Post-Quantum Exposure Map 2026

1. The Exposure Thesis: Institutional Crypto on Classical Rails

The ~$300 trillion tokenization opportunity is not arriving someday. It is arriving now, and it is choosing its rails. Over $317 billion in stablecoins and $36 billion in tokenized real-world assets already sit on blockchain infrastructure that NIST has proposed to deprecate by 2030. The $26.7 billion on chain today is not the risk. It is the template. Every rail decision, every pilot, every collateral framework, and every chain expansion being made today will determine the infrastructure that carries the next $300 trillion. The risk is not only quantum theft. It is locking the largest asset migration in financial history onto cryptography with a published expiration date.

PQ-native infrastructure delivers three advantages simultaneously. Security: protects authorization, custody, mint/burn, bridges, settlement, and collateral from future quantum migration risk. Privacy: protects institutional flows, treasury movements, and counterparty behavior from store-now-decrypt-later attacks. Distribution: differentiates new issuance in a crowded tokenization market where every issuer competes on yield, liquidity, compliance, brand, and trust.

Why Now: Five Forcing Functions

Legacy exposure is a migration problem: map it, contain it, harden it, plan for migration. New issuance is a choice: every new product can either create fresh migration debt or avoid it from day one. The rest of this report maps both.

Post-quantum risk is no longer a science problem. It is a financial-infrastructure design problem.

2. Institutional Exposure Map: BlackRock, Circle, Franklin, Goldman, J.P. Morgan and 20+ Institutions

This table maps every major institution's live crypto activity to its post-quantum and privacy exposure. Every row is searchable, shareable, and personally relevant. If your institution appears below, your product carries cryptographic migration debt.

How Post-Quantum Risk Works: The Causal Chain

Every row in the table below follows the same logic. Read left to right:

Which Chain Uses Which Vulnerable Primitive?

This is why your product is exposed. Every chain below uses at least one classical signature algorithm that quantum computers will break.

Summary: Every Institution, Every Product, Every Risk Score

Scan the table below to find your institution. The cards that follow go deeper on the highest-risk clusters.

Highest-Risk Institutions: Detailed Cards

Dependency Clusters: Where Risk Concentrates

Product-Archetype PQ Exposure Matrix

Product-Archetype Privacy Exposure Matrix

If your product touches a classical chain, your asset has cryptographic migration debt attached to it.

3. Chain and Ledger Exposure Map: Ethereum, Canton, Solana, Stellar, XRPL and More

Every chain below except EternaX relies on classical cryptographic assumptions today. None of the incumbent chains has completed a post-quantum migration. "Value exposed" means the approximate value of products in this report that touch that chain, not the exact amount residing on it. Many products are multichain, so rows are not additive.

Every other chain in this table relies on classical cryptographic assumptions today. None has completed a post-quantum migration. One chain was built so migration is never needed.

4. Where Post-Quantum Risk Lives: Nine Problem Sources Across Institutional Crypto

Post-quantum risk decomposes into nine distinct problem sources. Generic claims are useless. Specific mapping is what boards need.

4.1 Holder-Wallet Key Risk

Every institutional wallet on Ethereum uses secp256k1. Every wallet on Solana, Stellar, and XRPL uses Ed25519. Both are vulnerable to Shor's algorithm. Google's March 2026 paper compressed the qubit requirement to fewer than 500,000. This affects every holder of BUIDL, USYC, BENJI, USTB, USCC, OUSG, RLUSD, PYUSD, EURCV, uMINT, and every other tokenized asset on these chains.

4.2 Admin-Key and Transfer-Agent Risk

This is the most economically dangerous exposure. Issuer admin keys control mint, burn, freeze, whitelist, upgrade, and redemption functions. Franklin's transfer agent can reverse and correct onchain transfers. Securitize manages BUIDL's multichain share classes. A single compromised admin key can affect every holder simultaneously. These keys are typically secp256k1 or Ed25519 with no disclosed PQ hardening.

4.3 Chain-Level Consensus and Finality Risk

Ethereum consensus uses BLS signatures. The Ethereum roadmap identifies BLS, KZG commitments, and ZK systems as quantum-sensitive. Solana, Stellar, XRPL, Avalanche, and Aptos all use classical signature schemes for validator and consensus operations. A consensus-level attack does not steal individual wallets; it undermines the finality guarantee that every institutional settlement depends on.

4.4 Bridge and Cross-Chain Messaging Risk

Wormhole, CCIP, LayerZero, Axelar, and native bridges all rely on classical signer sets for message attestation. VBILL uses Wormhole. JTRSY plans LayerZero. RLUSD is expanding via Wormhole NTT. CCIP supports SWEEP. Even if both source and destination chains survive, a compromised bridge signer set can mint, redirect, or burn tokens in transit. Bridge risk is first-order for any multichain product.

4.5 Oracle and NAV-Feed Risk

Aave Horizon liquidations depend on oracle/NAV freshness. Chainlink NAVLink feeds VBILL and SWEEP pricing. Attestation signers, price-feed operators, and NAV publishers all use classical signatures. A manipulated oracle feed under quantum attack can trigger incorrect liquidations, mispriced collateral, or failed redemptions across permissioned lending markets.

4.6 Custody, MPC, and HSM Risk

Standard Chartered, Komainu, Ceffu, Anchorage, and BNY all provide institutional custody. MPC, multisig, and HSM architectures typically depend on classical primitives at the signing layer. Even when custody is segregated and institutionally governed, the underlying key material is quantum-vulnerable unless specifically migrated to PQ-safe schemes.

