Sofia | sonki.gwei | 🇪🇺 eu/acc

1/ gm! big news to share - i'm joining the @ethereumfndn funding coordination team ✨ 🧵👇

woah!

last but not least: I also had the chance to be on a panel at @ETHSofiaBG: "Building Under CROPS: What the Ethereum Foundation's Mandate Means for Developers and Institutions," moderated by @VyaraSavova (European Ethereum Institute), alongside @sajidazouarhi (Optimum) and @0xmikemcc (Privacy Pools). what I talked about – our team's mission: to understand and create funding mechanisms for the Ethereum ecosystem. I focus on positioning Ethereum as critical infrastructure in the broader open source ecosystem so that we can attract funding from outside crypto: from governments, organisations that support open source, and other funding and grant opportunities – subtraction as success: the Mandate's goal is for Ethereum to work even if the EF disappeared. from our team's perspective, subtraction succeeds when funding flows into Ethereum public goods from multiple sources, not only or primarily from the Foundation. one entity sitting at the center, even one without revenue, crowds others out. if people know the EF will handle something, they don't step up – open-weights AI: open weights sit in a grey zone. the models are free to use but you don't know what data trained it. the harder question is verification - how do you know an inference provider is actually running the model it claims to run? I'm exploring how Ethereum can become a trustless coordination layer for open frontier AI, combining payment rails, identity, and the ability for distributed actors to verify claims about one another without a central controlling body – EU Cyber Resilience Act: compliance is becoming a real challenge for open source. the CRA introduces security and reporting obligations that touch open source projects directly, and the tension is how do you comply without introducing centralised gatekeepers? in this workstream, I'm exploring how Ethereum as an attestation layer can allow open source projects to make verifiable claims about their compliance without relying on a single authority the rest of the panel – Sajida spoke about whether CROPS values can travel beyond the Ethereum ecosystem to the broader blockchain space, and where censorship is actually happening today across the stack: builders, relays, RPCs, front ends – Mike spoke about compliant privacy in practice, and why privacy and censorship resistance matter at the application layer, not as abstract principles but as concrete infrastructure choices full recording will be available soon for me personally, I'm glad I could give a sneak peek into the workstreams I'm working on. Ethereum should definitely serve a purpose beyond crypto: for example, becoming infrastructure for trust and verification in the broader open source ecosystem.

