A story crossed my terminal this morning with a headline that sounded like a siren: post-quantum cryptography is now a mandatory requirement for financial institutions.
That was the whole thing. Three sentences. No regulator named. No jurisdiction. No standard number. No effective date. No citation. And yet by the time I refreshed my feed, three tokens with 'quantum' in their ticker had printed green candles on the strength of a paragraph that named nothing.
We audited the silence between the lines of code. There was almost nothing there.
I have been decoding cryptographic news for twenty-five years, and I have learned to read the gaps faster than the sentences. The gap here is enormous. The word 'mandatory' is doing all the work, and it is doing it without a fingerprint — no agency, no document number, no compliance calendar, no jurisdiction. That is not a regulation. That is a mood ring.
But the mood is pointing at something real. Something that has been sitting on-chain, visible, patient, and completely unprotected since 2009. Roughly 1.7 million bitcoin in outputs whose public keys were broadcast to the world the moment they were touched. That is the story the headline was too lazy to write.
Here is the baseline, because the headline skipped it. In August 2024, NIST finalized its first three post-quantum standards: FIPS 203, which standardizes ML-KEM, built on CRYSTALS-Kyber, for key encapsulation. FIPS 204, ML-DSA, built on CRYSTALS-Dilithium, for digital signatures. FIPS 205, SLH-DSA, built on SPHINCS+, a stateless hash-based signature scheme. A fourth track, FN-DSA, derived from Falcon, remains in draft. In March 2025, NIST selected HQC as a backup key-encapsulation mechanism, with a standard expected toward the end of the decade.
That is the technical scaffolding. The regulatory scaffolding is separate and, importantly, older. The NSA published CNSA 2.0 — its Commercial National Security Algorithm Suite — back in 2022, and it is a ladder, not a switch. Software and firmware signing: migrate by 2025. Browsers, servers, and cloud infrastructure: 2025 through 2030. 'Flagship' national security systems: 2030 to 2033. Complete transition, per NSA guidance: by 2035. In Europe, DORA and NIS2 push operational resilience obligations onto financial entities without naming a single post-quantum algorithm.
So when a story says 'mandatory,' I want to know which rung of which ladder, enforced by which authority, with which deadline. The industry's actual rhythm is phased migration over a decade. 'Mandatory' compresses that into an alarm.
Before the alarmism, the distinction that everyone in the headline skipped. Quantum algorithms do not threaten all cryptography equally. Shor's algorithm collapses the public-key systems that secure blockchain — RSA, and elliptic-curve signatures like ECDSA and Schnorr — in polynomial time. That is a break, and a catastrophic one. Grover's algorithm is far gentler: it gives a square-root speedup to brute-force search, which is neutralized by simply doubling symmetric key lengths. Which means the threat map is lopsided. Your hashes are mostly fine. Your signatures are the exposed flank. And every chain that matters, from Bitcoin to Ethereum to Solana, leans on elliptic-curve signatures.
Why does this matter right now, in a bull market, in 2026? Because the balance sheets that touch crypto have changed. ETF wrappers, tokenized treasuries, regulated custodians, insurance companies with digital-asset sleeves — these are the entities that prudential regulators actually supervise. When a prudential regulator says 'cryptographically agile,' it travels down the stack into the wallets and bridges that hold the assets. That transmission channel is the only reason a cryptography story is a crypto story at all. It is also the channel the vague version of this headline completely elides.
I have translated dense regulatory language into market-actionable analysis for years. During the 2025 ETF and MiCA framework cycle I was publishing interpretive guides within hours of document drops, because institutional readers needed to act on the language faster than the language could be summarized. What I learned in that sprint is this: every press release compresses three different verbs into one. 'Shall migrate.' 'Should plan to migrate.' 'Is expected to consider migrating.' The first is law. The second is expectation. The third is a suggestion wearing a suit.
The word 'mandatory' in this story almost certainly maps to the middle verb, and probably to a phased schedule measured in years. That is not a scandal. It is how cryptographic infrastructure actually moves. You do not swap the signature scheme under a custodian's hardware security module over a weekend. You run hybrid keys side by side — classical and post-quantum — for years, watching for compatibility failures, before you cut over. Every serious roadmap I have seen, public or private, has that shape.
Which means the immediate, tradeable content of this news is close to zero, and the structural content is enormous. Hold both of those in your head at once. Most readers will only hold the first.
Now the part nobody in the headline mentioned, because it requires reading a spec sheet instead of a press release.
