Europol tells crypto holders to move exposed wallet keys before quantum computers can break them
Europol named wallet keys as crypto's main quantum exposure, a risk that covers the 6.04 million bitcoin Glassnode counts with public keys already on-chain. Its report says those coins can be protected only by moving them before an attack, so the length of the migration queue sets the deadline for custodians.
The Investor · Invest desk
What happened
- Europol's cybercrime centre found the hash functions that link blocks and secure mining largely quantum-safe, calling the effort to break a 256-bit hash "astronomically high with foreseeable technology."
- A 2024 study the report cites puts migrating every unspent bitcoin output at 76 days of cumulative downtime, or roughly 300 days if the work took 25% of each block.
- NIST-standardised post-quantum signatures are 10 to 120 times larger than Bitcoin's ECDSA signatures, and the report warns they would crowd blocks and raise fees.
- Nine firms, BlackRock, Coinbase and Strategy among them, committed $15 million between them in July to fund three years of Bitcoin security research, with quantum defences part of the remit.
Why it matters
- Who has to decide decision Custodians holding coins at exposed addresses have to set a migration start date before any attack is credible, since Europol says those outputs cannot be secured after the fact.
- What it limits constraint A migration taking a quarter of each block leaves ordinary bitcoin payments three quarters of the network's capacity for about ten months.
- What it costs cost Holders pay for the move in transaction fees on far larger signatures, and the bill grows if they all try to move in the same few months.
Next story · Invest · 2d ago
Coinbase, custodian of about 5% of bitcoin, says quantum migration can take yearsConfirmed2 publishers
"Cryptocurrencies will not collapse due to quantum computing," the report concludes [7]. The danger it describes is narrower. A powerful enough machine could work out a private key from a public key already visible on-chain and spend the coins [2]. The report pairs moves by individual owners with a phased transition to quantum-resistant cryptography and better key management [8].
For a custodian, the figure to plan around is how long the move takes. At full blocks, the floor in the 2024 study is 76 days [5]. Give migration a quarter of each block and 76 divided by 0.25 is 304 days [20], close to the study's own figure of roughly 300. IBM's roadmap targets a fault-tolerant quantum computer by 2029 [13], and Microsoft expects scalable quantum computing in the same year [14]. To finish before such a machine exists, a migration has to start at least 304 days earlier, and that assumes the queue moves in order [20].
This could go differently in three ways. The first is a late machine: taken at face value, the surveyed experts put the odds that nobody breaks RSA-2048 within a day this decade at 51% to 72% [22]. That survey measured RSA, though. Google research in March and an AI-assisted competition in September both lowered the resources thought necessary to attack the elliptic-curve cryptography Bitcoin uses [15]. The second is an orderly start at a quarter of each block. The third is a late scramble toward the full-block floor, where migrations compete with every other transaction for space and post-quantum signatures push fees up [10].
I think the evidence supports starting custody migration plans now. The queue can be measured today and the attack date cannot. The case against rests on the survey's majority outcome: anyone who moves early pays fees for protection they may not need for ten years [22]. My view would weaken if a signature design sharply cut the block space each migrated output uses, or if estimates of what it costs to attack elliptic curves stopped falling [15].
Industry money so far is easy to size. The July pledge comes to $5 million a year [23], or about $556,000 per firm per year if the nine split it evenly [24]. Decrypt's report does not give the split. Coinbase's quantum advisory council urged developers in June to start migration work, and Ripple and the Stellar Development Foundation have published migration roadmaps [16].
For payments, the report rates real-time interception, which it calls a "just-in-time" attack, as a more immediate quantum risk than decrypting recorded data later [19]. Its companion study, on attackers who harvest encrypted data now to decrypt it later, found "currently no clear evidence" that the technique is being exploited systematically at scale [11].
What to watch
- Whether Bitcoin developers settle on a post-quantum signature scheme compact enough to cut the 76-day full-block migration floor.
- Any further cut in the resources estimated to break elliptic-curve keys, after Google's March research and September's AI-assisted competition.
- EU member states' post-quantum migration strategies, which the NIS Cooperation Group wants adopted by the end of 2026, and whether they reach crypto custodians.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption18
- Hype gap+8
- Incentives35
- Confidence68
Perspective Coverage
8 publishers- Builder
- Builder 42%
- Operator
- Operator 26%
- Investor
- Investor 32%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Europol's European Cybercrime Centre report, Quantum Computing and Cryptocurrencies, identifies cryptocurrency wallets as "the primary point of exposure to quantum threats."
