The $7 Billion Race To Save Crypto From Quantum Computers

What Happened

The transition is much harder for crypto. Assets worth billions can sit untouched for decades, old wallets may never be upgraded, and institutional custody systems were built around cryptography that quantum machines are expected to break.

For Akshay Thakur from BitGo, institutional custody introduces another critical requirement.

Market Context

Despite the rumors and fear-mongering, Quantum computers are still years away from threatening today’s financial systems. But the cost of preparing for them is already becoming real

BeInCrypto spoke with experts from BitGo, Nethermind and the cryptography community about what that migration will actually involve — and who will end up paying for it.

Why It Matters

In March, Google researchers estimated that a sufficiently advanced quantum computer could break widely used 256-bit elliptic-curve cryptography in minutes. This is the same level of cryptography used by crypto wallets, custody systems, blockchain signatures and much of the security infrastructure used by financial institutions.

Although Q-Day might not be tomorrow, governments have started planning. Because the risk is too great to ignore. The US is budgeting billions of dollars to move federal systems to new post-quantum standards, while NIST wants vulnerable algorithms phased out by 2035.

The Quantum Risk For Crypto’s Institutional Giants

Thakur expects the user-facing cost to appear strongly at signing time, as larger payloads pass through multiparty protocols and add latency.

Details

All three of our interviewed experts agree on the same thing. Institutions need a complete record of where vulnerable cryptography is used, including signing systems, hardware, recovery procedures, authentication and long-lived keys.

Nigel Smart, who has a PHD in Computational Number Theory, describes this as a Cryptographic Bill of Materials.

“The post-quantum standards are already in place, as well as many production-ready implementations. What most organizations lack is the clear inventory, something called a Cryptographic Bill of Materials. Knowing where crypto is used in your organization, how keys are managed, and what algorithms are used.”

NIST similarly places discovery and prioritization near the beginning of the transition process.

“Institutional custody runs on threshold signing; the key is never assembled in one place. NIST standardized for implementation simplicity, compactness, and conservatism. Thresholdability was not a standardized priority. Falcon, which Solana, Algorand and now TRON have all adopted, do not have viable threshold construction today. It’s an open research problem.”

NIST opened its first formal call for multi-party threshold schemes in January 2026, while research presented at its MPTS workshop found severe efficiency penalties for threshold signing with standard hash-based signatures.

Nitin Gaur from Nethermind, an engineering firm specializing in Blockchain Infrastructure, says the same issue extends across company systems.

“Cryptographic inventory across the estate: every use of RSA, ECC and Diffie-Hellman in TLS, JWT issuance, code signing, CA roots, API authentication, firmware. It is ten to fifteen per cent of programme cost and one hundred per cent of the critical path.”

Bigger Signatures, Bigger Costs

Post-quantum security comes with substantially larger keys and signatures. NIST’s ML-DSA-65 uses a 3,309-byte signature and a 1,952-byte public key, while commonly used elliptic-curve signatures are measured in tens of bytes. Some SLH-DSA variants reach tens of kilobytes.

On blockchains, more bytes mean greater bandwidth use, higher storage requirements and potentially higher fees.

For proof-of-stake networks, Nigel Smart also points to the difficulty of aggregating standardized post-quantum signatures efficiently.

“Post-quantum signatures can be substantially larger than today’s signatures, increasing bandwidth, storage, and verification overhead. In the blockchain space, we need signatures (for the consensus layer in proof-of-stake blockchains) which can be easily aggregated (which is currently non-trivial with standardized post-quantum signatures).

Hybrid periods, where classical and post-quantum signatures run together, can compound those costs further.

The Custody Issue

Institutional custody was built around elliptic-curve cryptography, with MPC, hardware security modules, recovery procedures and approval systems designed accordingly. Changing the signature therefore requires custodians to revalidate much of the control system around the key.