis. Its coinbase message reads Hic experimentum prosperat (“here the experiment succeeds”), followed by the genesis date and the full supply, 10,000,000,000,000,000 sats, 100M XID. The genesis coinbase mints nothing. Its only output, value 0, is a 47-byte OP_RETURN carrying the tag XCOIN/charter/1 followed by the SHA-256 of the charter, the text that states the rules above, so that the money rules and the chain begin in the same block and neither can be quietly replaced. The charter hash is fd9b475afdbe178864f32802726cc60c27290c09efd472d0934b1c733d3b9340. To check it, take the SHA-256 of the charter text (contrib/regenesis/CHARTER.md in the code) and compare it with the 32 bytes after the tag in the genesis coinbase, or with the charter_hash that nex-cli getcharter reports. The same call reports the genesis hash, 3bc1a36df7d786a5c4584e21d248e0a3785a96aaa60a5b3959dfad50283379f2, and the currency id, the SHA-256 of the 80-byte genesis header followed by the charter text: e6e4ae00e1d3b25a7e4c2e94d3216d70f6b6f2e7cbd38bf23acaed391edea060.
Parameters checked against the code
| Parameter | Value |
|---|---|
| MAX_MONEY | 100,000,000 XID (10,000,000,000,000,000 sat) |
| Premine | none. No founder allocation, no privileged issuance, nothing carried in; FOUNDER_PREMINE_SCRIPT is never paid |
| EMISSION_START_HEIGHT | 1 (block 0 mints nothing) |
| Subsidy | the Annual Tenth: 6.25 / 12.5 / 25 / 50 XID ramp to block 220,000, then 10% less every 110,000 blocks, floor 1.5 XID, fade to a 0.1 XID tail; whole sats |
| Emission table | 65 rows (64 ranges + closing remainder), SHA-256 356de0dc…2775d0a230 |
| Closing remainder | 1,660,000 sat (0.0166 XID), minted with the last coin |
| Last subsidy block | 35,375,353 (~2363 at 300 s); subsidy zero afterward |
| nPowTargetSpacing | 300 seconds (5 minutes) |
| Difficulty | reference ASERT (aserti3-2d), anchored at the genesis block and active from block 1; half-life 2 hours (nASERTHalfLife = 7,200 s); no per-block clamp; no minimum-difficulty blocks |
| COINBASE_MATURITY_MAINNET | 1,000 blocks (about 3.5 days) on mainnet (and on retired testnet A) |
| MIN_OUTPUT_VALUE_SAT | 10,000 sat (0.0001 XID) on every non-OP_RETURN output; a coinbase with exactly one spendable output is exempt and may pay any value from 1 sat |
| MAX_BLOCK_WEIGHT | 64,000,000 weight units (consensus) |
| MAX_RELAYABLE_BLOCK_WEIGHT | 16,000,000 WU, the largest block the peer-to-peer transport carries and the ceiling for -blockmaxweight (policy) |
| DEFAULT_BLOCK_MAX_WEIGHT | 4,000,000 WU mining default (policy, about 708 one-input PQ spends; can be raised without a fork) |
| MAX_BLOCK_DATACARRIER_BYTES | 8,000 bytes of OP_RETURN per block (100 anchors × 80), every block included (consensus); relay policy accepts 80 bytes per transaction, one anchor, -datacarrier on by default |
| SETTLEMENT_LEVY_GENESIS_RULE | {0, 0, 0}: zero rate, zero cap, so no transaction owes a levy. The machinery is in the code, dormant; a levy can be switched on only by soft fork and never off without a hard fork |
| COIN | 100,000,000 sat = 1 XID |
| Genesis inscription | coinbase message Hic experimentum prosperat - 2026-09-26 - 10,000,000,000,000,000 sats, 100M XID (Latin: “here the experiment succeeds”); the date is the genesis day, 10,000,000,000,000,000 sats = 100,000,000 XID |
| Genesis coinbase | mints nothing; one 47-byte OP_RETURN output, value 0: XCOIN/charter/1 followed by the SHA-256 of the charter: fd9b475afdbe178864f32802726cc60c27290c09efd472d0934b1c733d3b9340 |
| Genesis block | mined 2026-09-26 00:00:00 UTC; hash 3bc1a36df7d786a5c4584e21d248e0a3785a96aaa60a5b3959dfad50283379f2 |
| Currency id | e6e4ae00e1d3b25a7e4c2e94d3216d70f6b6f2e7cbd38bf23acaed391edea060 |
| Address HRP | xpa, Bech32m, witness version 3 (addresses read xpa1r…) |
| Chains | mainnet and regtest; testnet A retired |
Fee policy release defaults, not consensus
Fees are set by relay policy and the fee market; no consensus rule prices a transaction. The relay floor is 1,000 sat/kvB, 1 sat/vB. The mining floor and the incremental relay fee equal it, and the wallet's fallback fee is on by default at the same rate (-fallbackfee=0 disables it). A typical one-input, two-output payment is about 1,480 vB, so its floor fee is about 1,480 sat, 0.0000148 XID. The largest standard transaction is 400,000 WU. Every one of these is a release default that a node operator can override and a release can move; none is consensus.
