Skip to research

EternaX Research · Institutional Custody Decision Framework

Post-quantum digital-asset custody

The Custody Stack Is Being Rebuilt. Which Architecture Survives the Post-Quantum Transition?

HSM, MPC, threshold post-quantum signatures, native hash-based designs and crypto-agile authorization—what institutions gain, what they give up, and what survives the migration.

Authors

Paarrthhh Birla · Dariia Porechna · Dr. Chen Feng

Companion paper: The Native-Signature Boundary in Post-Quantum Distributed Authorization (arXiv:2609.03547)

Read the decision question Read the paper FAQ

Institutional custody is moving on-chain while the cryptography securing ownership is entering its largest migration in decades. The decision is no longer simply HSM vs MPC. It is which custody architecture can protect assets today and still survive the next signature transition without forcing the institution to rebuild its control system.

Decision question

When ECDSA or EdDSA changes, what else must change with it? The winning architecture is the one that preserves the right institutional controls—policy, quorum, recovery, auditability and operating continuity—while minimizing cryptographic migration risk.

$318.5TGlobal equity + fixed-income securities base in 2025.17

$5.5TCiti 2030 base case for tokenized financial assets.18

$3.2B/yrIllustrative annual custody/control revenue at 10% penetration and 1 bp.

$31.9B/yrIllustrative long-run annual run-rate at 1 bp across $318.5T.

The architecture decision is being made before the migration is complete. The custody stack chosen now can become embedded beneath trillions of dollars of tokenized assets. Its cryptographic migration model therefore matters as much as its security model today.

Key findings

Post-quantum support is not the same as crypto agility. A custody platform may verify a PQ signature without being able to generate it under the same distributed-key, approval and recovery architecture.
Three properties organize the design space. Native-signature compatibility, unilateral-signing resistance and threshold-layer agility; across surveyed families, no design gets all three at once—an architectural tension, not an impossibility claim.16
The decisive metric is the migration impact surface. Institutions should ask which DKG, shares, signing, refresh, recovery, policy and evidence components change when the signature family changes.
HSM and MPC solve different trust problems. HSM-first custody can maximize native compatibility and operational maturity; threshold/MPC designs can avoid concentrating the complete native signing key.
Programmability changes the design space. If the enforcement layer can evaluate richer authorization, threshold approval no longer has to be encoded as one native signature; this creates the opening for crypto-agile institutional authorization.

Audience · CTO / CISO / Digital Assets / Custody Evidence · primary sources + cryptographic research Technical review · arXiv:2609.03547 · 7 September 2026

The problem · Define post-quantum custody correctly

02 / 08

Post-quantum custody is not a signature checkbox. It is a control-plane migration problem.

A blockchain may support a post-quantum verifier while the custodian is still unable to generate that signature under its existing key-sharing, approval and recovery model. These are different problems.

NIST defines crypto agility broadly: cryptographic algorithms must be replaceable across protocols, applications, software, hardware, firmware and infrastructure while security and operations continue.1 Custody needs the same discipline at the authorization layer.

Verification.Can the destination verify the new signature?

Signing.Can the custody system actually produce it?

Native-signature compatibility.Does the destination receive exactly one signature accepted by its unchanged native verifier, without a modified verification rule?

Unilateral-signing resistance.Throughout setup and operation, can fewer than the threshold of authorization parties—and can any single participant, dealer or trusted complete-key component—produce an accepted authorization alone?

Threshold-layer agility.Can the member-signature scheme change without replacing the threshold relation, threshold-specific protocol or threshold secret state?

Migration impact surface.Which components’ implementation, persistent state, wire semantics, trust assumptions, failure procedures or security arguments must change with the scheme?

The metric that matters: migration impact surface

The useful question is not “does your API support ML-DSA?” It is: when ECDSA changes, what else has to move?

A signature migration can touch distributed key generation, participant shares, preprocessing, signing interaction, combination, refresh, recovery, policy state, historical evidence and integration. A stable sign(message) API may hide a complete replacement of the custody protocol underneath it.

The companion paper defines this as the migration impact surface: the set of components whose implementation, persistent state, wire semantics, trust assumption, failure procedure or security argument must change with the scheme.16 It is end-to-end—destination-verifier and interface changes count—and the composition of the set matters more than its size.

PQ support is not crypto agility. A replaceable API alone does not make distributed authorization cryptographically agile.

Why this becomes a business problem

At small scale, a custodian can replace infrastructure. At tens of trillions of dollars of assets under control, repeated cryptographic rebuilds become a strategic operating risk. The winning custody architecture is therefore not only the one that is secure today; it is the one whose control model remains understandable and operable through repeated cryptographic change.

Market terminology. $318.5T is the underlying securities asset base. $31.9B/year is an illustrative recurring revenue run-rate at 1 bp in a full-penetration scenario—not today's market size and not a forecast of universal pricing.

Current landscape · What institutions have actually built

03 / 08

The incumbent custody market is credible. The problem is what happens when its cryptography changes.

The relevant benchmark is not whether existing custody platforms are secure today—they are. The relevant question is whether the control architecture can remain stable when the native signature family changes. This report therefore separates leading custody reference incumbents from the banks integrating those systems.

