The $7 Billion Race to Save Crypto From Quantum Computers

Despite the rumors and fear-mongering, Quantum computers are still years away from threatening today’s financial systems. But the cost of preparing for them is already becoming real

In March, Google researchers estimated that a sufficiently advanced quantum computer could break widely used 256-bit elliptic-curve cryptography in minutes. This is the same level of cryptography used by crypto wallets, custody systems, blockchain signatures and much of the security infrastructure used by financial institutions.

Although Q-Day might not be tomorrow, governments have started planning. Because the risk is too great to ignore. The US is budgeting billions of dollars to move federal systems to new post-quantum standards, while NIST wants vulnerable algorithms phased out by 2035. 

The transition is much harder for crypto. Assets worth billions can sit untouched for decades, old wallets may never be upgraded, and institutional custody systems were built around cryptography that quantum machines are expected to break. 

BeInCrypto spoke with experts from BitGo, Nethermind and the cryptography community about what that migration will actually involve — and who will end up paying for it.

Bitcoin's Quantum threat is a PR problem, not a technical one. That's according to Oxford computer scientist @StefanoGogioso. Even if 75% of all crypto is quantum-resistant, the moment one Satoshi-era coin moves, the market could lose trillions. If there's 1% chance that… pic.twitter.com/GMIeEK3s83

— BeInCrypto (@beincrypto) July 23, 2026

The Quantum Risk For Crypto’s Institutional Giants

All three of our interviewed experts agree on the same thing. Institutions need a complete record of where vulnerable cryptography is used, including signing systems, hardware, recovery procedures, authentication and long-lived keys.

Nigel Smart, who has a PHD in Computational Number Theory, describes this as a Cryptographic Bill of Materials.

“The post-quantum standards are already in place, as well as many production-ready implementations. What most organizations lack is the clear inventory, something called a Cryptographic Bill of Materials. Knowing where crypto is used in your organization, how keys are managed, and what algorithms are used.”

NIST similarly places discovery and prioritization near the beginning of the transition process.

For Akshay Thakur from BitGo, institutional custody introduces another critical requirement.

“Institutional custody runs on threshold signing; the key is never assembled in one place. NIST standardized for implementation simplicity, compactness, and conservatism. Thresholdability was not a standardized priority. Falcon, which Solana, Algorand and now TRON have all adopted, do not have viable threshold construction today. It’s an open research problem.”

NIST opened its first formal call for multi-party threshold schemes in January 2026, while research presented at its MPTS workshop found severe efficiency penalties for threshold signing with standard hash-based signatures.

Nitin Gaur from Nethermind, an engineering firm specializing in Blockchain Infrastructure, says the same issue extends across company systems.

“Cryptographic inventory across the estate: every use of RSA, ECC and Diffie-Hellman in TLS, JWT issuance, code signing, CA roots, API authentication, firmware. It is ten to fifteen per cent of programme cost and one hundred per cent of the critical path.”

The White House just confirmed it: The U.S. is going all-in on Quantum tech. 🇺🇸Now that it's official, the crypto market needs to have a serious conversation about post-quantum cryptography.If quantum computers arrive sooner than expected, billions in exposed bitcoin:native… https://t.co/1FaLyh9EgV pic.twitter.com/sU6GUywZLM

— BeInCrypto (@beincrypto) June 22, 2026

Bigger Signatures, Bigger Costs

Post-quantum security comes with substantially larger keys and signatures. NIST’s ML-DSA-65 uses a 3,309-byte signature and a 1,952-byte public key, while commonly used elliptic-curve signatures are measured in tens of bytes. Some SLH-DSA variants reach tens of kilobytes.

On blockchains, more bytes mean greater bandwidth use, higher storage requirements and potentially higher fees. 

For proof-of-stake networks, Nigel Smart also points to the difficulty of aggregating standardized post-quantum signatures efficiently.

“Post-quantum signatures can be substantially larger than today’s signatures, increasing bandwidth, storage, and verification overhead. In the blockchain space, we need signatures (for the consensus layer in proof-of-stake blockchains) which can be easily aggregated (which is currently non-trivial with standardized post-quantum signatures). 

Thakur expects the user-facing cost to appear strongly at signing time, as larger payloads pass through multiparty protocols and add latency. 

Hybrid periods, where classical and post-quantum signatures run together, can compound those costs further.

The Custody Issue

Institutional custody was built around elliptic-curve cryptography, with MPC, hardware security modules, recovery procedures and approval systems designed accordingly. Changing the signature therefore requires custodians to revalidate much of the control system around the key.

Gaur says MPC offers no quantum resistance by itself.

“MPC distributes the computation but does not change the algorithm: threshold ECDSA across five parties is still ECDSA. A quantum computer derives the private key from the public key alone, so it does not need to compromise any party and does not care how many there are. Every dollar spent distributing trust across signers buys exactly zero quantum resistance, and that is not well understood inside institutions that believe their custody is state of the art.”

Nigel Smart says some of the hardest systems to upgrade will be wallets, custody infrastructure and smart contracts already controlling assets.

Bitcoin shows why the clock matters. A June 2026 report estimated that around 1.7 million BTC still sit in early addresses where public keys are already exposed. 

Many of those coins may never move, leaving them vulnerable if quantum computers become powerful enough before the network completes its migration.

How does Satoshi prove they're Satoshi after quantum computers arrive?According to @danboneh, the answer is leaving a cryptographic note onchain today, then opening it in 100 years. https://t.co/1aRjihHSoW pic.twitter.com/A0qEGU7gac

— a16z crypto (@a16zcrypto) August 28, 2026

Who Pays for the Migration? 

Smart expects responsibility to be divided between protocol developers, custodians, service providers and asset owners, since each group controls a different part of the migration.

Gaur instead argues for a central budget with senior ownership. 

“Centrally funded, CISO owned, CFO approved multi-year line, governed the way Y2K and LIBOR were. No business line will volunteer budget for a programme with no revenue and no customer asking, and funded that way it will not happen.”

Public blockchains are harder to govern because there is no single budget holder capable of forcing every participant to upgrade. A custodian can replace its own signing systems, yet it cannot compel dormant asset owners to move funds or impose consensus changes across an entire network.

Internet security shows that large migrations can still begin early. By April 2026, Cloudflare reported that more than two-thirds of human-generated TLS traffic reaching its network already used post-quantum protection.

An Unpriced Cost

Crypto still lacks a credible industry-wide estimate. Thakur outlined where the biggest costs are likely to fall.

“Most of the cost isn’t cryptography. It’s inventory and dependency mapping. It’s hardware that can’t be upgraded and has to be replaced. It’s running classical and post-quantum systems in parallel while you prove the new one preserves every control. It’s re-auditing and re-certifying. And there’s one category with no precedent in any previous cryptographic migration: paying on-chain transaction fees to move assets, at post-quantum signature sizes, on chains where those larger signatures have themselves pushed fees up.”

Nigel Smart commented on the timeline for such a migration. 

“The transition is likely to take years rather than months, making early inventory, testing, and staged migration preferable to a last-minute upgrade. However, many governments and large companies have brought forward their timelines for transition quite aggressively over the last few months.”

The dates already give institutions enough to budget against. Ethereum is aiming for core post-quantum protections around 2029, while NIST’s transition timetable extends through 2035. 

The uncertainty lies in when cryptographically relevant quantum hardware arrives, while procurement cycles, hardware replacement and custody redesign already operate on timelines measured in years.