Bitcoin and Ethereum sign with ECDSA over secp256k1. An ECDSA signature is 64 bytes, plus a recovery byte. Schnorr, under BIP-340, is also 64 bytes. Compressed, a public key is 33 bytes. This compactness is not a detail — it is the entire reason a decentralized ledger can verify millions of signatures without collapsing under its own data weight.
Now open FIPS 204. ML-DSA-44 produces a 2,420-byte signature and a 1,312-byte public key. ML-DSA-65: 3,309-byte signatures. ML-DSA-87: 4,627 bytes. Falcon is friendlier — Falcon-512 signatures run around 666 bytes — but its floating-point arithmetic and side-channel sensitivity make it a harder engineering problem to ship safely. And the hash-based option, SLH-DSA, ranges from roughly 7,856 bytes all the way to 49,856 bytes depending on the parameter set you choose.
Run the Ethereum math. Calldata costs 16 gas per non-zero byte. A single ML-DSA-44 signature costs about 38,720 gas just to carry, before anyone verifies it. A 30-million-gas block, in calldata terms alone, holds roughly 775 of them. Compare that to 64-byte ECDSA, at about 1,024 gas. That is a thirty-eight-fold increase in the cost of being quantum-safe. Add the verification cost on top — lattice operations are heavier than a scalar multiplication — and the number gets worse.
I felt this exact friction in 2020, during the DeFi summer, when I put 50 ETH into a Uniswap V2 pool and live-tweeted every interaction. The interface was exhilarating and the gas was brutal, and that tension — delight on one side, cost on the other — is what decides which protocol primitives actually get adopted by retail. Post-quantum signatures have that same tension, magnified tenfold. The cryptography is ready. The economics are not.
Post-quantum migration is not a signature problem. It is a blockspace problem. Bitcoin's block weight, already the subject of a decade of civil war, becomes the binding constraint the moment you move off 64-byte signatures. The Bitcoin developer community has carried proposals for quantum-resistant output types precisely because everyone doing the math arrives at the same wall. On-chain verification of post-quantum signatures is possible. It is just expensive in a way the current fee market was never designed to absorb.
There is a second, uglier layer. Not all bitcoin is equally exposed. An address that has never spent reveals only a hash of its public key. An address that has spent reveals the public key itself, forever, on-chain, in a form that a sufficiently powerful quantum computer running Shor's algorithm could attack to derive the private key.
The early P2PK outputs — pay-to-public-key, the format Satoshi's own coins sit in — expose the public key directly. Estimates put the exposed, dormant supply in that category somewhere around 1.7 million BTC, including the Patoshi-era coins. Add every address that has ever moved funds, every reused address, every hot wallet that has signed a transaction, and the exposed surface is far larger than the headline number. This is where the HNDL model — harvest now, decrypt later — stops being a talking point. An adversary does not need a quantum computer today. They need the ciphertext today and the machine later. And on a public blockchain, the ciphertext is not something you have to steal. It is something anyone can read.
We audited the silence between the lines of code, and this is what the silence contains: every public key ever broadcast is a deposit slip against a future withdrawal.
I learned the shape of this lesson in 2017, during an ICO audit sprint that lasted three weeks. I was auditing an ERC-20 contract and found a critical integer overflow in the transfer function — the kind that would have drained millions. I did not route it quietly. I drafted an urgent technical breakdown and pushed it into early crypto Twitter, and the debate ignited before the public launch. That episode taught me the thing that still governs how I read stories like today's. The vulnerability that kills you is never the one in the press release. It is the one already sitting in the code, waiting for someone to look.
The exposed keys are already on-chain. They are not hypothetical. They are a ledger of them. The 'mandatory' headline is forward-looking and unsourced. The vulnerability it gestures at is backward-looking and fully sourced — it is literally the blockchain, every byte of it, since genesis.
Trace the migration surface and the cost centers get uncomfortable fast.
Wallets first. Every wallet that manages keys needs a path to a signature-agile account model, or it needs to be replaced. Hardware wallets are worse — the secure element has to hold bigger keys, verify bigger signatures, and do it inside a power budget measured in milliwatts. Some of the current silicon cannot physically do it. That is not a firmware update. That is a silicon re-spin, and silicon re-spins run on a two-to-three-year clock before you even start certification.
Bridges are the theoretical high-risk zone. Cross-chain bridges lock value on one side and release on the other, and the release is authenticated by signatures and threshold committees. Stack the lock-and-release signature burden on top of post-quantum signature bloat and you get two risks multiplied — more signatures, larger, over more exposed public keys. I have watched bridge exploits drain nine figures in a single block. Adding a signature migration on top of that is not a hardening exercise. It is open-heart surgery on a patient that keeps sprinting.
