Claak makes a specific, narrow claim. This page states it, says which scheme runs where, and lists what has not been proven yet.
The account is a smart contract that checks a post-quantum signature on-chain for every operation. A classical key carries the transaction and pays gas; it cannot authorise a spend.
SPHINCS+ is built only from hashing, so an EVM chain can verify it with native opcodes. The deployed variant swaps SHAKE for keccak and uses its own parameters to make that affordable, which puts it outside FIPS 205 certification while keeping the hash-based security argument. On Solana the constraint is transaction size and compute budget, and Falcon is the one scheme small and cheap enough to verify in a single transaction. The scheme is chosen per chain by what that chain can actually verify, not by preference.
There is no upgrade path from a classical account, by design. An account that can be migrated has a window in which a classical key still holds authority, and that window is the vulnerability.
Keys are generated and stored on the device, encrypted with the user's password. No accounts, no analytics, and no Claak server in the path of funds.
The limits matter as much as the claims. If any of these change, this page changes with them.
Claak Wallet is live on Base mainnet and Arbitrum One, where standard accounts and Protected accounts are both deployed at byte-identical addresses. Solana runs on devnet and Bitcoin on Mutinynet signet, so those two are testnet only.
The contracts have not been through an external audit. Being live on mainnet is not the same as being proven, and the wallet says so itself: start with amounts you can afford to lose.
No one can promise protection against every future attack. The claim is narrower and checkable: the key controlling the funds does not use a scheme already expected to fall to a quantum computer.
Tirai is not open to the public. Its proof system and the veil, transfer, and unveil flow run end to end in testing.