Panel: MiCA in Bulgaria: Lessons from the First Licensed CASPs at @BWBulgaria F3 Future Finance Forum Damyan Leshev (Eversheds Sutherland, moderator) Ivan Takev (Alaric Securities) Vyara Savova (European Ethereum Institute) Dimitar Stoyanov (Financial Supervision Commission) context – MiCA came into force 1 July, and Bulgaria now has five licensed CASPs - per capita comparable to Germany, ahead of France and Italy – the rulebook is already being rewritten. the European Commission's MiCA review consultation closes 30 September what it actually took to get the first license – Alaric Securities (first MiCA CASP license in Bulgaria) already had a trading business dating back to 2011. crypto had to be incorporated into existing systems as a new asset class with no friction against traditional instruments – technically: integrations with executing venues, clearing brokers, custodians. on the licensing side: adapting existing rules so crypto fits, aligning operational resilience, IT security, business continuity – the challenge was meeting all requirements within very strict MiCA timeframes while the regulator was also navigating new ground why applications fail: the regulator's perspective – Stoyanov (FSC): the main problem is a "lack of the necessary mentality": applicants not understanding they now operate in a regulated environment – two directions of failure: flawed internal policies and procedures (many legacy VASPs produced something, but it wasn't serious), and staffing - key function holders (compliance officers / AML officers) who don't meet the requirements – "we want to see well-developed procedures, not something generated by AI with a bad prompt. we've seen such cases" – policies can be fixed during the authorisation process. staff can't - replacing a key function holder restarts the assessment what MiCA review has to fix – Savova (EEI): the white paper notification period is currently 20 days, roughly a month total delay before an asset can be listed. other jurisdictions have no such delay. Europe is losing users and competitiveness. the evaluation could happen while the asset is already listed tokenised securities – Takev: substance should take precedence over form. if something is a tokenised security, it should be treated as a security with full shareholder rights. currently it's not, you can't vote with your token at a general meeting – Nasdaq plans to launch tokenised trading in Q2 2027, with full shareholder rights and DTCC clearing. "that will be the real revolution in tokenisation" – Savova: the EU needs a common definition of what a digital DLT-based financial instrument actually is, rather than leaving it to member states. decades of discussion about the lack of a common "financial instrument" definition, and adding DLT on top only adds complexity the DLT pilot regime – Savova: the DLT pilot regime should become permanent. current caps should be removed or increased, and many more assets should be included in scope – Takev: there's no turning back; several authorised market infrastructures already operate under the pilot across Europe. the question is how to make it attractive e-money tokens and dual authorisation – a CASP wanting to provide transfer and custody for e-money tokens currently also needs payment services authorisation from the national bank. dual authorisation that the EBA itself said wasn't intended – Stoyanov: "there is nothing Bulgaria can do before there is a broader European approach" – Takev: one of the grey areas and big drawbacks of MiCA, hopefully fixed in one to two years ESMA direct supervision: tiered model – the Commission proposed ESMA supervise all CASPs directly. the discussion is converging on ESMA supervising only significant CASPs, with smaller ones remaining at member-state level – Savova: this is an opportunity: smaller CASPs don't have the same risk or resources, and a tiered model could give them a more streamlined regime – Stoyanov: observed the Binance authorisation process first-hand on ESMA's Digital Finance Standing Committee. "without getting into details, it was a very tedious and torturous process". for global CASPs there's sound logic for pan-European authorisation. for local players, national-level is more efficient. the challenge: where to draw the line is Bulgaria crypto-friendly? – Stoyanov: "friendly and unfriendly are a bit emotional". five authorisations, per capita comparable to Germany, one of ten EEA jurisdictions with a Class 3 CASP. "we are friendly toward good business" – Savova: "I want to scream it from the rooftops: I'm extremely impressed by what our supervisory authority is doing, including speaking in public and answering questions. that is not the rule in Europe"