01

Coinbase Prime / Coinbase Custody

Scale reference. Coinbase Institutional currently reports approximately $300B of assets under custody, 470+ assets supported for custody and about 11% of global crypto market capitalization under custody. Its U.S. custody offering includes Coinbase Custody Trust Company, an NYDFS-regulated qualified custodian.20 21

PQ question: how does a very large regulated cold-custody estate migrate signing and recovery controls as chains adopt different PQ authentication paths?

02

BitGo

Regulated custody + tokenized-securities reference. BitGo reported approximately $65.2B of assets on platform and 5,833 clients at June 30, 2026. BitGo Bank & Trust is OCC-regulated and already provides qualified custody for tokenized securities such as YLDS; BitGo also participated in DTCC's tokenized-securities infrastructure demonstration.22 23

PQ question: how should a platform spanning multi-signature, cold storage, regulated bank custody and tokenized securities isolate cryptographic migration from product operations?

03

Fidelity Digital Assets

TradFi-native custody reference. Fidelity Digital Assets operates an institutional custody and trading platform with offline cold-vaulted storage, multi-tier approval and multi-site storage. Fidelity Digital Assets, National Association received an OCC national trust bank charter in 2025.24

PQ question: how can an institution preserve mature cold-custody controls while changing the cryptographic primitive underneath asset authorization?

04

Anchorage Digital Bank

Federally chartered digital-asset bank reference. Anchorage Digital Bank operates as a federally chartered digital-asset bank and qualified custodian, combining custody with institutional governance, compliance, trading, staking and on-chain participation.25

PQ question: how does an integrated regulated-bank control model preserve authorization continuity as signature standards change?

05

Fireblocks

Custody-infrastructure reference—not the same legal category as a qualified custodian. Fireblocks provides MPC-CMP wallet and custody infrastructure, programmable policy and settlement connectivity to banks and financial institutions. Its current documentation exposes MPC ECDSA/secp256k1 and MPC EdDSA/Ed25519, while Fireblocks has publicly identified PQC and suitable MPC constructions as an active strategic priority.26 5 9

PQ question: when the native signature changes, how much of DKG, share state, distributed signing and recovery can genuinely remain unchanged?

Why these five?They give the most useful institutional reference set across scale, regulated custody, bank-grade operations and MPC custody infrastructure. This is not a claim that they are the five largest providers by one comparable AUC metric.

Two additional architecture comparators matter disproportionately

Copper · MPC custody

Copper's qualified-custody product explicitly uses proprietary MPC and states that a complete private key is never created. It is therefore a useful independent comparator for the distributed-key custody thesis.27

Taurus · HSM-first PQ thesis

Taurus publicly argues that HSM architecture offers the more practical path to PQ signature agility and that MPC requires new threshold protocols for new signature families. The article retains Taurus because this is the strongest public counter-thesis to crypto-agile authorization-layer approach.10

Then separate the banks building or integrating custody

Institution	Public custody direction	What remains undisclosed	Why it matters to the PQ decision
State Street	Selected Taurus-PROTECT, Taurus-CAPITAL and Taurus-EXPLORER; later disclosed production integration including Hyperledger Besu connectivity.4	Detailed production signing configuration.	Shows a major securities custodian standardizing an institutional digital-asset stack around an external custody platform.
BNY	Institutional digital-asset custody with disclosed Fireblocks and Chainalysis integration; BNY links digital custody to tokenization, payments and collateral workflows.12 13	Exact bank signing architecture and key-state boundary.	Demonstrates how custody becomes part of a broader asset-servicing control plane.
HSBC	Selected Metaco Harmonize for institutional digital-asset custody focused initially on tokenized securities.11	Exact production key backend and signing protocol.	Directly links custody architecture to the tokenized-securities market rather than only crypto-native assets.
Citi	Citi expects digital-asset custody later in 2026 on a common digital-asset architecture.2	Production signing stack.	An unusually important design window: the control plane is being built while PQ migration requirements are becoming clearer.
Standard Chartered / Zodia	Standard Chartered has an accepted offer to integrate Zodia Custody's regulated custody activities into the bank.3	Sufficient detail to characterize the future signing protocol.	Integration is a natural point to review how long-lived custody controls survive cryptographic migration.

The competitive deduction

The incumbent market already offers serious answers for safekeeping, native signing, regulated custody and distributed key control. The unresolved question is different: how much of the custody architecture must be rebuilt when the cryptographic primitive changes?

The choices · Surveyed post-quantum authorization families

04 / 08

Five surveyed authorization families. Each places scheme dependence differently—and none gets every property at once.

Before selecting a post-quantum custody architecture, institutions should separate the native-output routes from programmable authorization. The companion paper classifies specialized threshold signatures, generic MPC signing, distributed hash-based constructions (including PRAWNS), programmable multisignature / dual-gate authorization, and threshold-authorized HSM signing under three definitions: native-signature compatibility, unilateral-signing resistance and threshold-layer agility.16

A

Threshold-authorized HSM signing

What it optimizes. Native output with a comparatively stable approval gate; certification and operational maturity around a hardware-held key.