- [2]
A sufficiently powerful quantum computer could derive a private key from an exposed public key, letting an attacker spend funds without authorization, the report says.
- [3]
Glassnode estimated in May that 6.04 million BTC, or 30.2% of the issued supply, has already had its public key exposed.
- [4]
Europol published two reports on Wednesday urging organizations, policymakers and the cryptocurrency industry to begin preparing now for quantum computers capable of breaking widely used encryption.
- [5]
A 2024 study cited by the report estimates that migrating every unspent transaction output would require at least 76 days of cumulative downtime, or roughly 300 days if the work took up 25% of each block.
- [6]
The hash functions that link blocks and underpin mining are largely quantum-safe, the report says, since breaking a 256-bit hash would take a number of operations it calls "astronomically high with foreseeable technology."
- [7]
"Cryptocurrencies will not collapse due to quantum computing"
- [8]
The report recommends a phased transition to quantum-resistant cryptography, alongside improvements to wallet security and key management.
- [9]
Wallets whose public keys are already visible on-chain cannot be secured after the fact; for those, "the only solution is pre-emptive migration," with owners moving funds to new wallets before any attack.
- [10]
NIST-standardized post-quantum signatures are 10 to 120 times larger than the ECDSA signatures Bitcoin uses; the report says this threatens to overload block space, raise fees and slow confirmations.
- [11]
The Harvest Now, Decrypt Later report says there is "currently no clear evidence" that the technique is being systematically exploited at scale.
- [12]
The EU's NIS Cooperation Group has recommended that member states adopt a post-quantum migration strategy by the end of 2026.
- [13]
The report cites IBM's roadmap, which targets a fault-tolerant quantum computer by 2029.
- [14]
Microsoft expects scalable quantum computing by 2029.
- [15]
Google research in March and an AI-assisted competition in September both lowered resource estimates for attacking the elliptic curve cryptography Bitcoin uses.
- [16]
Coinbase's quantum advisory council urged developers in June to begin post-quantum migration work, and Ripple and the Stellar Development Foundation have published migration roadmaps.
- [17]
In a 2025 survey cited by the report, 32 experts put the odds of a machine breaking RSA-2048 encryption in 24 hours within the next decade at 28% to 49%.
- [18]
In July, nine firms including BlackRock, Coinbase and Strategy pledged a combined $15 million over three years for Bitcoin security research, including quantum defenses.
- [19]
For payments, the cryptocurrency report says real-time interception poses a more immediate quantum risk than retrospective decryption, describing a "just-in-time" attack.
- [20]
At 25% of each block, the 76-day full-block migration floor stretches to about 304 days, consistent with the study's roughly 300.
- [21]
A migration using 25% of each block leaves 75% of capacity for other traffic for about 304 days, roughly ten months.
- [22]
The survey's 28% to 49% odds of a break imply 51% to 72% odds of no RSA-2048 break within 24 hours in the next decade.
- [23]
The $15 million pledge over three years is $5 million a year.
- [24]
Split evenly across nine firms, $5 million a year is about $556,000 per firm per year.
Sources
8 independent publishers whose own reporting we read for this story.
- coindesk.comQuantum computers threaten exposed private keys rather than blockchains, Europol warns
1 article · October 7, 2026
- crowdfundinsider.comEuropol Cautions that Quantum Computing Advancements Could Put Digital Assets at Risk
1 article · October 8, 2026
- crypto.newsEuropol warns crypto wallets face quantum threats
1 article · October 7, 2026
- cryptobriefing.comEuropol warns crypto wallets are the weak spot for future quantum attacks
2 articles · October 7, 2026
- cryptopolitan.comEuropol finds the quantum risk to crypto sits in exposed wallets, while blockchains hold up
1 article · October 7, 2026
- cryptoslate.comEuropol says crypto’s quantum upgrade could take years and urges work to start now
1 article · October 8, 2026
- decrypt.coEuropol Warns Crypto Wallets Are 'Primary Risk' for Quantum Attacks
1 article · October 7, 2026
- news.bitcoin.comEuropol Warns Quantum Threat Could Put Crypto Fortunes at Risk
1 article · October 7, 2026
Topics and entities
Topics
- Harvest Now, Decrypt Later Threat
- Quantum threats to cryptocurrency
- Post-Quantum Cryptography
Entities
- European Cybercrime Centre
- Microsoft
- Glassnode
- Europol
- University Carlos III of Madrid
- BitGo
- CryptoQuant
- National Institute of Standards and Technology
- Bitcoin
- NIS Cooperation Group
- Coinbase
- IBM
- ECDSA