4.7 Collateral Repricing Risk

When the market begins to price quantum risk into collateral eligibility, haircuts widen. A tokenized MMF that today receives an 88% LTV on Aave Horizon may see that LTV reduced if the underlying chain's cryptographic rail is deemed compromised or migration-uncertain. Collateral eligibility withdrawal, haircut widening, and margin call acceleration are commercial consequences that precede any actual quantum attack.

4.8 Privacy Leakage and Store-Now-Decrypt-Later Risk

Public chains expose treasury movements, wallet balances, redemption behavior, collateral postings, liquidation events, counterparty timing, and market-maker flows. This data is being harvested now. Under store-now-decrypt-later, encrypted communications, key exchanges, and privacy-layer protections can be retroactively broken once quantum capability arrives. Privacy is a PQ problem, not a separate concern.

4.9 Private-DLT False Comfort

The most underestimated risk. Canton's privacy depends on classical encryption, not quantum-durable cryptography. When those keys break, privacy collapses completely: every historical flow becomes retroactively visible. Divulgence to non-stakeholders is documented. HNDL collection is already active. GS DAP's exact primitives are not disclosed. Swift operates on enterprise privacy with operator visibility. Privacy-by-policy is not privacy-by-cryptography.

What Happens When the Market Reprices Cryptographic Risk?

The commercial consequences arrive before any quantum computer breaks a key. Collateral eligibility withdrawal: venues and clearing firms adjust accepted collateral lists based on infrastructure risk assessments. Haircut widening: tokens on chains with no PQ roadmap receive worse collateral terms, reducing capital efficiency. Insurance and audit repricing: underwriters and auditors adjust risk models for quantum-exposed custody and settlement infrastructure. Institutional trust erosion: issuers without disclosed PQ roadmaps lose competitive position to issuers on PQ-native rails. The repricing does not begin when quantum computers arrive. It begins when the market opens the balance sheet.

The weakest key in the control plane becomes the strongest reason your collateral gets repriced.

5. Top 10 Institutional Crypto Pilots at Post-Quantum Risk

These are the highest-stakes institutional crypto pilots happening right now. Each one is not just a product launch. It is an architecture decision that will determine how the next tranche of the ~$300 trillion tokenization opportunity gets built. Each one is building on classical rails. Each one will harden into production. The window to influence architecture is during the pilot, not after.

Test the PQ-native version of your pilot on EternaX before the classical version hardens into production.

6. Legacy Exposure vs New Issuance: The Strategic Fork for Tokenized Finance

Already-issued products require containment: exposure mapping, admin-key hardening, vendor PQ roadmap requirements, and coordinated migration planning. But the $26.7 billion on chain today is a rounding error against the ~$300 trillion that will tokenize over the next decade. Every new stablecoin, tokenized fund, RWA product, collateral pilot, share class, chain expansion, and settlement corridor is a board-level rail-selection decision that determines the infrastructure for that $300 trillion.

In a crowded tokenization market, the issuer that can say "PQ-native from day one, with auditable privacy and no future migration debt" has a stronger institutional sales story than another classical-chain product waiting for a future retrofit. A PQ-native share class is not only safer. It is a better sales pitch.

A successful pilot on vulnerable rails becomes tomorrow's production liability.

7. PQ-Native Infrastructure as Distribution Advantage: Why EternaX

PQ-native rails create three advantages at once. This is not defensive risk mitigation. It is a competitive weapon.

EternaX: PQ-Native Market Infrastructure

EternaX is a PQ-native Layer 1 for stablecoin issuance, RWA tokenization, and institutional settlement. It is the only EVM-compatible chain where post-quantum security, auditable privacy, and DeFi composability are native from genesis.

Conservative where conservatism matters: SPHINCS+ (NIST SLH-DSA, FIPS 205) as the enterprise standard. Zero algebraic assumptions. 45+ years of cryptanalysis, zero successful attacks. The only NIST PQ signature whose security reduces entirely to hash function properties.

Novel where novelty matters: SILMARILS (Khodaiemehr, Bagheri, Feng, Porechna; arXiv:2605.03230, UBC and EternaX Labs, May 2026). 160-byte information-theoretic authentication record. 49x smaller than standalone SPHINCS+. Forgery probability ~1/2²⁵⁵. Hash-only crypto stack: no pairings, no BLS, no KZG.

Performance: EternaX loses ~2% throughput under PQ operation (50,000+ TPS to ~49,000+ TPS). Solana loses ~90%. Ethereum models at ~84%. Canton loses ~88%. Finality ~120ms.

EVM compatible: existing Solidity DeFi protocols deploy with minimal modifications and automatically inherit PQ security and institutional privacy.

Auditable privacy: validator-blind confidentiality. MEV-zero by architecture. Selective disclosure for supervisory audit. Not privacy-by-policy. Privacy-by-cryptography.

For the full institutional risk framework quantifying $112M-$295M cryptographic migration debt per institution, see the EternaX Cryptographic Migration Debt Framework. For the complete post-quantum signature security analysis ranking all NIST PQ families, see the Post-Quantum Signature Security Ranking 2026. For the three-pillar institutional positioning, see Why EternaX: PQ Security, Auditable Privacy, DeFi Composability.

8. Post-Quantum Risk FAQ: Institutional Crypto, Tokenized Assets, Stablecoins, and RWAs