Measured on 24 September 2026 · re-runnable
The Web3 Exposure Ranking
Four families measured against public sources: web3 domains, powerful contracts, memes and NFTs. The axis is how findable each project is; the priority is post-quantum readiness, measured — and measured in a way that separates what a project did from what its CDN did for it.
Read across the four families, the table answers one question — how far the market has got before 2030. Own post-quantum cryptography in the project’s code: 1. Borrowed from the CDN in front of it: 15. No post-quantum signal at all: 1. Post-quantum verdict not measurable on the row, and declared instead of scored: 10.
What is measured
Search exposure: the signals that decide whether a project can be found and read — domain identity, DNS trust records, AI crawler exposure, archived history, on-chain footprint, agent readiness. A module that could not run does not drag the score down: the total is re-normalised over the weight actually measured, and the coverage column says how deep the measurement went.
Why post-quantum is the priority
NIST retires RSA and ECC after 2030 and disallows them after 2035; traffic recorded today can be read then. What matters is who owns the cryptography, so the verdict separates four cases and never merges them:
- PQ in its own codepost-quantum cryptography found in the project’s own code — the signature layer, the part a quantum computer actually breaks
- PQ on its own edgethe hybrid key exchange is served by their own network, not by a CDN
- PQ borrowed from its CDNthe hybrid key exchange comes from the CDN in front of them — Cloudflare, Fastly, Akamai, CloudFront, Bunny. It is real protection, but it is not their work
- no PQ measuredno PQ signal measured anywhere: classical key exchange
The order is not for sale
No project can buy a position, a compliance row, a level or a module result. What can be bought is the diagnosis: which module costs you points, what is fixable, and what it would move. The measurement stays independent, because that is the only reason a ranking is worth citing.
Web3 domains
10 rows · the first 10 of the measured sample (top 40 by DefiLlama TVL), in measurement orderDeFi protocols with a live site: how findable they are, and whether anything they serve is post-quantum.
- #1
Aave V3
aave.com
75exposureLendingPQ borrowed from its CDNcoverage AAA$18.71B · TVL - #2
Bitget
bitget.com
67exposureCEXnot measurablecoverage A$6.79B · TVL - #3
OKX
okx.com
67exposureCEXnot measurablecoverage AAA$32.44B · TVL - #4
Bitstamp
bitstamp.net
62exposureCEXnot measurablecoverage A$5.01B · TVL - #5
HTX
htx.com
61exposureCEXnot measurablecoverage A$4.37B · TVL - #6
Gate
gate.com
60exposureCEXnot measurablecoverage AAA$7.89B · TVL - #7
Crypto-com
crypto.com
57exposureCEXnot measurablecoverage AAA$2.72B · TVL - #8
LayerZero V2
layerzero.network
56exposureBridgenot measurablecoverage AAA$7.89B · TVL - #9
Robinhood
robinhood.com
55exposureCEXnot measurablecoverage A$15.93B · TVL - #10
Polygon Bridge
polygon.technology
54exposureChainnot measurablecoverage AAA$2.94B · TVL
Measured, then withdrawn — and declared
- morpho.orgWSEP 59 · withdrawn from publication by the publisher
Measured like every other row and kept out of the table by a decision of the publisher, not by a change of measurement. Its score is published with the reason on purpose: an omission you can see costs the table nothing, and a silent one would cost it everything.
Powerful contracts
3 rows · oracles and contracts holding money, with the address DefiLlama declaresOracles and money-heavy contracts: what the chain says about them — balance, readable source, and whether they verify signatures with ECDSA.
- #1
Chainlink (LINK)
chain.link
54exposureOraclePQ borrowed from its CDNcoverage AAA - #2
Api3
api3.org
52exposureOraclePQ borrowed from its CDNcoverage AAA - #3
RedStone Oracles
redstone.finance
51exposureOraclePQ borrowed from its CDNcoverage AAA
Could not be measured, and why
Nothing of theirs could be read for this family: no HTML (bot protection, a rate limit, a timeout) or no declared domain. A score built from external sources only would not be comparable with the rows above, so it is declared instead of scored.
- lido.finot measured
- aave.comnot measured
- okx.comnot measured
Memes
7 rows · the largest by market capitalisation with a project site of their own (CoinGecko, by id)The most valuable memes with a project site. Half of Web3’s culture lives here and nobody measures it.
- #1
Shiba Inu (SHIB)
shib.io
34exposureMemePQ in its own codecoverage A$3.35B · Market cap - #2
Dogecoin (DOGE)
dogecoin.com
63exposureMemePQ borrowed from its CDNcoverage A$14.64B · Market cap - #3
FLOKI (FLOKI)
floki.com
53exposureMemePQ borrowed from its CDNcoverage AAA$265M · Market cap - #4
Bonk (BONK)
bonkcoin.com
43exposureMemePQ borrowed from its CDNcoverage A$309M · Market cap - #5
Mog Coin (MOG)
mogcoin.xyz
43exposureMemePQ borrowed from its CDNcoverage AAA$47M · Market cap - #6
SPX6900 (SPX)
spx6900.com
43exposureMemePQ borrowed from its CDNcoverage A$404M · Market cap - #7
Official Trump (TRUMP)
gettrumpmemes.com
30exposureMemenot measurablecoverage A$559M · Market cap
Could not be measured, and why
Nothing of theirs could be read for this family: no HTML (bot protection, a rate limit, a timeout) or no declared domain. A score built from external sources only would not be comparable with the rows above, so it is declared instead of scored.
- (PEPE)no project domain declared
- pudgypenguins.comHTTP 403 · blocked the read
- dogwifcoin.orgHTTP 403 · blocked the read
NFTs
7 rows · an editorial selection of well-known collections (no free source for volume)Well-known collections. Floor price needs a paid source, so the power column is declared empty instead of invented.
- #1
CryptoPunks
larvalabs.com
55exposureNFTPQ borrowed from its CDNcoverage A - #2
Bored Ape Yacht Club
boredapeyachtclub.com
52exposureNFTPQ borrowed from its CDNcoverage A - #3
CloneX
clonex.rtfkt.com
49exposureNFTPQ borrowed from its CDNcoverage A - #4
Otherdeed
otherside.xyz
38exposureNFTPQ borrowed from its CDNcoverage A - #5
Art Blocks
artblocks.io
34exposureNFTPQ borrowed from its CDNcoverage AAA - #6
Moonbirds
moonbirds.xyz
21exposureNFTPQ borrowed from its CDNcoverage A - #7
Milady Maker
miladymaker.net
48exposureNFTno PQ measuredcoverage AAA
Could not be measured, and why
Nothing of theirs could be read for this family: no HTML (bot protection, a rate limit, a timeout) or no declared domain. A score built from external sources only would not be comparable with the rows above, so it is declared instead of scored.
- azuki.comHTTP 403 · blocked the read
- doodles.appHTTP 429 · throttled the request
The limits, declared
- Borrowed is not prepared. A project behind Cloudflare inherits hybrid post-quantum key exchange without doing anything; one running its own edge may look worse and be further along. The column says whose cryptography it is, not how ready the project is.
- Exposure is not traffic. No search-volume, ranking-position or conversion data is used; the score comes from what the project publishes and what public sources say about its domain.
- The NFT family has no free floor price. The power column is declared empty there rather than filled with an unsourced number.
- The sample is a selection. Each family declares how its rows were chosen, and the memes sample is by market capitalisation with a project site — a different rule gives a different table.
The measurement is a runnable script, not a private dashboard: same inputs, same sources, same numbers. Each snapshot is dated, and the next step is to anchor its hash on-chain so a published table cannot be rewritten after the fact — including by us.