The Migration Window: 'AI Breaks Crypto' Is the Wrong Frame for Web3's Real Deadline

Two numbers define the next decade of Web3 security, and neither appears on a price chart. The first is 2,432 bytes — the size of a single Dilithium-2 signature, the lattice-based scheme NIST standardized in August 2024 as FIPS 204. The second is 64 bytes — the size of an ECDSA signature that secures nearly every Bitcoin and Ethereum transaction settled today. The migration the industry is now being asked to undertake is not a patch. It is a roughly thirty-eight-fold expansion of the single most replicated object in the entire stack. I spent the past several months auditing how a handful of infrastructure teams are preparing for that expansion. Almost none of them framed it correctly. The conversation keeps drifting toward a phrase that sounds urgent and means very little: "AI is challenging cryptography." I heard it repeated in three separate governance calls this quarter, and in each one the speaker meant something different. That is the tell. When a claim means everything, it verifies nothing. Context That phrase is doing two jobs at once, and it does neither of them honestly. The primitive that actually threatens public-key systems is not artificial intelligence. It is Shor's algorithm running on a fault-tolerant quantum computer. Shor's breaks RSA and elliptic-curve cryptography — ECDSA, Schnorr, EdDSA — because it solves the discrete-logarithm problem in polynomial time. Grover's algorithm, its quieter cousin, halves the effective key strength of symmetric ciphers like AES. Both are quantum. Neither is AI. AI's relationship to cryptography is real but categorically different. It accelerates implementation-layer attack: fuzzing, side-channel analysis, automated exploit generation. It compresses the research timeline that might one day produce a cryptographically relevant quantum machine. It does not, today, break AES or ECC from first principles, and no credible paper claims otherwise. When I audited a $12 million ICO in 2017, the same pattern held in miniature: the loudest technical claim was almost always the least specific one. The two threats demand different responses on different clocks. The quantum threat is theoretical, distant, and systemic — a slow variable with a catastrophic tail. The AI threat is practical, present, and local — an accelerant poured on existing weaknesses. Merging them into one headline produces urgency without direction, which is precisely the condition under which bad capital and bad code both get funded. The standards landscape is further along than most Web3 engineers assume. NIST published three post-quantum standards in 2024: FIPS 203 (ML-KEM, built on CRYSTALS-Kyber), FIPS 204 (ML-DSA, built on CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, a hash-based scheme). The NSA's CNSA 2.0 suite sets a migration target of the early 2030s for national-security systems. The signal is unambiguous: the standards bodies have decided. The question is no longer whether to migrate, but when — and who coordinates it. On the Web3 side, that work is still in the discussion phase — EIP drafts, BIP threads, a scattering of research posts. There is no consensus timeline, no shared migration format, and no authority empowered to impose one. Strip away the branding and the practical question every holder should be asking right now is narrow and answerable: does the protocol that holds my assets have a migration plan, or a slogan? In a market where the marginal dollar is scarce, the difference between the two is measured in runway. A team that has modeled its PQC calldata costs has done the work. A team that has published a "quantum-ready" badge has done the marketing. The badge is cheaper. That is the whole problem. Core Start with the arithmetic, because the arithmetic is where most of the optimism dies. Ethereum's block gas limit sits near 30 million. A standard ECDSA transaction consumes roughly 21,000 gas for the base transfer and about 16 gas per non-zero calldata byte for the signature. A 64-byte ECDSA signature therefore costs on the order of 1,000 gas in calldata. Swap in a 2,432-byte Dilithium-2 signature and that same calldata line costs roughly 39,000 gas — before any verification logic runs, and lattice verification is itself more expensive than elliptic-curve verification. Based on my work auditing rollup calldata accounting, the compression tricks that make L2s cheap do not compress a lattice signature the way they compress an elliptic-curve one, because the entropy is distributed differently across the field. You cannot deduplicate randomness. The consequence is not "transactions get a bit more expensive." The consequence is that the throughput of the entire settlement layer changes by an order of magnitude unless the architecture changes with it. Aggregating lattice signatures is an open research problem, not a shipping feature. ZK rollups can absorb part of the load, but the proving cost of verifying PQC signatures inside a circuit is non-trivial — and in this market, provers are already operating on thin margins. The irony is sharp: the security upgrade that protects the chain is paid for out of the same budget that currently keeps it cheap. Then there is the part nobody wants to say out loud. On Bitcoin, a large fraction of the value at