Europol Says Quantum Risk Sits in Wallet Keys, Not Blockchains

Europol published two reports on 7 October about the security risks of quantum computing. For crypto, it points at one specific place: the cryptographic keys that control wallets and authorise transactions. The agency's press release calls those keys "the main point of exposure".

A sufficiently powerful quantum computer could derive a private key from an exposed public key, Europol says. An attacker could then move funds without the owner's permission.

The same release pushes back on the loudest version of the story. Europol says the cryptographic hash functions underpinning important aspects of blockchain integrity are comparatively resistant to quantum attacks. Its report also challenges predictions that quantum computing will inevitably cause cryptocurrencies to collapse. Both reports, produced by Europol's European Cybercrime Centre as part of the EMPACT cycle, call on organisations, policymakers and the crypto industry to begin preparing now.

The Key Is the Exposure, Not the Ledger

The split Europol draws is the useful part. The record-keeping side of a blockchain holds up: hashes are comparatively resistant, so the ledger's integrity is not the soft target. The keys that prove ownership and approve a transfer are.

That is a narrow problem. It is also a different one from the vague fear that quantum computers will empty every wallet. It applies where a public key is already out in the open, and where a private key could, in theory, be worked back out of it.

The second report, Harvest Now, Decrypt Later, covers the slower half of the risk. Its landing page says systems relying on asymmetric encryption such as RSA and ECC could be rendered obsolete by quantum algorithms such as Shor's algorithm. The technique does not require access to a quantum computer at the time the data is collected. Material captured today could be opened years later.

Europol adds a measured note to that: there is currently no clear evidence the harvest-now method is being systematically exploited at scale.

Europol Declines to Name a Date

If you came for a countdown, the reports do not offer one.

The timing of these capabilities remains uncertain. However, this should not be the main concern.

Instead of a deadline, Europol asks for a phased transition to quantum-resistant cryptography, supported by improvements to wallet security and key management. It also wants what it calls crypto-agility. In practice, that means building systems so the cryptography inside them can be replaced later without rebuilding everything around it.

crypto-agility should be pursued proactively to ensure that systems can withstand and overcome future threats while remaining secure.

Coordinating the Upgrade Is the Hard Part

A single company can swap its encryption stack. A public network with thousands of node operators, wallets and exchanges cannot move that quickly. That is the argument for starting before the threat is imminent.

Coordinating upgrades across decentralised networks will be a particular challenge, making early preparation essential.

For crypto, Europol frames preparation as coordinated work on protocols and wallets, plus clear information for users about future upgrades and migration requirements. That last clause is the closest its public material comes to an instruction for holders. When a network changes its signatures, someone has to tell you what to do and by when.

What Is Reported but Not Yet Verified

Europol's own publication pages list both reports. Their PDF download links returned no working file when checked, so the detail inside could not be read at first hand.

Secondary summaries of the crypto report describe a "just-in-time" attack. It exploits the gap between a transaction exposing its public key and being confirmed. They also attribute several numbers to the report. Post-quantum signatures run 10 to 120 times larger than the ECDSA signatures Bitcoin uses today, which the report says threatens block space and fees. A 2024 study puts migration of every unspent transaction output at no less than 76 days of cumulative downtime, or roughly 300 days at 25% of each block. IBM's roadmap targets a fault-tolerant quantum computer by 2029. And a 2025 survey of 32 experts gives 28% to 49% odds of breaking RSA-2048 in 24 hours within a decade.

The same summaries cite Glassnode's May estimate that 6.04 million BTC, or 30.2% of the issued supply, already has its public key exposed. They also report that NIST has proposed deprecating today's common public-key configurations by 2030. NIST would then phase out classical public-key cryptography by 2035. The EU's NIS Cooperation Group recommended member states adopt a post-quantum migration strategy by the end of 2026, according to those summaries. Europol also wants a European Commission-led working group with ENISA and the EU Anti-Money Laundering Authority to brief policymakers. None of those figures could be checked against the report itself.

What Holders Can Do Now

Europol's own material names no specific wallets or chains, and whether the reports go further could not be confirmed. The one instruction that appears in those secondary summaries is migration. Wallets whose public keys are already visible on-chain cannot be secured after the fact, so the only route is moving funds to new wallets before any attack. That line is reported, not something this desk could read in the report.

What is on the record is more modest. Keys are the part of crypto quantum computing can actually reach. The industry is being asked to make its cryptography replaceable. And the users of any network that does so will need to be told. Europol's conclusion is not that crypto collapses. It is that this is a migration problem, and migration is the thing decentralised networks are worst at doing on a schedule.