On a public blockchain, whoever produces a signature or other authorization the protocol accepts can move the asset, regardless of legal title. Each chain’s protocol also sets the signature algorithm. Post-quantum cryptography (PQC) for on-chain keys requires the protocol to accept a PQC signature scheme, and adding one is a governance decision no exchange or custodian can compel. You can change your custody key management, signing stacks, and address-rotation policy now, on your own schedule. In this workshop, you plan how to migrate what you control and how to track the chains you depend on.
Bitcoin’s Taproot upgrade, which added Schnorr signatures, took almost four years from first proposal to activation. Crypto-Agility for Digital Assets: Chains Are Planning One Post-Quantum Change When They Will Need Several sets out the dates of that and other chain upgrades. Institutional clients and their auditors are asking custodians five questions about addresses, testing, and migration plans. What Crypto Holders and Builders Should Do Now lists them, and each one can be answered today with work the custodian controls.
We run this intensive as an eight-hour planning workshop, in one day in person or in two four-hour sessions live online. You work from your own custody records, vendor contracts, and supported chains. If you cannot use your own data, you work from a sample custodian we provide. No cryptography background is needed. You leave with a draft program plan and a year-one roadmap, with the assumptions you still need to check written down.
Who this intensive is for
Program managers and PMO leads attend with the CISO or CTO who will sponsor the program and the leads for custody operations and key management. HSM and multi-party signing engineers, whoever tracks protocol governance for your chains, and vendor management, risk, and compliance staff belong in the room too. We recommend sending a mixed group from one organization, ideally the people who would be members of its quantum readiness steering committee. Running the custody stack, following each chain’s improvement proposals, and answering client due diligence are usually three different jobs.
Bring at least one person from custody operations. Many of the sequencing decisions in this workshop are custody operations decisions.
The intensive is for exchanges, custodians, funds, and issuers of stablecoins and tokenized assets. A bank that runs digital asset custody as one line of business can also consider the Quantum-Safe Financial Services Intensive. To work through confidential detail with only your own colleagues present, book the intensive as private team training through training@quantumacademy.com.
What you’ll be able to do afterward
- Separate the changes your organization controls from the changes that depend on each chain’s governance
- Draft a program charter and business case, and define the steering committee’s structure
- Plan an inventory of addresses, contracts, and custody systems, starting from records you already hold
- Score and tier your holdings and systems, recording unknowns instead of guessing them
- Classify custody, wallet, and signing vendors, question them in the right order, and grade every date they give you
- Track each chain’s governance as an external dependency, and plan what you do while you wait
- Structure the program into workstreams and a year-one plan, with KPIs your board can read
What you leave with
Every participant receives the course handbook, a PDF of every slide with notes that explain it in full. Each participant also receives a PDF copy of Quantum Ready, the companion book to the framework the day draws on. During the day, you build first versions of these working documents:
- An estate map that sorts custody systems, on-chain keys, and smart contracts by who controls each change
- A program charter and steering committee structure, with a protocol-governance seat
- An inventory plan, with its tracks, starting records, and coverage denominator
- An initial priority list, with evidence gaps and blocked entries recorded
- A custody register of your key management and signing systems, plus a vendor dependency register that separates evidenced dates from assumptions
- A timeline map of the chains you support, with graded dates and a decision owner for each
- A workstream structure with role and resource assumptions
- A year-one plan by quarter, with board KPIs and the decisions you need from others
The working documents are editable and yours to keep.
Preparing for the day
You can work through the day with data from your own organization or with a sample custodian we provide. If you bring approximate figures from your own estate, you apply each module directly to your holdings and systems, and the documents you leave with contain your own numbers. If you cannot share your data or have not had time to collect it, you work with the sample custodian’s illustrative figures. You then apply the same templates to your own estate when you return to work.
Your joining instructions, sent seven days before the course, list what to gather if you want to use your own data. Approximate figures are enough:
- The chains you support, and the custody systems and vendors you use for each
- Contract renewal dates for your custody platform, HSM, multi-party signing, and wallet vendors
- The records an inventory would start from, such as your custody system of record, treasury records, and staking records
- Address and account counts by chain, and the smart contracts and bridges you depend on
- Any regulatory, client due diligence, or insurer deadlines your organization already tracks
You decide what you share with the room. Because addresses paired with their balances are high-value material, bring counts by chain rather than address lists.
The day
The day draws on the lifecycle of the Applied Quantum PQC Migration Framework and its Digital Assets Extension. The instructor starts each module with a short briefing. You then apply the module’s template to your own estate or to the sample custodian.
In person, we teach the intensive from 09:00 to 17:00 local time, with lunch and two breaks:
Live online, we teach it in two four-hour sessions on consecutive days, each with a short break. We cover Modules 1 to 4 in the first session and Modules 5 to 8 in the second.
