Institutional custody expansion collides with long-term quantum risks — will MPC architectures bottleneck the transition?

Executive summary

Global banking institutions are rapidly scaling their digital asset custody infrastructure, shifting custody from a back-office concern to a core strategic priority. In May 2026, BNY, the world's largest custodian with $59.4 trillion in assets under custody and administration, announced it would offer Bitcoin and Ethereum custody in Abu Dhabi. Shortly after, Standard Chartered confirmed its agreement to fully acquire Zodia Custody, a digital asset custodian it incubated in 2020, with the transaction expected to close by the end of August 2026. These moves signal a deep integration of traditional banking capital with digital asset plumbing, providing the secure foundations required for sovereign wealth funds, pension funds, and corporate treasuries to allocate capital.

However, this institutional expansion coincides with emerging technical vulnerabilities. A recent report from Swiss digital asset technology firm Taurus argues that the majority of digital asset custodians remain exposed to future quantum computing risks. Specifically, the report highlights that Multi-Party Computation (MPC)—the dominant custody architecture favored by crypto-native custodians and fintechs—faces structural mathematical limitations when migrating to post-quantum cryptographic standards. While the physical threat of a cryptographically relevant quantum computer remains decades away, the regulatory and technical timelines to upgrade custody infrastructure are much tighter, threatening to disrupt institutional custody pipelines before 2030.

Why it matters

The immediate market impact of this development is structural rather than transactional. It does not directly drive short-term spot price volatility or alter daily trading volumes, which remain tied to macroeconomic liquidity and derivative market positioning. Instead, it alters the risk matrix for institutional allocators. Every spot Bitcoin ETF, tokenized fund, and corporate treasury position relies entirely on the security of its custodian's private key management. If the underlying custody architecture requires a complex, unproven overhaul to meet upcoming post-quantum standards, institutional allocators may shift their capital toward custodians utilizing more adaptable hardware-based security.

This dynamic creates a clear division in the custody market. Hardware Security Modules (HSMs), such as those provided by Thales, can run post-quantum signature algorithms via straightforward firmware updates. Conversely, MPC architectures must invent entirely new protocols to distribute post-quantum signatures across multiple machines without assembling the private key. For hash-based signature schemes like SLH-DSA—which are increasingly favored by networks like Circle, Aptos, and Ethereum—multi-party protocols face fundamental mathematical barriers because hash functions lack the mathematical structure that MPC exploits.

Consequently, the institutions that benefit most from this trend are well-capitalized, bank-backed custodians capable of maintaining hybrid HSM-MPC architectures. Smaller, pure-play MPC custody providers may face rising R&D costs and potential client attrition as compliance deadlines approach. Furthermore, any transition to post-quantum cryptography requires coordinated upgrades at the blockchain protocol level (such as Bitcoin's BIP-360). If custodians deploy post-quantum signatures before the underlying blockchains support them, transactions will be rejected by node operators. This dependency means that institutional custody security is inextricably linked to open-source developer consensus, a dependency that conservative institutional compliance officers are only beginning to evaluate.