03Mining: MetalDAG
Bitcoin's puzzle is SHA-256 over an 80-byte header. The whole working set fits in a handful of registers, which is exactly what a custom chip exploits: a hash pipeline etched in silicon, replicated thousands of times. If a puzzle fits in a register file, it ends up in a warehouse.
MetalDAG is in the Ethash family. Every epoch of 14 days, counted from the genesis time rather than from block height, has its own seed and its own dataset: 4 GiB at launch, growing 128 MiB per epoch. The dataset comes from a small per-epoch cache built from the seed in 3 rounds; each 64-byte dataset item is built from 256 cache parents. To make one mining attempt, your machine takes the Keccak-256 of the 76-byte header prefix (every header field except the nonce), hashes that together with the nonce, and then makes 64 accesses into the dataset, 128 bytes each, the address of every access computed from the mix state the previous access left behind. The mix is then compressed and hashed once more to a 256-bit result that is compared with the target exactly as a SHA-256d block hash would be. The Keccak here is Keccak-f[1600] with the original 0x01 padding, as Ethash uses, not NIST SHA3. Only mining builds the full dataset; a verifier recomputes just the roughly 128 dataset items an attempt touches from the per-epoch cache.
Why the Mac
The 4 GiB launch dataset is the floor of a 16 GB Mac, and the dataset grows every epoch so that the working set drifts past the memory tiers of discrete GPUs over time while Apple Silicon’s unified memory keeps mining efficient. The code calls MetalDAG Apple-Silicon-favoring, and that is the whole claim: memory-hard, and favoring the machine people already own.
Honest limits. MetalDAG is memory-hard. The code claims nothing about custom chips, and neither does this paper. High-end discrete GPUs can mine xCoin. The Mac's case is hardware people already own, not a guaranteed edge. Full nodes verify with a light per-epoch cache of one 128th of the dataset, 32 MiB at epoch 0, and never hold the dataset; only mining builds the full DAG.
MetalDAG parameters mainnet (and retired testnet A)
| Parameter | Value |
|---|---|
| Family | Ethash-family, memory-hard, dataset-based |
| metaldagDagInitBytes | 4 GiB dataset at launch |
| metaldagDagGrowthBytes | +128 MiB per epoch |
| metaldagEpochSeconds | 14 days, time-based, counted from the genesis time (metaldagBaseTime), not from block height |
| Mixing | 64 accesses × 128-byte mix per nonce; 64-byte hash, 256 dataset parents, 3 cache rounds |
| Hash core | Keccak-f[1600], original 0x01 padding |
| Header hash | Keccak-256 of the 76-byte header prefix, every field except the nonce; the nonce enters the mix separately |
| Result | 256 bits, compared with the nBits target exactly as a SHA-256d block hash would be |
| metaldagCacheDivisor | 128: verification cache = dataset ÷ 128 (32 MiB at epoch 0), hard ceiling 64 GiB; no full dataset needed to verify |
| Multi-algorithm | reserved, not active: header bits 28–29 must be 0 (MetalDAG); no AuxPoW validation exists |
04Post-quantum signatures on every spend
Every xCoin transaction is authorized with a post-quantum signature: ML-DSA-65, the lattice scheme standardized as FIPS 204 (NIST security level 3), or SLH-DSA-SHA2-128s, the hash-based scheme standardized as FIPS 205 (NIST security level 1). Both are consensus-valid, and a spend tree may carry an SLH-DSA fallback leaf that shares no structure with the lattice, in case lattice assumptions ever weaken. Consensus rejects everything else. There is no legacy address format, no hybrid mode with a classical key, and no flag to turn one on. A transaction with a classical signature is not weak, it is invalid, the same as a transaction with no signature.