Paper placement. Native: yes. Unilateral-signing resistance: no (complete key in the trusted signer). Threshold-layer agility: yes—the approval gate may remain while the HSM key and signing implementation change.

Best when. Unchanged native verification is mandatory and a complete native key inside certified hardware is acceptable.

B

Specialized threshold post-quantum signatures

What it optimizes. One native signature with no complete private key held by one participant.

Paper placement. Native: yes. Unilateral-signing resistance: yes* (requires dealerless DKG). Threshold-layer agility: no—DKG, shares, signing logic, refresh and recovery stay tied to the native signing relation.

Best when. The verifier is fixed and distributed custody of the native key is non-negotiable.

C

Generic MPC of the signing function

What it optimizes. Distributed native-key custody while reusing a general secure-computation engine.

Paper placement. Native: yes. Unilateral-signing resistance: yes*. Threshold-layer agility: no—the signing circuit and native key shares still move with the algorithm. An MPC engine that can evaluate several circuits is engine agility, not threshold-layer agility.

Best when. Native signing is required and the institution accepts cryptographic-state migration beneath a stable MPC service layer.

D

Distributed hash-based constructions (incl. PRAWNS)

What it optimizes. Distributed control while retaining an ordinary hash-based signature for the unchanged verifier.

Paper placement. Native: yes. Unilateral-signing resistance: conditional (PRAWNS leaves DKG unresolved). Threshold-layer agility: no—the distributed computation remains tied to the hash-based signing relation; changing to ML-DSA or another family still changes that computation.

Best when. Native hash-signature output is the primary constraint and the institution can wait for research maturity.

Empty cell. Across the surveyed families, no design simultaneously provides native output, unilateral-signing resistance and threshold-layer agility. That is an architectural tension in the classification, not a general impossibility theorem.16

The question the native-output routes leave behind

Why should institutional authorization have to change when the signature changes?

The native-output families above primarily optimize how the next native signature is produced. A different architecture becomes possible when the destination can verify a different authorization relation: programmable multisignature or dual-gate authorization (native: no; unilateral-signing resistance: yes; threshold-layer agility: yes).

The EternaX approach

Make existing custody authorization post-quantum safe—without replacing the custodian or moving the assets.

EternaX is designed to integrate underneath existing MPC, HSM and Safe-style custody. The custodian, chain, asset venue and operating model can stay in place while EternaX adds a post-quantum authorization layer using SLH-DSA / SPHINCS+ approvals and signature-agnostic threshold authorization.28

Keep the custodianKeep the custody workflowKeep the asset venueAdd PQ-safe authorization

Stress test · What actually changes when ECDSA changes

05 / 08

The comparison changes when the buyer asks what must survive the migration.

Suppose an institution moves from threshold ECDSA to ML-DSA or SLH-DSA. The destination must support the new verifier—but the custody system must separately become capable of generating, authorizing, recovering and evidencing the new artifact.

For a threshold-authorized HSM, the principal cryptographic change can be contained around the hardware-held native key and signing implementation, while the approval gate may remain. The trade-off is unilateral-signing resistance: compromise of the HSM key-use boundary creates a unilateral signer.

For specialized threshold signatures, the move can replace distributed key generation, shares, signing logic, preprocessing, combination and refresh because those mechanisms are derived from the native signing equation. This preserves native output with unilateral-signing resistance (when DKG is dealerless), but it has no threshold-layer agility.

Generic MPC localizes more of the scheme dependence into a signing circuit, but the native key shares, validation and performance characteristics still move with the algorithm—so the MPC engine may remain while the threshold layer does not satisfy Definition 3. Distributed hash-based constructions such as PRAWNS keep the blockchain-facing artifact native but remain specialized; unilateral-signing resistance is conditional while DKG stays unresolved. Dual-gate / signature-agnostic authorization moves in the opposite direction: it gives up inherent legacy-native output so that threshold authorization state can remain independent of the member-signature family.

Paper / institutional criterion	HSM	Threshold PQ	Generic MPC	PRAWNS-style	EternaX dual-gate
Native-signature compatibility	Yes	Yes	Yes	Yes	No · translator / programmable verifier restores destination fit
Unilateral-signing resistance	No · complete key in signer	Yes*	Yes*	Conditional · DKG unresolved	Yes
Threshold-layer agility	Yes · approval gate may remain	No	No · engine agility ≠ Def. 3	No	Yes · design objective
Mixed classical + PQ migration	Policy-dependent	Not inherent	Possible at circuit level	Not core objective	Yes
Avoid full custody re-platforming	Usually	May require signer rebuild	May require signer rebuild	New specialized signer	Core integration model
Primary buyer outcome	Hardware-backed native signing	Distributed native signing	Reusable MPC engine	Native hash-signature compatibility	Authorization continuity

*Dealerless DKG. The companion paper marks unilateral-signing resistance for specialized threshold and generic MPC as conditional on dealerless distributed key generation across the complete lifecycle.16

The difference is simple: the other architectures primarily optimize how the new signature is generated. EternaX optimizes how little of the institution has to change when cryptography changes.