risk has already exposed its public keys. Early P2PK outputs, reused addresses, and dormant coins — including the roughly one million BTC attributed to Satoshi — sit in scripts whose public keys are permanently visible on-chain. Hashing protects unspent outputs that have never moved. It does not protect keys already revealed. For those coins, the quantum clock is not theoretical; it starts the moment a cryptographically relevant machine exists. There is no governance proposal that can retroactively hide a public key. The migration path that actually exists today is account abstraction. EIP-4337 lets an account define its own signature-verification logic. That means a wallet can adopt a post-quantum signature at the account layer — gradually, reversibly, without a protocol-level hard fork. It is the closest thing the ecosystem has to a controlled off-ramp, and I would treat it as the load-bearing structure of any credible migration plan. Code is the only law that holds, and account abstraction is the only place where that law can currently be amended without rewriting the constitution. Zoom out and the blast radius becomes clear. A cryptographic migration is not one upgrade; it is a coordinated rewrite of every layer that touches a key. Wallets must support new address formats and larger signatures. Exchanges and custodians must accept them without breaking deposit attribution. RPC providers and indexers must parse them. Cross-chain bridges must verify them on both ends. DeFi contracts that hard-code ecrecover must be rewritten, because the precompile assumes an elliptic-curve signature and will not accept a lattice one. Each of these is a separate team, a separate audit, and a separate failure mode. The migration is only as strong as the least prepared component, and there is always a least prepared component. What concerns me is the transition window. During any mixed regime — old and new signatures coexisting — bridges, exchanges, and custody systems become the weakest link. They aggregate assets and translate between signature schemes. They are exactly where an attacker would probe, and they are exactly where verification is most likely to be skipped for the sake of compatibility. I have watched this movie before, at smaller scale: in 2022, during the worst of the winter, the protocols that failed were rarely the ones with the weakest cryptography. They were the ones that had made an exception to their own rules to move faster. And beneath all of it sits a coordination problem that no algorithm solves. Cryptographic migration is a public good. Every chain benefits from a shared, tested, standard migration format. No single chain can capture the full return on producing one, and no single chain can force the others to adopt it. This is the classic underprovision trap: everyone knows the work is necessary, and no one is incentivized to pay for it first. Governance isn't a vote; it's a verification — and verification at ecosystem scale requires a coordinator that does not currently exist. Contrarian Angle Here is the counterintuitive claim, and it is the one the headline buries. The greatest near-term risk is not the cryptographic threat. It is the response to it. Post-quantum algorithms are young. Lattice-based cryptography earned NIST standardization in 2024, which is recent in a field where confidence is earned over decades of adversarial scrutiny. These schemes have not yet survived the equivalent of the cryptanalysis that dismantled earlier proposals, and the history of standardization is littered with algorithms that looked strong and were not. A rushed hard migration does not eliminate risk. It trades a known, quantified, distant risk for an unknown, unquantified, immediate one. This is the correct reading of "Web3 must prepare but must not migrate hastily." It is not fence-sitting. It is risk management, and it holds two ideas at once: the clock is real, and panic is itself a vulnerability. Skepticism is the first line of defense — against the threat, and equally against the cure. There is a second, quieter risk: narrative capture. When a headline fuses AI and cryptography, capital follows the story rather than the threat model. Projects that own no cryptography begin to market "quantum resistance." Speculative money chases a five-to-ten-year infrastructure problem as though it were a next-quarter catalyst. In a bear market, where survival already depends on not misallocating scarce resources, that misallocation is not cosmetic. It is the difference between a protocol that funds real research and one that funds a press release. Takeaway So where does that leave the ledger? The threat is real, slow, and systemic. The standards are decided. The implementation is unsolved. The coordination is nonexistent. None of those four facts is going to change because a headline said "AI." The correct posture for the next cycle is unglamorous: fund the research, prototype at the account layer, keep every migration reversible, and refuse to ship a signature scheme merely because a competitor announced one. Verify everything, trust nothing — and in this specific case, trust the algorithm only after the cryptanalysts have had a decade to try to break it. The ecosystem that survives the next decade will not be the one that moved fastest. It will be the one that moved in order.