Europol report suggests quantum computers threaten crypto wallets, not the blockchain
A quantum computer powerful enough to break today’s public-key cryptography would not unravel the Bitcoin ledger, according to a report from Europol’s European Cybercrime Centre. The larger risk lies in the digital signatures that prove who owns the coins recorded on it.
The report, titled “Quantum Computing and Cryptocurrencies,” separates cryptocurrency security into two layers. The Europol analysts write that the hash functions that link blocks and secure consensus remain largely resistant to known quantum attack while the elliptic-curve keys that control wallets do not. According to the agency, cryptocurrencies are more likely to adapt than collapse, provided developers, wallet providers and users migrate to post-quantum cryptography before a capable machine exists.
What Can a Quantum Computer Actually Break?
Two quantum algorithms matter for cryptography, and they affect it in very different ways.
Shor’s algorithm solves integer factorization and discrete logarithms efficiently. Both are math problems that are easy to compute in one direction but extraordinarily hard to reverse, much as multiplying two large prime numbers is simple while working backward from the result to find those two primes would take a conventional computer longer than the age of the universe.
Those two problems underpin RSA, Diffie-Hellman and elliptic-curve cryptography, including the curve Bitcoin and Ethereum use to sign transactions. A sufficiently large, fault-tolerant quantum computer running Shor’s algorithm could derive a private key from its public key, according to the report.
The report at times describes this threat as decryption. For cryptocurrencies, the more precise term is forgery, because a blockchain signature authorizes a payment rather than hiding data. An attacker holding a derived private key could sign transactions that the network would accept as legitimate.
Grover’s algorithm is far less damaging because it offers a quadratic speedup for brute-force search, which weakens hash functions and symmetric ciphers without breaking them. A 256-bit hash still retains roughly 128 bits of security against a quantum search, a margin the report describes as astronomically high for any foreseeable technology.
Why Is the Blockchain Itself Considered Safe?
The ledger’s integrity rests on hash functions, which fall into Grover’s weaker category. Each block carries a hash of the previous block, so altering any past transaction would require recomputing every block that follows it.
In proof-of-work networks such as Bitcoin, miners compete to find inputs that produce a hash meeting a difficulty target. In proof-of-stake networks such as Ethereum, validators are selected by the collateral they stake, but hashes still chain the blocks together. In both designs, the network verifies a new block through hash functions and consensus rules rather than through the signatures that secure funds, according to the report.
Europol qualifies its conclusion with care. It describes these mechanisms as largely quantum-safe and expects them to hold at least in the medium term, rather than calling them immune.
Why Are Wallets the Weak Point?
Every wallet depends on a key pair. The private key signs transactions, and the public key lets the network verify them. Shor’s algorithm attacks the link between the two, which is why Europol identifies wallet security as the primary point of exposure.
How exposed a given wallet is depends on whether its public key is visible on the chain. Many Bitcoin address formats publish only a hash of the public key until the coins are spent. Older pay-to-public-key outputs, reused addresses and Taproot outputs place the key itself on the ledger, where anyone can collect it.
Once a public key is exposed, no cryptographic fix can protect it after the fact, the report writes. The only remedy is moving the funds to a new, unexposed address before an attack becomes possible. Because no central authority can revoke keys or force upgrades, coins left in exposed addresses would remain at risk indefinitely.
The report also describes a narrower threat that researchers Jamie Pont and colleagues call a just-in-time attack. Even a well-protected transaction reveals its public key while it waits to be confirmed. A fast enough quantum computer could derive the private key in that window and redirect the funds.
One caution applies to the report’s treatment of Taproot, the 2021 Bitcoin upgrade it cites as evidence that incremental change is possible. The report states that Taproot offers no quantum resistance. Because Taproot outputs commit directly to a public key, they are exposed before they are ever spent.
When Could a Quantum Computer Pose a Real Threat?
No machine capable of running Shor’s algorithm at cryptographic scale exists today. Europol draws its timeline from the Global Risk Institute’s 2025 Quantum Threat Timeline Report, which surveyed 32 experts from academia and industry.
Respondents put the likelihood of a quantum computer breaking RSA-2048 within 24 hours at 5% to 15% within five years, 28% to 49% within 10 years and 51% to 70% within 15 years. The ranges reflect pessimistic and optimistic readings of the responses. The report also points to IBM’s target of a fault-tolerant quantum computer by 2029 and Google’s stated goal of an error-corrected machine within the decade.
Readers should treat the survey as an indirect guide for cryptocurrencies. It measures RSA-2048, not the 256-bit elliptic curves that secure Bitcoin and Ethereum. Published resource estimates have generally found that breaking 256-bit elliptic-curve keys requires fewer logical qubits than breaking RSA-2048, so the survey may understate the near-term risk to wallets.
How Hard Would the Migration Be?
The replacement algorithms already exist. In 2024 the National Institute of Standards and Technology finalized FIPS 203, FIPS 204 and FIPS 205, which define ML-KEM for key establishment and the ML-DSA and SLH-DSA signature schemes. The report refers to the first two by their pre-standard names, CRYSTALS-Kyber and CRYSTALS-Dilithium.
The obstacle is execution. Post-quantum signatures are 10 to 120 times larger than ECDSA signatures, according to the report, which would consume scarce block space and raise fees. The exact multiple depends on the scheme and parameter set. An ML-DSA-44 signature runs 2,420 bytes against roughly 72 bytes for ECDSA, while SLH-DSA signatures range from about 7.9 kilobytes to nearly 50 kilobytes.
Governance adds delay. The report cites a 90% miner threshold for significant Bitcoin changes, a figure that reflects the activation mechanism used for Taproot rather than a fixed protocol rule. Earlier soft forks used a 95% threshold, and the 2015 to 2017 dispute over Segregated Witness showed how contentious such upgrades can become.
The physical migration would also take time. Pont and colleagues estimated that moving every unspent Bitcoin output to quantum-safe addresses would require at least 76 days of cumulative network downtime. Dedicating a quarter of each block to the effort would stretch the process to roughly 300 days, the report writes. Hardware wallets may need replacement as well as software updates.
Smaller networks have shown the approach can work. The Quantum Resistant Ledger has used hash-based XMSS signatures since its launch, though its transaction volume is a small fraction of Bitcoin’s.
What Does Europol Recommend?
The report assigns responsibilities across the ecosystem. Regulators should set clear guidelines for post-quantum adoption and encourage industry collaboration. Blockchain projects should build post-quantum algorithms into their core protocols and support wallet providers through the change. Wallet providers should begin testing and deploying post-quantum wallets, and users should move funds into them as they become available.
In the near term, Europol recommends interim measures such as account abstraction, multisignature schemes and avoiding address reuse. It describes these as ways to buy time rather than substitutes for post-quantum cryptography. The agency views quantum key distribution and other quantum-based defenses as promising but impractical at blockchain scale for now.
At the policy level, Europol calls for a European Commission-led working group that would include ENISA, CERT-EU, the EU Anti-Money Laundering Authority and Europol itself. It also urges policymakers to assess the quantum exposure of central bank digital currencies in cooperation with the European Central Bank.
The report’s central message is that the threat is manageable if the work starts early. Cryptocurrencies will not collapse because of quantum computing, Europol writes, but their long-term security depends on a coordinated transition that begins well before a cryptographically relevant machine arrives.
Photo Credit: 2025 Opinion-based estimates of the likelihood of a digital quantum computer able to break
RSA-2048 in 24 hours, as function of time. (source: Quantum Threat Timeline Report 2025 – EvolutionQ,
GRI)