Maturity discipline. “Cryptographically constructible,” “standard-compatible,” “implemented,” “benchmarked,” “audited,” “certified,” “integrated into custody” and “production” are different claims. The framework deliberately keeps them separate.

Decision · Let the requirements choose the architecture

06 / 08

For programmable institutional custody, EternaX should be the default control-plane architecture.

A bank should not start with “which vendor should we use?” It should start with the boundary conditions of the asset and the trust model.

1. Does the destination require exactly one native signature?

If yes, the choice set narrows to architectures that can emit that artifact directly: HSM signing, specialized native threshold signing, generic MPC or specialized constructions such as PRAWNS.

2. Can a complete native key exist inside certified hardware?

If yes, an HSM-first architecture is extremely compelling: native output, high operational maturity and a comparatively stable approval layer. If no, distributed native-key custody becomes the dominant constraint.

3. Is the asset-control layer programmable?

If the account, vault, issuer module or policy layer can evaluate richer authorization, the system no longer has to force threshold approval to masquerade as one native signer.

4. Is long-term cryptographic migration a first-class requirement?

If the institution wants the authorization system to survive ECDSA → PQ and the migration after PQ, the degree of signature-family coupling becomes a core architectural criterion.

Where each route legitimately wins

HSM-first wins when current operational maturity, certification and native output matter more than unilateral-signing resistance—i.e., a complete key inside trusted hardware is acceptable.

Native threshold signing wins when the destination is fixed, one native signature is mandatory and no complete key may exist in any one component (accepting no threshold-layer agility).

Generic MPC wins when the institution needs distributed native signing but wants to reuse a general secure-computation engine across algorithms and accepts that circuit and native key-state migration are still part of the impact surface (engine agility ≠ threshold-layer agility).

PRAWNS-like research matters where a fixed verifier and hash-based native artifact are non-negotiable, and the institution is willing to adopt a specialized construction when DKG and related research mature.

Dual-gate / signature-agnostic authorization wins a different problem: programmable institutional custody in which the buyer prioritizes stable governance, mixed classical/PQ transition and threshold-layer agility across repeated signature migrations—at the cost of inherent legacy-native output unless a separate translator or programmable verifier is used.

PRIMARY OUTCOMEMake custody authorization PQ-safeProtect custody approvals with standardized post-quantum signatures while retaining the existing custody provider and operating model.

OPERATIONAL OUTCOMENo custody re-platformingKeep the MPC, HSM or Safe-style custody stack; integrate a post-quantum authorization layer underneath it.

MIGRATION OUTCOMENo big-bang cutoverSupport staged classical/PQ migration so participants can move at different times.

ARCHITECTURAL OUTCOMEAuthorization continuityKeep policy, quorum, evidence and authorization state separate from the member-signature family.

ECONOMIC OUTCOMELower migration cost and riskReduce the components, ceremonies and operating procedures that must be rebuilt during future algorithm changes.

Decision rule. If the institution has programmable enforcement and wants its existing custody stack to become post-quantum safe without a full re-platform, EternaX is the natural authorization architecture. If one unchanged native signature is mandatory and no programmable authorization layer exists, HSM or native threshold/MPC remains the more natural fit.

What EternaX can make PQ-safe today

Custody signing and approval workflows first; EVM asset authorization can be protected as well.

Across custody stacks: EternaX can make custody signing and custody approval workflows post-quantum safe when integrated by the custody provider.28

Ethereum / EVM: PQ Vault can additionally require post-quantum verification before on-chain asset movement. With PQ Custody SDK + PQ Vault, three of four identified risk layers can be protected; base-layer consensus remains a chain-level risk.28

Solana, Canton and Stellar: EternaX can harden the custody control layer, while native transaction authorization and consensus remain residual chain-level risks until those networks upgrade.28

Principal exception. If an unchanged fixed verifier requires one native signature and no programmable authorization layer is available, HSM or native threshold/MPC remains the more natural choice.

Map these requirements to EternaX's custody integration model. Explore custody architecture →

The deduction · Crypto-agile institutional authorization

07 / 08

EternaX is the post-quantum authorization layer for the custody stack you already use.

The customer does not have to buy a new custodian to gain post-quantum custody authorization. EternaX is designed as an integration layer beneath existing MPC, HSM and Safe-style custody, with SLH-DSA / SPHINCS+ member approvals and a threshold authorization layer that is separate from the member-signature family.28

EXISTING CUSTODY STACKMPC · HSM · Safe · bank custodyExisting provider, workflow and asset venue stay in place

→

ETERNAX PQ AUTHORIZATIONSLH-DSA approvals + threshold authorizationPQ Custody SDK · mixed classical/PQ migration · crypto-agile rotation

→

AUTHORIZED EXECUTIONExisting custody continues operatingPQ Vault can extend protection to EVM on-chain asset authorization

Make custody authorization PQ-safe. Protect institutional approvals using NIST-standardized SLH-DSA / SPHINCS+ without requiring the existing custodian to be replaced.28

No custody re-platforming. The existing MPC, HSM or Safe-style custody stack, operational workflow and asset venue can remain in place.28

No big-bang migration. Mixed classical/PQ quorums allow staged migration rather than a synchronized flag day.28

Keep authorization through the next algorithm change. Member-signature rotation is separated from the threshold authorization layer, narrowing the future migration impact surface.28

Know exactly what remains exposed. EternaX explicitly separates custody-layer protection from residual base-layer chain risks rather than claiming the underlying network is fully quantum-safe.28

The natural selection

For programmable institutional custody, EternaX is the default post-quantum authorization architecture.