panel on Building Post-Quantum Trust for Interconnected AI at @ETHSofiaBG Georgi Kirov (Crisp Labs, moderator) Kiril Kalchev (BRAIN++ AI Factory) Petar Nikolov (Equisect, PhD in Quantum Algorithms) Prof. Angel Marchev (UNWE / Sofia University) biggest misconception about post-quantum trust – Nikolov: post-quantum cryptography is one of the hardest problems we're solving right now, even though we don't know if it's an imaginary problem or a real one. we're solving something for the next 10-20 years – Kalchev: the biggest misconception is that when you choose the best post-quantum algorithm and implement it, you're done. it's a journey. exploits will be found. your system needs to be able to adapt – Marchev: first, if things go sour, they change fast, but adoption of countermeasures takes a long time. that's a contradiction we have to deal with. second, we're not yet in a post-quantum world but we're already in an AI world. the superintelligence misconception (that it's coming and breaks everything) is exactly that type of a misconception quantum computing vs. post-quantum cryptography – Nikolov: quantum computing has nothing in common right now with post-quantum cryptography. PQC is about classical computers developing new encryption algorithms (hash-based, lattice-based) it's all classical – there are 4–5 algorithms proposed as post-quantum resistant, but nobody has tested them on actual quantum hardware. the underlying hard problems (shortest vector, closest vector) can't be tested on classical machines – the biggest immediate threat is harvest now, decrypt later. organisations are harvesting encrypted data today, planning to decrypt it once quantum hardware becomes affordable – the algorithms we're developing now may have nothing in common with what we'll need in 10–15 years. Shor published his factoring algorithm in 1994 but nobody ran it on real quantum hardware until about 10 years ago. someone will develop something far better than Shor's algorithm, we should expect the unexpected the arms race – Marchev: imagine the future of cryptography as an arms race. people advancing on one side with current technology, people advancing on the hacking side. this goes on forever, new technology doesn't end it, just shifts the terrain – on education: globally there are very few established quantum/PQC programmes. the US leads on education, Europe on academic research, China is always present. the market isn't treating post-quantum as seriously as other current topics, but research is flourishing, mainly in lattice cryptography – physics is contributing in unexpected ways: researchers working on side-channel attacks through power consumption and temperature changes, and on methods to spoof those signals – AI will shorten production times dramatically. the half-life of implementation is going to get shorter and shorter what to do today: Kalchev's three steps – first: catalogue your data, understand your security posture, decide what needs to be secured – second: categorise. start with data that's important for long periods: we're in the harvest-now-decrypt-later era – third: start implementing hybrid algorithms where they exist. and don't pick just one post-quantum algorithm and stop: it won't be your last choice. rotate algorithms, make policies, everything else follows AI goes quantum first – Nikolov: AI will go quantum before cryptography does. LLMs are probabilistic, quantum computing is probabilistic; there's a natural synergy. research already shows quantum computing could speed up AI development by orders of magnitude, not percentages – after post-quantum cryptography, the next step may be quantum cryptography itself, using quantum properties for encryption, not just for breaking classical encryption the business case – Marchev: don't treat post-quantum as a prediction problem. it's an adaptability problem. NIST already recommends starting migration now – the key shift: from trusting objects to trusting processes. this was reflected in Kalchev's earlier presentation: it's the central point from a business perspective – it has to be a systematic process, not a patch job. every moving part reflects changes in every other part. and since it's an adaptability problem: the quicker you move, the better the competitive advantage timing the day before this panel, the EU's three financial supervisors (EBA, EIOPA, ESMA) published their autumn 2026 risk assessment (esma.europa.eu/press-news/es…). they warn that quantum computing could undermine cryptography securing communications, transactions, databases, and blockchains, and that the threat could materialise before quantum computers are commercially useful for anything else. encrypted data stolen today can be decrypted later. the NIS Cooperation Group has recommended member states adopt a post-quantum migration strategy by the end of 2026, three months from now.

at @ETHSofiaBG, Kiril Kalchev from BRAIN++ AI Factory gave a keynote on Polymorphic Crypto Chains, a design model for chain client developers: the problem – every blockchain is built on cryptography that will eventually need replacing. quantum computing is one reason, but not the only one: algorithms get broken, standards evolve, new attacks surface – today, changing the cryptographic primitives in a chain usually means a hard fork and a coordinated network-wide cutover. that doesn't scale, especially when you're federating data across organisations the idea – what if every block just declared which hash and signature scheme protects it? then swapping a primitive becomes a registry operation - no fork, no re-signing history, no forcing every client to upgrade simultaneously – the actual change is minimal: one new field in the block (cryptographic metadata) and one substitution in the link function. everything else follows from there why it matters – hybrid post-quantum signatures (e.g. secp256k1 + ML-DSA) work as just another table entry, no client code change needed – retiring a compromised algorithm is recorded in the chain itself, auditable and enforceable by policy – per-account key migration works cleanly on top of this; each account registers a suite alongside its public key, so migration becomes per-account rather than network-wide (photos show this as an EIP-8141-style verifier frame in a few lines of Python) – the test suite (see photos attached) is basically a specification written as executable failure modes: 20 tests covering suite coverage, tamper detection, Ethereum-native suites, verifier frames, anchoring, and ledger semantics what exists: reference implementations in Python, C++17, and Rust, with 61 tests. GPL-3.0. EU-funded through BRAIN++ / EuroHPC Joint Undertaking

privacy is normal y’all

babe wake up, first speakers are getting announced at @EFDevcon