Executive Summary
Post-quantum cryptography (PQC) is increasingly framed as a straightforward technical upgrade: pick a new signature scheme, update the codebase, and declare the network “quantum-safe.” However, that framing is dangerously incomplete, especially for blockchains and digital assets.
PQC is best understood as a forced migration program
For digital assets, PQC is best understood as a forced migration program with three systemic consequences:
Churn risk: PQC will not be “one-and-done.” Standards, implementations, and threat models will evolve. Betting an ecosystem on a single, irreversible cryptographic choice creates “Black Swan” exposure.
Interoperability and fragmentation risk: Ecosystems do not upgrade in lockstep across chains, wallets, custody, exchanges, apps, and jurisdictions. Hard forks are coordination events; failed coordination can strand assets, fracture liquidity, and undermine trust.
Economic risk (“PQC tax”): PQC can increase transaction-layer overhead, impacting throughput, fees, node costs, and decentralization - turning an “upgrade” into an capital-intensive infrastructure rebuild.
Cryptographic Control Layers: The Essential Infrastructure for a Post-Quantum World
Why “Pick a PQC Signature and Move On” Is a Risky, One-Shot Bet
Most PQC debates still start with “when.” For digital assets, the question is how we migrate safely during the transition window.”
That’s why a dominant narrative in PQC discussions is reassuringly simple - “We will pick a post-quantum signature for everyone, publish a roadmap, swap out ECC, and move on.”
This narrative hides a major systemic risk: single-choice concentration resulting in Black Swan exposure.
If an ecosystem standardizes on one “forever” PQC signature scheme, it concentrates risk in one place. If that choice later develops cracks - through new cryptanalysis, side-channel weaknesses, implementation failures, parameter changes, or standards shifts - the risk is not merely a broken feature. It is in the security model itself. And history repeats itself.
PQC will be no different. In fact, it is likely to be even more dynamic, because real-world implementations are still maturing, and global adoption will introduce regional divergence and policy-driven requirements.
In other words: the winning strategy is not the perfect selection. It is crypto agility (CRAG) - the capability to adopt stronger options over time, support coexistence during transitions, and avoid a single irreversible choice that requires synchronized global upgrades.
What is QFlex designed for
That’s why BOLTS designed QFlex to reduce “one-shot” concentration risk by supporting all cryptographic options, so ecosystems can evolve their security posture without betting everything on a single irreversible choice, and more importantly, place the choice of cryptography at the wallet layer per transaction.
Institutional Lag: The Transition Window Is the Real Attack Surface
Institutions can’t “flip cryptography overnight.” They operate at the speed of compliance, committees and audits.
This means cryptographic risks can change quickly, while institutional systems and decision-making cannot.
The result is a dangerous asymmetry: the gap between a technical need and an institutional response becomes the real attack surface.
This is also why quantum risk has become a capital-markets issue. Investment committees will ask:
“What happens to assets during the transition?”
“How does the ecosystem prevent fragmentation?”
“What operational controls exist to manage the migration risk?”
“What’s the cost, and does it change unit economics?”
If the answers are vague, the risk becomes an adoption blocker. That’s why QFlex masters the transition window to provide the controls and auditability expected by risk teams.
What QFlex Masters
If the answers are vague, the risk becomes an adoption blocker. That’s why QFlex masters the transition window to provide the controls and auditability expected by risk teams.
The PQC Tax: How PQC Changes Blockchain Unit Economics
Post-quantum cryptography can materially increase the data attached to transactions, creating a “PQC tax” that shows up as higher bandwidth consumption, higher storage requirements, and greater compute and validation overhead.
You don’t need to understand cryptography to understand the consequence: on-chain bytes are economics.
How the tax cascades
When transaction payloads expand, effects ripple through unit economics:
Fees and UX: If blockspace becomes more scarce, fees rise. Everyday transactions become less viable, and user experience degrades.
Throughput and propagation: If block size remains constant, throughput falls. If block size grows to compensate, propagation and bandwidth costs rise - creating centralization pressure.
Node/validator cost and decentralization: Storage and networking are recurring costs. Increased overhead raises the barrier to operating nodes and validators, consolidating participation over time.
Downstream ecosystem cost: The tax is not limited to the chain. Wallets, custody providers, exchanges, bridges, compliance systems, analytics, and archives inherit the overhead. Increased overhead is usually passed on to the transactor by blockchain ecosystems either implicitly or explicitly.
How QFlex Helps
The crypto-agility capability provided by QFlex helps alleviate this PQC Tax in 2 ways:
Transaction level PQC-choice allows efficient selection of cryptography based on the level of protection a transactor desires on that one transaction, be it value-based or otherwise. In other words, a crypto transaction to buy a cup of coffee can use the smallest & fastest PQC signatures thus requiring minimal overhead for the ecosystem to process.
Different blockchains using QFlex allow for heterogeneity of PQC algorithms across transactions, thereby bypassing any negative effects that might be caused by monolithic selection of a high overhead digital signature. This heterogenous ability to assimilate any cryptography per transaction allows blockchains to offer user-selected protections while minimizing blockchain differences based on system wide PQC choices.
The Need for a New Category: A Cryptographic Control Layer Built for Change
This is the core market gap, as most solutions focus on implementing a new cryptographic primitive. But digital assets need a way to operate through migration - safely, repeatedly, and without relying on perfect coordination.
We’re validating these assumptions in real-world environments, including early pilot work with Canton, where adoption, interoperability, and cost constraints are operational - not theoretical.
That is why BOLTS Technologies offers crypto agility (CRAG) - a cryptographic control layer built for change, and not “yet another PQC library.”
Why a control layer is a different category
A library helps developers implement an algorithm. But a control layer is designed to help ecosystems manage the realities of forced migration through:
staggered adoption across participants,
coexistence of multiple schemes,
policy-driven selection,
and auditability for institutional stakeholders.
As such, boards and investors looking for defensible categories should note that the winners will be the platforms that help ecosystems navigate multiple transitions without breaking.
The Value Proposition
This is the real value proposition of CRAG: reducing systemic risk as digital assets may undergo repeated cryptographic transitions due to new cryptographic vulnerabilities, compliance mandates, or institutional/customer preferences.
Conclusion: The Question That Matters
Quantum computing timelines may be uncertain. But the industry’s need to migrate their cryptography is increasingly inevitable. For digital assets, PQC is not primarily an algorithm selection exercise - it is a forced migration program that stresses interoperability, governance, operational readiness, and economics.
The real boardroom question is not: “When will quantum break crypto?”
It is: “Will my ecosystem respond to changing cryptographic demands at the speed of relevance while minimizing my costs?”
The market will reward solutions that treat cryptography as a living control plane - capable of staged adoption, coexistence, auditability, and repeated change - rather than a one-time patch.
Post-quantum crypto is a migration problem first - and a cryptographic control layer built for change is becoming essential infrastructure.