- Outputs are witness version 3, the post-quantum script tree: a 32-byte program commits to the Merkle root of algorithm-tagged leaves, and there is no key path. Leaf 0xc0 is ML-DSA-65, leaf 0xc2 is SLH-DSA-SHA2-128s; 0xc4 and 0xc6 are reserved. An ML-DSA leaf holds only the SHA-256 of the public key; the 1,952-byte key itself appears on the witness when the output is spent, so keys stay hidden until the moment of spending.
- Addresses are Bech32m with prefix
xpa1r…. Theris the witness version. There is no other kind of mainnet address; testnet A (retired) usestxa1r…. - Signatures are large. An ML-DSA-65 signature is up to 3,309 bytes and an SLH-DSA-SHA2-128s signature is exactly 7,856 bytes, where a classical signature is a few dozen. A single-input ML-DSA-65 spend weighs about 5,650 weight units; the consensus block ceiling is 64,000,000 WU, the largest block the network relays is 16,000,000 WU, and the mining default of 4,000,000 WU fits about 708 such spends. Each post-quantum signature check costs 2 of a block's 1,280,000 sigop budget. The cost is paid once, at genesis, instead of by every holder in a panic later.
- Everyday and fallback. ML-DSA-65 is the everyday path. SLH-DSA signing takes a few hundred milliseconds and its signature is 7.9 KB, which is why the SLH leaf is the fallback and not the default. Hashing everywhere is SHA-256: a key's identifier is the SHA-256 of its public key, 32 bytes, chosen over RIPEMD-160 because 160 bits would be the bottleneck against a level-3 target.
- Script limits and validation budget. Under witness v3 an initial witness stack element may be up to 8,192 bytes; elements pushed during execution keep the 520-byte limit. A leaf script is at most 10,000 bytes and 201 non-push opcodes, and every hash opcode charges one validation-weight unit per byte hashed. In the BIP-342 validation budget an ML-DSA-65 signature check costs 200 and an SLH-DSA check 1,080, which bounds the worst possible block at 25.3 s of single-threaded verification. Measured on the founder's M3 Pro in a release build, an ML-DSA-65 verify takes 79.1 µs median and an SLH-DSA-SHA2-128s verify 418.9 µs median.
- Commitments. Tagged hashing is BIP-340 style over SHA-256, with the tags
XCoinLeaf,XCoinBranchandXCoinSighash/v3; the internal-key slot of every control block holds the fixed marker SHA-256("xcoin/v3/nokey"). A control block is the leaf version, that marker and a Merkle path of up to 128 nodes of 32 bytes, 4,129 bytes at most. The v3 sighash commits a key version byte: 0x02 for ML-DSA, 0x03 for SLH.
xCoin is a Bitcoin-derived chain that enforces post-quantum-only outputs at consensus: only witness v3 outputs and OP_RETURN may be created on mainnet (as on retired testnet A), and the legacy script types (P2PKH, P2WPKH, P2TR and the rest) are rejected, so there is no ECDSA and no Schnorr spend path for any coin on this chain. Witness v3 leaves run the BIP-342 CHECKSIG sequence with ML-DSA-65 or SLH-DSA-SHA2-128s in place of Schnorr.
05Consensus and network
xCoin is a conservative Bitcoin-lineage UTXO chain everywhere it can afford to be, and novel only where it must be. It is a standard Bitcoin Core build with Bitcoin Core's JSON-RPC, under the MIT licence.
- 300-second blocks, difficulty retargeted every block by anchored ASERT (the aserti3-2d reference algorithm) with a two-hour half-life, anchored at the genesis block and active from block 1. Every target is computed from the genesis target and the chain's cumulative departure from its ideal 300-second schedule, so schedule error does not compound and there is no emergency cliff after a long solve. There is no per-block clamp and no minimum-difficulty block; a block stamped more than two hours ahead of a node's clock is rejected.
