Europol's European Cybercrime Centre published Quantum Computing and Cryptocurrencies — Bridging Technical Expertise and Decision-Making on October 7, 2026. The report separates a genuine future cryptographic weakness from exaggerated claims that a quantum computer can already empty ordinary wallets or rewrite a blockchain.
The main threat concerns public-key signatures that prove ownership of cryptocurrency, not an instantaneous failure of every hash function used by Bitcoin or Ethereum. Europol says machines capable of carrying out the relevant attacks do not yet exist, and it gives no reliable arrival date. Nevertheless, it urges exchanges, wallet developers, custodians and blockchain communities to begin coordinated migration planning before that capability exists.
What quantum computing could eventually break
Much of today's cryptocurrency custody uses public-key cryptography. A holder proves the right to spend by signing with a private key corresponding to a public key. A sufficiently capable error-corrected quantum computer could, in theory, run algorithms that recover certain classical private keys from exposed public keys. The economic result would be unauthorized signing and transfer, not necessarily a failure of the chain's block-production history.
Why 'hashing is broken' is the wrong headline
Hash functions and public-key signatures have different properties under known quantum algorithms. Hashes may suffer security-margin reductions in some future scenarios but are far more resistant than the elliptic-curve signatures used to authorize many wallet transfers. Europol's assessment emphasizes that the primary risk lies in wallet ownership credentials.
What is an exposed public key？
Some outputs or address structures make public keys visible before a subsequent spend. Older Bitcoin pay-to-public-key outputs and historical public-key reuse are often discussed as areas with longer exposure windows. The report and associated reporting cite approximately 6.9 million BTC in outputs linked to exposed public keys. This is an exposure estimate, not an assessment that 6.9 million coins have been stolen, compromised today or will necessarily be vulnerable at the same time.
A wallet's risk also depends on the address type, spending history and how keys are reused. Ordinary transaction signatures can disclose public-key material; mitigating the issue requires both better new-wallet designs and migration plans for existing holdings.
Why migrating old outputs is difficult
A global Bitcoin migration would require holders to identify affected outputs, generate safe destination credentials, execute valid transactions and fit migration transactions into available block space. Europol-associated analysis cites a 2024 study estimating at least 76 days of cumulative Bitcoin block capacity for a complete UTXO conversion, or roughly 300 days if only a quarter of space is dedicated to it. This is a model, not a scheduled migration date or guaranteed duration.
Post-quantum signatures may also be significantly larger than today's ECDSA signatures, creating fee, storage, block-size and validation trade-offs. Exchanges with millions of addresses and institutions with cold/offline signing infrastructure cannot safely replace everything overnight.
What 'crypto agility' means in practice
Crypto agility is the ability to update signing, authentication, hardware-security-module and recovery designs without disabling a financial system. For cryptocurrency platforms it may mean inventorying wallet types, testing quantum-resistant signature schemes, monitoring protocol proposals, coordinating with custodians and running phased credential rotation.
Because decentralized networks require broad agreement, a quantum-resistant upgrade also faces governance and economic questions: who pays migration fees, what happens to lost-key outputs, how legacy signatures are treated and whether frozen/dormant balances should be restricted. Those are unresolved policy questions, not Europol orders to freeze particular coins.
Is this a present emergency for self-custody users？
No practical quantum attack on crypto wallet signatures is identified in the current Europol release. Users should not send assets to unsolicited 'quantum safe upgrade addresses', reveal seed phrases or sign unfamiliar rescue transactions. An attacker could exploit fear of the report through phishing today even though the future cryptographic attack remains unfeasible.
For institutions, however, the planning horizon is relevant now: hardware procurement, custody integration, client communication and standards adoption can take years. A failure to start preparation early could become a severe operational bottleneck later.
Future risk versus confirmed loss
A future quantum capability would be a systemic cryptography issue, not necessarily an exploit of one wallet manufacturer. There is currently no confirmed loss amount, attacker wallet, incident timestamp or recovered-funds percentage associated with Europol's October 7 report.
The report should therefore be classified as High strategic custody risk, not Critical active hack. The 6.9 million BTC estimate is not a current 'funds at risk of immediate seizure' amount in the ordinary incident-loss sense.
Timeline
Before 2026 — Research and migration proposals
Academic work and protocol-development discussions assessed signature vulnerability, key reuse, larger post-quantum signatures and transaction-capacity requirements.
October 7, 2026 — Europol EC3 publication
Europol released its assessment and urged proactive crypto-agile planning by the cryptocurrency sector and policymakers.
Future — Capability and migration gates
The arrival of sufficiently powerful quantum hardware remains uncertain. Technical standards, real-world adoption and blockchain consensus must precede any robust large-scale transition.
Evidence Status
Confirmed — Europol
Official EC3 report published October 7; threat analysis focuses on wallet public-key cryptography; capable computers are not yet available; sector-wide early preparation is recommended; timelines uncertain.
Research / estimates
Roughly 6.9 million BTC in exposed-public-key output categories; modelled 76-day full-capacity and 300-day quarter-capacity migration scenarios; larger candidate signatures. These are research estimates, not official financial losses.
Developing
Standards adoption, network governance, quantum-hardware progress, migration protocols, treatment of dormant keys and final asset eligibility for new signature schemes.
Risk Assessment
High long-horizon cryptographic custody risk, Low immediate exploit evidence. The danger is the difficulty of migrating millions of wallets and legacy outputs once quantum capability becomes practical—not any observed live quantum theft in October 2026.
What to Watch Next
Wallet-standard updates, cryptographic-agility strategies at major custodians and exchanges, Bitcoin/Ethereum signature proposals, progress toward error-corrected quantum hardware and safe public communication that distinguishes planning from phishing.
FAQ
Has Europol confirmed a quantum wallet hack？
No.
How many BTC does the 6.9 million figure represent？
An estimate of holdings in output categories with exposed public keys; it is not stolen value.
Does quantum computing threaten blockchain hashing in the same way？
No. Signature-based wallet ownership is generally the more sensitive risk described in this assessment.
Is a quantum-safe migration already scheduled？
No universally adopted networkwide schedule was announced.
Should users move funds to a 'quantum recovery' address now？
Not on the basis of unsolicited messages; that is a phishing risk.
Why prepare before a capable machine exists？
Standards, infrastructure upgrades and old-output migration require long lead times and network coordination.
