The post-quantum signature NIST finalised runs 72 times the bytes of today's ECDSA

The bill is denominated in bytes. A compact secp256k1 ECDSA signature is about 64 bytes and the ML-DSA-87 parameter set NIST finalised is about 4,627 ^[10][11], so the same authorisation arrives roughly 72 times heavier ^[16], and standardisation added rather than shaved, landing about 32 bytes above the older Dilithium-5 figure of 4,595 ^[17]. Cryptopolitan notes that signature size feeds directly into storage, bandwidth and transaction cost ^[12].

That ratio is why the custodian's version of this problem is the manageable one. The G7 tells organisations to identify critical systems and buy quantum-safe products during upgrades they had already scheduled ^[13], which is a procurement preference rather than a capital project, or rather a cost that hides inside a refresh cycle nobody itemises until a vendor cannot meet the clause.

The chains' timetables, by contrast, read like engineering. BIP-360 would remove Taproot's quantum-vulnerable key-path spend and has no activation date ^[6], and Decrypt points out that a change of that size needs broad support from developers, miners, businesses and users, plus a way for holders to move funds off vulnerable addresses without disrupting the network ^[8]. Vitalik Buterin's February 2026 roadmap names four components to replace, validator BLS signatures, KZG commitments, ECDSA account signatures and application-layer zero-knowledge proofs, with core post-quantum infrastructure targeted for 2029 ^[7], which sits one year inside the EU's requirement that high-risk systems migrate before 2030 ^[18]. Solana researchers say its EdDSA signatures give it a simpler path, and the Solana Foundation has tested post-quantum signatures on a test network and added an optional hash-based vault ^[14].

The dates on the calendar bind member states, not exchanges. The European Commission wants transition begun by the end of 2026 and high-risk systems migrated before 2030 ^[9], and that first mark falls about four months after the September 3 report ^[19]. The belt that reaches a private custodian is purchasing: the G7 asks governments to write quantum security into procurement requirements alongside research and national strategies ^[5], and Cryptopolitan's reading is that firms without a migration plan meet compliance and competitive friction as those clauses spread ^[20].

The reading the evidence supports is that a custodian's near-term expense is inventory and compatibility testing rather than cryptography, and that the number likely to surprise people is the fee arithmetic on 72x signatures once some chain actually activates one, rather than the migration budget. The counter-thesis is that the exposure is already dated. The G7's own phrase is "harvest now, decrypt later" ^[3], and on a public ledger the harvesting step is free, because keys and transaction history stay visible indefinitely ^[15]; if that is the binding constraint, anything with a long secrecy life has already been taken, and every schedule above is about limiting new exposure rather than protecting what is on chain now.