It solves the immediate problem—make custody authorization PQ-safe—and the longer-term problem—avoid rebuilding institutional authorization every time cryptography changes.

SEE HOW ETERNAX MAKES CUSTODY PQ-SAFE

Test the architecture against your current custody stack.The custody pilot maps APIs and recovery, validates the dual-gate design and produces an integration plan for production decision-making.

SCOPE A 90-DAY CUSTODY PILOT

Conclusion · Recommendation · Evidence

08 / 08

The custody decision is not only how to become PQ-safe. It is how to stay PQ-safe without rebuilding the control plane.

Institutional custody is becoming a large recurring infrastructure business as securities move onto programmable rails. The global securities base is already approximately $318.5T, while Citi's 2030 base case puts tokenized financial assets at $5.5T.17 18

For fixed-verifier environments, native-output architectures remain the rational choice. HSMs offer exceptional operational maturity where a complete key inside trusted hardware is acceptable. Native threshold and generic MPC architectures preserve distributed native-key custody where it is not.

But programmable institutional custody creates a different optimization problem. If the institution wants mixed classical/PQ migration, stable quorum and governance semantics, and minimum authorization-layer migration impact across repeated algorithm changes, then separating threshold authorization from the member-signature family is the cleanest architectural direction.

Final recommendation: For programmable institutional custody, EternaX should be the default post-quantum authorization architecture. It is designed to make the existing custody authorization layer PQ-safe without replacing the custodian or moving assets, while preserving authorization continuity across future cryptographic migrations.28

What an institution should ask in an RFP

What exactly changes when ECDSA is replaced?

Do we need a new DKG, new shares or new recovery ceremony?

Can classical and PQ member authentication coexist under policy?

Where, if anywhere, can the complete native key exist?

Will historical authorization evidence remain interpretable?

What changes again when today's PQ signature is eventually replaced?

EternaX · Post-quantum market infrastructure

Make your existing custody authorization post-quantum safe.

Review the EternaX integration model for your MPC, HSM or Safe-style custody stack, or scope a 90-day institutional custody pilot.

SEE THE CUSTODY SOLUTION SCOPE A 90-DAY PILOT

Sources, evidence and methodology

Method. Architecture claims are separated into public production facts, peer-reviewed or presented research, preprints and EternaX analysis. Undisclosed vendor implementation details are not inferred. Market revenue figures are scenario calculations, not forecasts.