- UTXO model, full-node validation, peer-to-peer gossip on port 9333 (network magic
58 50 41 03), JSON-RPC on 8332 for operators. The node isnexd, the CLI isnex-cli. - Three chains and nothing else: mainnet, testnet A (
-testnet, P2P 19333, RPC 19432, magic58 54 41 02, addressestxa1r…, data in<datadir>/testneta) and regtest (P2P 19444, RPC 18443, magic4e 45 58 03, HRPnxrt). Testnet A was the rehearsal chain, the mainnet rules on a private chain with its own identity; its coins have no value, and it is retired (ledger archived at height 3,555). Mainnet has been live since September 26, 2026, 00:00 UTC, explorer at superknet.com. - Encrypted node connections. From block 0, connections between nodes use hybrid post-quantum encryption: ML-KEM-768 combined with the BIP324 transport (XIP-4).
- No checkpoints, no assume-valid, no minimum chain work. The release checkpoint list is empty on mainnet and the assume-valid and minimum-work values are unset on every chain, so a node validates everything from genesis on its own.
- No administrative key. There is no key, no signer and no message anybody can transmit to steer the chain; the charter forbids an administrative key at this layer.
- Seeds. Five DNS seed hostnames are named in the code:
seed.xcoinproject.com,seed.superknet.com,seed.xcoinminer.com,seed.minedifferent.com,seed.movepunk.com. Their DNS records are still to be created, so no seed is deployed yet, and the compiled-in seed list has a single entry that the code itself flags as a single point of failure. Until the seeds are up, peers are added with-addnode.
Where the chain stands. Mainnet is live: genesis was mined September 26, 2026, 00:00:00 UTC, hash 3bc1a36df7d786a5c4584e21d248e0a3785a96aaa60a5b3959dfad50283379f2, with hybrid post-quantum node connections (ML-KEM-768, XIP-4) from block 0; explorer at superknet.com. Testnet A (retired, genesis 1dc4131e…6a43ccb9, ledger archived at height 3,555) was the rehearsal.
06How to take part
There is no whitelist, no license, and no sale. You need a machine and an address.
1 · Get an address
The node's own wallet makes one from the command line (nex-cli). It starts with xpa1r. The node's wallet is a descriptor wallet whose default address type is the post-quantum script tree, pqtr(…), with key expressions pq(KEY) for ML-DSA-65 and slh(KEY) for SLH-DSA-SHA2-128s. Every new address costs one ML-DSA-65 and one SLH-DSA key generation, about 50 ms together, which is why the keypool defaults to 100 rather than Bitcoin's 1,000. The node accepts no seed or private key over RPC: an offline wallet signs a PSBT and the online node broadcasts it.
2 · Pick your level
- Browser. xcoinminer.com. One tab, one click. Built to teach, not to earn.
- Mac. NerdMiner, the native Mac miner. Paste your address and walk away. Mining is the only thing that needs the full DAG.
- Anywhere. NerdMiner's browser extension and its iPhone and Apple Watch companions are described at xcoinminer.com.
3 · Solo, alone or through the pool
Solo is a lottery ticket: rare, but a block is the whole subsidy plus its fees and it is yours. The pool at pool.xcoinminer.com:3335 is solo and coinbase-only too: a block you find pays its coinbase straight to your address; no accounts, nothing held on your behalf, nothing split, no payout scheme. Its details are at xcoinminer.com. The pool, the miner and the explorer sit outside the node code. Either way a coinbase reward matures after 1,000 blocks, about 3.5 days, before it can be spent.
4 · Watch it
The explorer at superknet.com shows live mainnet figures from genesis, September 26, 2026, 00:00 UTC. Your own node is the reference: nex-cli reports every block, and getcharter reports the charter hash, the currency id and the genesis hash.
07Community and governance
xCoin is built for the many, so the community is designed to stay open and stay honest at the same time.
- MineDifferent (minedifferent.com) is the forum. Your standing there is meant to be your mining record, not a moderator's grant.
- The shared chat room is one conversation across xcoinminer.com, superknet.com, and the forum. Anyone can read it.
- Distributed Ledger Technologies builds and operates the reference software and the public infrastructure: the nodes, the pool, the explorer, the wallet, the miner, and the forum. DLT sells no coins, lists XID on no exchange, and makes no representation about its value. DLT's revenue, if any, comes from services and products around the network, published at distributedledgertechnologies.com.
- What DLT cannot do. Consensus has no administrative key. DLT cannot freeze, seize, or reassign a coin, cannot print past the cap, and cannot change a rule in this paper without a protocol upgrade that every node operator chooses to run.
The charter, committed in the genesis coinbase, forbids an administrative key at this layer. The charter text is on this site, with the hash the genesis coinbase commits to.
