Given two points $P_1 = (x_1,y_1)$ and $P_2 = (x_2, y_2)$ on an elliptic curve $y^2 = x^3 + ax +b$, the sum $P_3$ of $P_1$ and $P_2$ is $P_3 = P_1 + P_2 = (x_3,y_3)$ where $x_3 = \lambda^2 - x_1 - x_2$ and $y_3 = y_1 + \lambda(x_3 - x_1)$ where $\lambda = (y_1 - y_2)/(x_1 - x_2)$ if $P_1 \neq P_2$ and $\lambda = (3x_1^2 + a)/(2y_1)$ if $P_1 = P_2$. The case $P_1 \neq P_2$ is called point addition and the case $P_1 = P_2$ is called point doubling.
Let $M, A, S, D$ denote the operation of multiplication, addition, subtraction, and division in the underlying field. Then we see that with the previous formulas,
- the evaluation of $x_3$ requires $1M + 2S$;
- the evaluation of $y_3$ requires $1M + 1A + 1S$;
- the evaluation of $\lambda$ requires $2S + 1D$ if $P_1 \neq P_2$ and $1M + 4A + 1D$ if $P_1 = P_2$ [I assume here that $3x_1^2$ is evaluated as $x_1^2 + x_1^2 + x_1^2$ ($2A$) and $2y_1$ as $2y_1 = y_1+y_1$ ($2A$)].
Hence, we obtain that
- a point addition requires $2M + 1A + 5S + 1D$;
- a point doubling requires $3M + 5A + 3S + 1D$.
Back to your question now,
- the evaluation of $kG$ requires $k-1$ point additions using the first method, that is, $2(k-1)M + (k-1)A + 5(k-1)S + (k-1)D$;
- letting $\ell$ the binary length of $k$ (i.e., $\ell = \lfloor\log_2 k\rfloor + 1$) and $h$ the Hamming weight of $k$ (i.e., the number of bits equal to $1$ in the binary representation of $k$), the evaluation of $kG$ requires $\ell$ point doublings and $h$ point additions using the double-and-add method, that is, $(3\ell+2h)M + (5\ell+h)A + (3\ell+5h)S + (\ell+h)D$. On average, for a random $\ell$-bit integer $k$, we have $h = \ell/2$; in which case, we get $4\ell M + 5.5\ell A + 5.5\ell S + 1.5\ell D$.
It is worth noting that the first method is completely impractical for cryptographic applications since $\ell$ is typically $256$ and thus $k \approx 2^{256}$.