NIST, Considerations for Achieving Crypto Agility: Strategies and Practices, updated June 29, 2026. nist.gov
Citi, Citi Unveils Custody+: A Suite of Near- and Real-time Custody Solutions, Aug. 18, 2026. citigroup.com
Standard Chartered, Standard Chartered to acquire Zodia Custody's custody business, May 18, 2026. sc.com
State Street / Taurus deployment materials: agreement; production update.
Fireblocks, What Google's New Quantum Research Means for Institutional Crypto Security, Apr. 1, 2026. fireblocks.com
Celi et al., Efficient Threshold ML-DSA, USENIX Security 2026. usenix.org
Kondi, Kumar, Vanegas, Black-Box Threshold Signing of Hash-Based Signatures is Impossible, NIST MPTS 2026. csrc.nist.gov
Boneh, Bünz et al., PRAWNS research preview, Aug. 2, 2026. lclhost.org
Fireblocks Developer Docs, Using ECDSA and EdDSA. developers.fireblocks.com
Taurus, Post-Quantum Readiness for Institutional Digital Asset Custody. taurushq.com
HSBC, Announcing HSBC's New Digital Assets Custody Service, Nov. 8, 2023. business.hsbc.com
BNY, BNY Mellon Launches New Digital Asset Custody Platform. bny.com
BNY, Digital Asset Custody, current product page. bny.com
Dariia Porechna, Threshold Authorization Without Threshold Signatures: Signature-Agnostic MPC Custody, arXiv:2607.08226, July 2026. arxiv.org
Kelsey, Lucks, Lang, Turning Hash-Based Signatures into Distributed Signatures and Threshold Signatures, IACR Communications in Cryptology, 2025. nist.gov
Dariia Porechna, The Native-Signature Boundary in Post-Quantum Distributed Authorization, arXiv:2609.03547, Sept. 2026. Defines native-signature compatibility, unilateral-signing resistance and threshold-layer agility; introduces the migration impact surface; classifies authorization families and records the empty-cell architectural tension. arxiv.org
SIFMA, 2026 Capital Markets Fact Book: global equity market capitalization of $157.8T and global fixed-income securities outstanding of $160.7T in 2025. sifma.org
Citi Institute, Tokenization 2030 — Wall Street On-Chain, June 2026: $5.5T base case, $2.7T bear case and $8.2T bull case for tokenized assets by 2030. citigroup.com
Northern Trust, 2025 Form 10-K: $1.9016B of custody and fund-administration fees in 2025 and $17.4T of Asset Servicing AUC/A at Dec. 31, 2025. northerntrust.com
Coinbase Institutional, current institutional platform page: approximately $300B assets under custody, 470+ custody assets and 11% of global crypto market capitalization under custody. coinbase.com
Coinbase Prime, Custody and Prime legal-entity documentation: Coinbase Prime custody supports 470+ assets; U.S. Prime custody can contract through Coinbase Custody Trust Company, LLC. coinbase.com
BitGo Holdings, Q2 2026 Form 10-Q / Financial Results: approximately $65.2B assets on platform and 5,833 clients as of June 30, 2026. sec.gov
BitGo, June–July 2026 institutional tokenized-securities materials: BitGo Bank & Trust provides qualified custody for YLDS and participated in DTCC tokenized-securities infrastructure. bitgo.com
Fidelity Digital Assets, Custody: institutional platform with offline cold-vaulted storage, multi-tier approvals and multi-site storage; Fidelity Digital Assets, National Association received an OCC national trust bank charter in 2025. fidelitydigitalassets.com
Anchorage Digital, institutional custody materials: Anchorage Digital Bank is a federally chartered digital-asset bank and qualified custodian offering custody and related institutional services. anchorage.com
Fireblocks, Buyer's Guide for Banks & Financial Institutions, 2026: MPC-CMP custody technology, programmable policy, bank integration and custody infrastructure for regulated environments. fireblocks.com
Copper, Qualified Custody: proprietary MPC-based qualified custody; Copper states that a full private key is never created. copper.co
EternaX, Custody & MPC Providers — SLH-DSA / SPHINCS+ Post-Quantum Custody, current product architecture page: existing-custody integration, PQ Custody SDK, PQ Vault, mixed classical/PQ migration and explicit chain-level residual-risk boundaries. eternax.ai
EternaX, Institutional Post-Quantum Pilot, current pilot framework: custody/MPC outputs include dual-gate design, custody API map, recovery validation and integration plan over a 90-day decision cycle. eternax.ai

Evidence discipline: primary-source facts are separated from research results, preprints and architectural inference. Undisclosed bank implementation details are not inferred. Fast-moving vendor and research claims should be revalidated when the publication date changes.

About the Authors

EternaX Labs · Post-Quantum Financial Infrastructure

Dariia Porechna

Dariia Porechna

Co-Founder

Cryptographer and distributed systems architect. Former Head of Protocol at Subspace. Former Research Engineer at Wolfram|Alpha. Co-author, SILMARILS.

Paarrthhh Birla

Paarrthhh Birla

Co-Founder

Former VP, Growth Office at Polygon. Former Head of Partnerships at Subspace Protocol. Former digital-assets strategy advisor at EYP. MBA, CPA.

Dr. Chen Feng

Dr. Chen Feng

Chief Scientist

Associate Professor, University of British Columbia. PhD, University of Toronto. 100+ peer-reviewed papers across quantum communications, blockchain, and TEE privacy. Co-author, SILMARILS.

LinkedIn · Google Scholar

FAQ · Post-quantum custody

Frequently asked questions about post-quantum institutional custody

Direct, answer-first responses for banks, custodians, CTOs and CISOs comparing post-quantum custody architectures.

Does EternaX make the underlying blockchain fully quantum-safe?

No. EternaX hardens the custody and authorization layers that institutions can upgrade today. On Ethereum/EVM, PQ Custody SDK + PQ Vault can protect custody signing, custody approvals and on-chain asset authorization, while base-layer consensus remains a chain-level risk. On Solana, Canton and Stellar, native transaction authorization and consensus remain residual chain-level risks until those networks upgrade.28

Link to this answer

Can EternaX make my existing custody post-quantum safe?

EternaX is designed to make the custody authorization layer post-quantum safe without replacing the custodian, moving assets or changing the operating model. Custody providers integrate the PQ Custody SDK beneath existing MPC, HSM or Safe-style workflows. On EVM deployments, PQ Vault can additionally protect on-chain asset authorization.28

Link to this answer

What is the main benefit of the EternaX custody architecture?

Authorization continuity. EternaX is designed so institutions can change member authentication cryptography without rebuilding the custody authorization plane. Crypto agility is the enabling property; a narrower migration impact surface, asynchronous migration and longer infrastructure life are the resulting technical and business benefits.

Link to this answer

What is the best architecture for post-quantum institutional custody?

There is no universal winner. For fixed-verifier environments that require one unchanged native signature, HSM, native threshold signing or generic MPC may be the better fit. For programmable institutional custody that prioritizes staged migration, stable governance and minimum authorization-layer replacement, EternaX's signature-agnostic authorization architecture is designed to be the natural default.

Link to this answer

How can an institution make existing custody post-quantum safe without replacing its custodian?