08XCIP-001 proposal, not in the code
XCIP-001 is a proposal specified outside the node code. Nothing of it is in the code this paper describes: the node has no claim mechanism and no snapshot mechanism, and no parameter of the proposal binds the network. It could only ever arrive through a future protocol upgrade after its specification is frozen and reviewed, and this paper states none of its parameters. Until then, the emission schedule in section 02 is the only way an XID comes into existence.
09Security model
- Consensus over authority. No administrative key, no discretionary mint, no checkpoints. Every rule in this paper is enforced by full nodes, and a node validates from genesis on its own.
- Supply invariant. MAX_MONEY is 100,000,000 XID, and the 65-row emission table (64 reward ranges plus the closing remainder) sums to it exactly.
- Quantum posture. An address commits only to the Merkle root of its spend tree, and the ML-DSA leaf holds only the SHA-256 of the public key; the key appears on the witness at spend time. There is no classical key to migrate away from, and an SLH-DSA leaf that shares no structure with the lattice is the fallback if lattice assumptions weaken.
- Slow to spend a reward. Coinbase maturity is 1,000 blocks, about 3.5 days, ten times Bitcoin's 100.
- UTXO hygiene. Every output that is not OP_RETURN must carry at least 10,000 sat (0.0001 XID); a coinbase with exactly one spendable output is exempt so that every subsidy stays mintable; under the Annual Tenth the smallest reward, the 0.1 XID tail, is well above the floor.
- Mining dispersion. Memory-hard proof-of-work that favors hardware people already own is the design's bet on a wide miner set.
- Pool power, not pool size. A dominant pool is a control risk whatever its fee. The pool DLT runs is solo and coinbase-only, with no accounts and no payout scheme.
- Reviewed. The consensus code has had an external security review, and the fixes are in the code, cited by finding number.
- Verification without trust. Every consensus parameter is in the code, and the numbers in this paper were checked against it on the revision date above.
10Risks, honestly
You should hear these from the people who built it.
- The network is young. Mainnet genesis was mined September 26, 2026, 00:00 UTC. It is small, and one person with a garage of GPUs could be a large fraction of it. The defense is more ordinary machines, which is why this paper exists.
- The seed infrastructure is thin. The DNS seed hostnames named in the code have no records yet, and the compiled-in seed list has one entry, a single point of failure the code itself flags.
- Post-quantum signatures are large. A one-input ML-DSA-65 spend weighs about 5,650 WU, so blocks carry fewer transactions than a classical chain of the same size. This is a deliberate trade.
- MetalDAG is memory-hard, and that is the whole claim. The code says nothing about custom chips, and neither does this paper. Discrete GPUs can mine it.
- The software is early. Bugs are possible. Review reduces risk; it does not remove it.
- XID has no established market. DLT does not list it and makes no claim about its value. Retired testnet A coins have no value at all.
11Roadmap
- Consensus rules in the code: the Annual Tenth emission table (65 rows, SHA-256
356de0dc…2775d0a230); post-quantum-only outputs; anchored ASERT; MetalDAG; the charter committed in the genesis coinbase. - Testnet A, the private rehearsal chain, now retired (ledger archived at height 3,555).
- Mainnet genesis mined September 26, 2026, 00:00 UTC, with HX1 hybrid post-quantum node transport (ML-KEM-768, XIP-4) from block 0.
- External security review of the consensus code, fixes in the code.
- Tooling outside the node code: NerdMiner, the native Mac miner; the browser miner at xcoinminer.com; the pool, solo and coinbase-only; the MineDifferent forum; the explorer at superknet.com, live on mainnet.
- DNS records for the five seed hostnames, and a regenerated fixed-seed list.
- XCIP-001, if ever adopted, only by a future protocol upgrade; nothing of it is in the code today.
This list holds only what the code, its runbook and the project's published tools name. The roadmap page keeps the full list of what is built and what is not.
12Disclaimer
xCoin is experimental monetary software developed by Distributed Ledger Technologies Inc. Nothing in this document is investment advice, an offer of securities, or a promise of value. Consensus parameters described as provisional may change before their activation. Mining and holding cryptographic assets involves risk, including total loss. Verify everything: the code and the chain, not this paper, are the protocol.
© 2026 Distributed Ledger Technologies Inc. · distributedledgertechnologies.com