Custodians and HSM vendors sit at the center of all of it. The hardware security module is where institutional keys actually live, and PQC migration strikes its firmware, its validated key sizes, and its FIPS 140-3 certification boundary. Every one of those is slow, expensive, and re-audited from scratch. There is a clean insight here I want to make explicit: the post-quantum transition is not a cryptographic event. It is a key-management governance event wearing cryptographic clothes. The mathematics was solved in the standards bodies. The hard part is a custody policy that says the keys have not rotated in seven years and nobody wants to be the person who schedules the outage.
Here is where I am more optimistic than the doomers — and where I diverge sharply from the 'mandatory migration' framing.
There is a structural escape hatch, and it already exists. Ethereum's account abstraction, through ERC-4337 and the EIP-7702 delegate model, lets an account define its own verification logic. RIP-7212 added a precompile for the secp256r1 curve, which opened the door to hardware-backed signing on-chain. The point of all of it is signature agility: the ability to swap verification schemes without rebuilding the protocol underneath. A signature-agile account can run classical ECDSA today and ML-DSA tomorrow, side by side, hybrid, cut over when it is safe.
But I have watched this movie before, and I know how it ends for most developers. Uniswap V4 turned the DEX into programmable Lego with hooks — infinite composability, infinite footguns. The capability is real, and the complexity spike is real, and it is the complexity spike that decides adoption. Post-quantum signature modules will hit exactly that wall. Ninety percent of teams will not build their own verification logic, no matter how elegant the primitive is. They will wait for an audited, standardized, boring library, and the boring library will win.
Which produces the least glamorous and most accurate prediction in this whole piece: the winning post-quantum scheme for blockchain will not be the mathematically most beautiful one. It will be the one with the most implementations, the most libraries, the most hardware support, and the most boring institutional familiarity. ML-DSA is winning that race for exactly the same reason the OP Stack keeps winning deployments — not because it is technically superior, but because it got there first with the tools, the tutorials, and the integration grants. Standards competition is a distribution competition. I have been watching this pattern for twenty-five years. It has never once broken.
One more layer, and it is the one almost nobody prices.
Migrating the cryptographic base layer of Bitcoin and Ethereum is a public good. No single team captures the value of a chain-wide signature upgrade. The beneficiaries are everyone who holds the asset. That is the textbook definition of a public good — non-excludable, non-rival — and public goods get underfunded, unless the funding mechanism is structured to reward measurable delivery rather than committee relationships. I have said for years that the only public-goods funding mechanism I trust in this industry is the one that pays retroactively for what already shipped, because the alternative — a grants committee voting on proposals — is a nepotism engine with a governance dashboard.
The post-quantum migration is about to become the largest public-good project in crypto history, and the funding model that carries it will decide whether it happens in five years or fifteen.
Now the counter-intuitive angle, the one the retail narrative will get wrong and pay for.
The immediate beneficiaries of a post-quantum mandate are not crypto projects. They are the legacy security vendors. Thales, Entrust, Utimaco, and the FIPS validation labs. Their order books move years before any blockchain does, because the regulated entities that must migrate are banks, and banks buy HSMs, not tokens. If you are looking for the tradeable expression of 'post-quantum is now mandatory,' you are looking in the wrong market, and the crypto-native version of the trade is mostly a relabeled narrative.
The second contrarian point is harder and more useful. Q-Day is a hardware milestone, not a press release. The timeline is set by logical qubit counts and error-correction thresholds, not by how loud a headline is. There have been multiple 'quantum panic' cycles in this industry, and Q-Day has slipped past every one of them. The cryptography community's honest answer — a cryptographically relevant machine in ten to twenty years, uncertain — has not changed because a paragraph said 'mandatory.' When you see a quantum-resistant token pump on this story, you are watching people buy a mood ring at the price of a watch.
We audited the silence between the lines of code once more, and the silence is louder than the announcement. Three sentences, no names, no dates — that is not a regulatory event. That is a trend signal wearing a regulatory costume.
Watch three things and ignore everything else.
First, primary documents. NIST and CNSA pages, not press summaries. If a real enforcement date exists, it will have a document number, and the story that cited none did not have it. Second, the hardware curve — logical qubits and error correction, tracked honestly, not the headlines. Third, the first custodian that publishes a signature-agility roadmap with dates attached to it.
The headline said 'mandatory.' The code says 'eventually.' The distance between those two words is where the next round of narrative inflation gets sold to people who did not count the bytes.