EternaX provides a post-quantum authorization layer designed to integrate beneath an institution's existing custody stack. The MPC, HSM or Safe-style custody provider can remain in place while the authorization path is hardened with post-quantum approvals. This avoids a full custody re-platform and allows the institution to preserve its operating model.28

Link to this answer

Is HSM or MPC better for post-quantum custody?

It depends on the trust model and verifier constraint. HSM-first custody is strong when native output, certification and operational maturity matter most and a complete key inside hardened hardware is acceptable. MPC or native threshold designs are stronger when no single component may hold the complete native key. For repeated algorithm migration, institutions should also compare how much key state, signing logic and recovery must change.

Link to this answer

Can an MPC custodian become post-quantum safe without rebuilding its MPC architecture?

Not automatically. A custody system built around threshold ECDSA or EdDSA does not automatically become a distributed ML-DSA or SLH-DSA signer. The DKG, shares, signing computation, recovery and performance model may need to change. EternaX addresses this by moving institutional threshold authorization outside the member-signature primitive rather than requiring the existing MPC signer to become every future post-quantum signer.

Link to this answer

Can a custodian become post-quantum safe before the underlying blockchain becomes quantum-safe?

Yes, at the custody and authorization layers. Institutions can harden the controls they own today even while the base chain remains partly classical. On Ethereum/EVM, EternaX's PQ Custody SDK and PQ Vault can protect custody signing, approvals and on-chain asset authorization, while base-layer consensus remains a separate chain-level risk.28

Link to this answer

Does post-quantum custody require moving assets or changing custodians?

No, not necessarily. EternaX is designed to add a post-quantum authorization layer beneath existing MPC, HSM and Safe-style custody so the custodian, workflow and asset venue can remain in place. The migration target is the authorization path, not a forced asset move.28

Link to this answer

Can EternaX work with existing MPC, HSM, Fireblocks-style or Safe-style custody?

Yes, when the custody provider exposes an integration path for the authorization layer. EternaX is designed to sit beneath existing MPC, HSM and Safe-style custody instead of replacing the custody provider. The exact integration depends on the provider's APIs, policy engine, recovery model and transaction path.28

Link to this answer

What is the difference between post-quantum custody and post-quantum authorization?

Post-quantum custody is the broader system; post-quantum authorization is one of its critical control layers. Custody includes safekeeping, signing, approval, recovery, policy, auditability and execution. Post-quantum authorization focuses on ensuring that institutional approvals and quorum controls remain secure as cryptographic authentication schemes change.

Link to this answer

What changes when institutional custody migrates from ECDSA to ML-DSA or SLH-DSA?

Potentially much more than the verifier. The migration can affect DKG, key shares, signing interaction, preprocessing, combination, refresh, recovery, performance, policy evidence and integration. The set of components that must move is the migration impact surface. EternaX is designed to reduce the authorization-layer portion of that impact surface.

Link to this answer

Why is crypto agility important for institutional custody?

Because the post-quantum transition will not be the last cryptographic migration. Institutions need custody infrastructure that can replace algorithms without repeatedly rebuilding policy, governance and operational controls. Crypto agility is the property that makes this possible; authorization continuity is the institutional outcome.

Link to this answer

What is authorization continuity and why does it matter for custody?

Authorization continuity means institutional policy, quorum and approval state can remain stable while the cryptography used by participants changes. It matters because custody systems are expected to operate for years, while cryptographic standards can change multiple times. Preserving authorization continuity reduces disruption, migration cost and operational risk.

Link to this answer

How should a bank select a post-quantum custody architecture?

Start with the destination and trust constraints, not the vendor. Ask whether one unchanged native signature is mandatory, whether a complete key may exist in certified hardware, whether the enforcement layer is programmable, whether mixed classical/PQ migration is required, and how much authorization state can change during each algorithm migration. These requirements determine whether HSM, native threshold, generic MPC, specialized hash-signature constructions or EternaX's signature-agnostic authorization model is the better fit.

Link to this answer

Who are the leading institutional digital-asset custody players considered in this framework?

This report uses Coinbase Prime/Coinbase Custody, BitGo, Fidelity Digital Assets, Anchorage Digital Bank and Fireblocks as five reference incumbents across regulated custody, institutional scale and custody infrastructure. Fireblocks is included as a custody-infrastructure platform rather than being treated as the same legal category as a qualified custodian. Copper and Taurus are added as architecture comparators because their MPC and HSM-first designs materially sharpen the post-quantum decision.

Link to this answer

What is post-quantum digital-asset custody?

Post-quantum digital-asset custody is a custody architecture that can securely control assets using quantum-resistant cryptography and migrate its signing, authorization, recovery and policy mechanisms as cryptographic standards change. It is broader than adding an ML-DSA or SLH-DSA verifier: the custody system must also generate, authorize, rotate, recover and evidence the new credentials.

Link to this answer

Is MPC custody automatically post-quantum safe?

No. An MPC custody platform built around threshold ECDSA or EdDSA does not automatically become a distributed signer for ML-DSA, SLH-DSA or another post-quantum signature. The destination verifier, distributed key state, signing computation, preprocessing, recovery and performance model may all need to change. Fireblocks itself describes PQC as an active architecture and MPC-construction problem rather than claiming today's ECDSA/EdDSA MPC is already PQ-safe.5 9

Link to this answer

What is the difference between HSM custody and MPC custody?