Module 1 What you control and what you track
The instructor walks through the record of chain upgrades, from Bitcoin’s Taproot to Zcash’s two cryptographic changes within 60 days in 2026. You then sort your estate into the framework’s three control classes: custody infrastructure you run, on-chain keys whose algorithm each protocol sets, and smart contracts that third-party developers manage.
Module 2 Mandate, governance, and the business case
You draft a charter with two outcomes: readiness for your dated obligations and the ability to change the cryptography you control. For an EU crypto-asset service provider, those obligations include MiCA authorization and DORA’s rules on cryptographic controls. You define a steering committee with a protocol-governance seat, and frame the business case as fiduciary and custody risk.
Module 3 Inventory planning
You plan to list every address, account, contract, and validator from treasury, custody, portfolio, and staking records before any chain scan. You plan tracks for on-chain keys, smart contracts, custody systems, validators, and layer-2 networks and bridges. Each on-chain entry gets three separate records: exposure state, key-control status, and migratability. A custody key becomes two entries: the signing stack you can migrate, and the on-chain key its protocol governs.
Module 4 Risk scoring and priorities
You score each entry on the framework’s four dimensions where they apply, with sector factors such as exposure state and value concentration. Admin keys over stablecoin and bridge contracts score Critical on concentration, for reasons Ethereum’s Five Quantum Vulnerabilities and Who Owns Each Fix sets out. You record unknowns instead of guessing them and tier each fully scored entry. For each blocked high-priority entry, you name an owner and document a risk acceptance.
Module 5 Custody stack and vendor management
You list your HSMs, key management systems, and multi-party signing stacks in the framework’s custody register. You classify custody, wallet, signing, and node-software vendors, and open every conversation with the same two crypto-agility questions. You grade every vendor date as committed, forecast, announced, or unknown, and draft an acceptance test: a rehearsed algorithm change before production use.
Module 6 Protocol governance and the chains you support
You treat each chain you support as a counterparty you cannot compel, and read its readiness from the ledger and its proposal record. You grade its dates: a foundation roadmap is announced at best, and a proposal without an activation date is unknown. For each chain, you write the interim address-rotation policy and name the business owner who decides whether to accept the risk, reduce holdings, or exit. You also draft each chain’s playbook for an algorithm event: who can pause deposits and withdrawals, and what clients are told.
Module 7 Program structure and staffing
You organize the work into workstreams and repeatable work packages, such as ending address reuse on one chain. You place the Crypto-Agility owner in the function that runs the custody stack, and set the gates and staffing. You define the evidence each wave needs: a timed algorithm-change rehearsal on a system you control and, for moved funds, the destination’s authorization scheme. You also agree what the steering committee does when a chain’s upgrade activates later than your roadmap assumed.
Module 8 Year-one plan, KPIs, and the asks
You assemble the day’s work into a year-one plan by quarter. You set board KPIs for on-chain quantum exposure, custodial infrastructure PQC readiness, protocol PQC timeline alignment, and smart contract admin key exposure. You list the decisions you need from executives, business owners, and vendors, and the chain governance processes you will take part in. The instructor reviews each plan before the session ends.
Common questions
How technical is the day?
The day is about planning and program management. You need a working knowledge of your own custody operations and the chains you support, and no background in cryptography. The instructors explain the technical background to each decision in the module that needs it.
Do we need a cryptographic inventory before the day?
No. In Module 3, you plan the inventory from records you already hold. Teams that already have an inventory or a cryptographic bill of materials (CBOM) bring a summary and use it in Module 4.
Can one person attend alone?
Yes. You complete the same templates and note the questions that need a colleague. A mixed group from one organization can answer more of those questions in the room.
Is the intensive vendor-neutral?
Yes. We favor no custody platform, HSM vendor, wallet provider, or chain, and we judge algorithms and products against published standards and public evidence.
Where this course fits
We recommend Quantum-Safe Digital Assets as preparation, though you can enroll without it. It covers the same ground at overview depth. Participants who have taken it already know the terms we use during the day. Afterward, whoever will run the program can take PQC Migration Project Management. Whoever manages custody, wallet, and signing vendors can take PQC Vendor Governance and Supply Chain. Engineers who run your custody signing stack can take Cryptographic Agility: Design and Implementation.
Why we teach this
This intensive is built on the Digital Assets Extension of the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org. The course author wrote the framework. The instructors run migration programs in this sector and teach the constraints they meet in that work.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It is separate from our professional certifications and states your CPE credits, one for each 60 minutes of teaching. CISSP, CISM, CRISC and FRM holders can claim them with their certifying body. The credits also count toward renewing a Quantum Academy certification. Our CPE credits page explains how to claim them.
Enrollment includes 180 days of access to the corresponding online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
