Research · 24 September 2026

The Web3 Ranking: Measured, Not Sold

Most Web3 rankings are built from numbers the projects report about themselves. This one is built from measurements of their own domains against public sources: registry records, DNS, web archives, DeFi data and the chain itself. It publishes 28 projects measured across four families — web3 domains, powerful contracts, memes and NFTs — and every row carries its coverage, its exclusions and its limits. Where a signal could not be measured, the row says so instead of guessing.

What we measured

Nine modules run against each domain: identity and ownership, DNS trust records, AI crawler exposure, ecosystem interactions, on-chain contract verification, own-registry attestation, web archive history, agent readiness and agent discovery. Each one either measures something from a verifiable source or declares that it could not.

The score is renormalised over the weight that was actually measured. That detail matters: a module that cannot run must not look like a defect of the project. Coverage is shown next to every row — AAA means the deep layers were measured too, A means the entry layer only. In this snapshot, 13 of 27 published rows reached AAA.

Why post-quantum readiness is the priority

NIST retires RSA and ECC after 2030 and disallows them after 2035; traffic recorded today can be read then. So the ranking does not ask whether a project looks modern — it asks whose cryptography it actually carries. The four verdicts are never merged:

• PQ in its own codepost-quantum cryptography found in the project’s own code — the signature layer, the part a quantum computer actually breaks
• PQ on its own edgethe hybrid key exchange is served by their own network, not by a CDN
• PQ borrowed from its CDNthe hybrid key exchange comes from the CDN in front of them — Cloudflare, Fastly, Akamai, CloudFront, Bunny. It is real protection, but it is not their work
• no PQ measuredno PQ signal measured anywhere: classical key exchange

A fifth case is declared instead of scored: not measurable. It is not a small remainder — 10 of the 27 published rows are in it — and it is stated on the row, not hidden in a footnote.

That is what the table is for. Not a leaderboard for its own sake: a reading of how far the market has got before 2030, with measurements instead of press releases — and with the rows where nothing could be measured still visible, because a gap you can see is information and a gap you cannot is a sales pitch.

The four families

• Web3 domains — 10 rows. The first ten rows of the measured sample — the top 40 by TVL on DefiLlama. Each row carries its TVL as DefiLlama declares it, next to how findable the site is.the first 10 of the measured sample (top 40 by DefiLlama TVL), in measurement order
• Powerful contracts — 3 rows. Oracles and money-heavy contracts whose address DefiLlama publishes. The chain answers two questions: is the source readable, and does the contract verify signatures with ECDSA — the layer a quantum computer actually breaks.oracles and contracts holding money, with the address DefiLlama declares
• Memes — 7 rows. The most valuable memes that declare a site of their own. Market cap comes from CoinGecko by coin id, never by ticker: two projects can share a symbol, and a ranking that mixes them is wrong.the largest by market capitalisation with a project site of their own (CoinGecko, by id)
• NFTs — 7 rows. Seven well-known collections, chosen by hand and declared as such. A floor price needs a paid source, so that column is declared empty instead of filled with a number nobody can check.an editorial selection of well-known collections (no free source for volume)

Three things the measurements showed

• The one project carrying post-quantum cryptography in its own code is a meme. Of the 27 published rows, 1 carries it: shib.io. The probe read the scripts it serves and found ML-KEM inside one of them, which is a measured signal in that project’s own code and not something inherited from an edge. The rest of the table either borrows the hybrid key exchange from the CDN in front of it — 15 rows: 9 Cloudflare, 5 Amazon CloudFront, 1 Fastly — or shows no post-quantum signal at all (1), and there is no room in the table for a project to be credited with work its CDN did.
• Borrowed is not prepared. Milady Maker — the only published row with no post-quantum signal anywhere — runs its own edge and refused the post-quantum handshake, so it ranks below collections that did nothing and simply sit behind Cloudflare. Nobody should read that as “Cloudflare is bad” or as “that collection is careless”: it is the difference between owning your cryptography and renting it, and the column exists precisely to keep those two apart.
• The gaps are declared, not averaged away. In the contracts family there is no balance to show: the address DefiLlama publishes for those protocols is their token contract, and its native balance is zero — the contracts that hold the money are not the ones with a published address. In the web3 domains family the post-quantum probe has only concluded on one row so far, so nine are declared not measurable rather than scored. Both gaps are visible in the table, which is the only way a snapshot can be honest about being a snapshot.

Could not be measured, and why

Some rows could not be read for one family or another: bot protection, a rate limit, a timeout, or no domain declared at all. A score built from external sources only would not be comparable with the rest, so they are listed with the reason instead of being quietly dropped or scored as if they were worse:

• lido.finot measured
• aave.comnot measured
• okx.comnot measured
• (PEPE)no project domain declared
• pudgypenguins.comHTTP 403 · blocked the read
• dogwifcoin.orgHTTP 403 · blocked the read
• azuki.comHTTP 403 · blocked the read
• doodles.appHTTP 429 · throttled the request

Measured, then withdrawn — and declared

Of the 28 projects measured, 1 is not in the table by a decision of the publisher, not by a change of measurement. Its score is published here with the reason, on purpose: an omission you can see costs the table nothing, and a silent one would cost it everything. The table shows 27 rows; every row missing from it is accounted for somewhere on this page.

• morpho.orgWSEP 59 · withdrawn from publication by the publisher

The limits, declared

The sample is a selection, not Web3 as a whole — each family says how its rows were chosen, and a different rule gives a different table. A project behind a CDN inherits hybrid key exchange without doing anything, so the post-quantum column must be read as “whose cryptography is this”, never as “how ready is this project”. Exposure is not traffic: no search-volume or ranking-position data is used. The weights are still being calibrated and this is a dated snapshot, not a verdict: the next step is to anchor the hash of each measurement on-chain, so a published table cannot be rewritten afterwards — by anyone, including us.

The order is not for sale

No project can buy a position, a score or a module result, and nobody — including us — can edit a published table without it being visible. What can be bought is the diagnosis: which module costs you points, what is fixable, and what it would move. The measurement stays independent, because that is the only reason a ranking is worth anything.