In an HSM-first architecture, the complete native signing key can exist inside a trusted hardware boundary and external controls determine when the HSM may sign. In distributed MPC custody, the native key is represented across multiple participants so no single participant holds the complete key. HSMs can offer strong certification, operational maturity and native output; MPC can offer a stronger distributed-key trust model but often creates more signature-scheme coupling.

Link to this answer

What does crypto-agile custody mean?

Crypto-agile custody means the custody system can replace cryptographic algorithms without unnecessarily rebuilding the surrounding authorization, policy, recovery and operational infrastructure. For institutional custody, the strongest test is not whether an API exposes another algorithm; it is how much persistent state and governance machinery must change when the algorithm changes.1

Link to this answer

What is the migration impact surface in digital-asset custody?

The migration impact surface is the set of custody components whose implementation, persistent state, wire semantics, trust assumption, failure procedure or security argument must change when the signature scheme changes. It is end-to-end—including destination verification and interfaces—and can include DKG, shares, preprocessing, signing, combination, refresh, recovery, policy state and authorization evidence. The composition of the set matters more than its size.16

Link to this answer

Can ML-DSA be used with threshold custody?

Yes, threshold ML-DSA is cryptographically feasible. Research presented at USENIX Security 2026 describes an efficient threshold ML-DSA construction compatible with standardized ML-DSA for up to six parties. That establishes feasibility; it does not by itself establish the production maturity, certification, latency or recovery properties required by every institutional custodian.6

Link to this answer

Can SLH-DSA or hash-based signatures be thresholdized?

Specialized distributed and threshold hash-based signature constructions exist, but standard hash-based signatures are difficult to threshold efficiently as a black box. NIST-presented work gives an impossibility result under a specific oracle-respecting black-box model, while other constructions move complexity into trusted setup, state or specialized protocol design. The correct conclusion is not that threshold hash-based signatures are universally impossible; it is that the construction model matters.7 15

Link to this answer

What is PRAWNS and why is it relevant to post-quantum custody?

PRAWNS is a 2026 research direction from Dan Boneh, Benedikt Bünz and collaborators for distributed generation of an ordinary hash-based signature while hiding the threshold and participant set from the destination verifier. It is relevant because it targets native signature compatibility plus distributed control. The public research preview also states that distributed key generation remains unresolved, so it should be treated as research rather than a production custody standard.8

Link to this answer

What is signature-agnostic threshold authorization?

Signature-agnostic threshold authorization separates member authentication from institutional threshold approval. Members may authenticate with different signature families while a separate threshold authorization mechanism enforces quorum and policy. The design objective is to keep authorization state stable when member signature algorithms change, narrowing the authorization-layer migration impact surface.14

Link to this answer

When is an HSM-first post-quantum custody architecture the better choice?

HSM-first custody is often the better choice when the destination requires one native signature, operational maturity and certification are paramount, and the institution accepts the complete native key existing inside a hardened trusted hardware boundary. It is particularly attractive when programmable enforcement is unavailable and minimizing implementation novelty matters more than eliminating the full-key hardware trust boundary.

Link to this answer

When is signature-agnostic authorization the better choice?

It is strongest when the asset-control layer is programmable and the institution prioritizes repeated cryptographic migration, mixed classical/PQ transition, stable governance semantics and minimum replacement of authorization-layer state. It is not the universal winner: a fixed verifier that requires one unchanged native signature may favor HSM, native threshold signing or generic MPC.

Link to this answer

How large could the tokenized securities custody and control market become?

SIFMA reports approximately $157.8 trillion of global equity market capitalization and $160.7 trillion of global fixed-income securities outstanding in 2025, or about $318.5 trillion combined. Citi's June 2026 base case projects $5.5 trillion of tokenized assets by 2030. At an illustrative 1 basis point of annual custody/control monetization, 10% penetration of today's securities base would correspond to about $3.2 billion of recurring annual industry revenue; full penetration would correspond to about $31.9 billion per year. These are scenario calculations, not adoption or universal pricing forecasts.17 18 19

Link to this answer

Why does tokenization increase demand for custody and authorization infrastructure?

Tokenization moves ownership and transfer onto programmable systems, but institutions still require safekeeping, key management, authorization policy, recovery, compliance controls, asset servicing and settlement connectivity. As more securities become digitally represented, cryptographic authorization becomes part of the control plane of ownership rather than a peripheral wallet function.

Link to this answer

Why is EternaX the natural architecture for programmable institutional custody?

Because EternaX is designed to keep institutional threshold authorization independent of the member-signature family. That allows policy, quorum and authorization state to remain stable while ECDSA, EdDSA, ML-DSA, SLH-DSA or future authentication schemes change. For programmable custody that must survive repeated cryptographic migrations, this directly matches the long-term requirement set.

Link to this answer

eternaX · Quantum-safe Settlement at Market Speed

Research framework · Not legal, investment or procurement advice.