EU watchdogs issue stark quantum warning

On 24 September 2026 the Joint Committee of the European Supervisory Authorities (EBA, ESMA and EIOPA) released an Autumn 2026 Risk and Vulnerabilities report stating that advanced quantum computers could soon break the cryptographic primitives securing blockchains. The report warns that the threat may materialise before quantum hardware reaches commercial viability, potentially exposing roughly 6.9 million Bitcoin – valued at about $586 billion – to theft. The warning adds urgency to the long-standing debate over how Bitcoin should handle legacy addresses whose public keys are already visible on-chain.

Why legacy Bitcoin addresses are a weak spot

Bitcoin’s original transaction format, pay-to-public-key (P2PK), stores the public key directly in the output script. When a user spends that output, the public key is revealed, allowing a quantum adversary with a sufficiently powerful machine to apply Shor’s algorithm and derive the corresponding private key. Modern pay-to-script-hash (P2SH) and pay-to-witness-public-key-hash (P2WPKH) outputs hide the public key behind a hash, making them less immediately vulnerable. However, any address that has been reused or that still contains a P2PK output remains exposed.

According to Cryptoquant data cited in the EU report, about 6.9 million BTC sit in such vulnerable outputs. While the majority of unspent transaction outputs (UTXOs) are protected by hash-based scripts, the concentration of value in legacy wallets – many belonging to early adopters and institutional holders – creates a high-impact attack surface.

The “harvest-now, decrypt-later” scenario

The EU regulators stress that attackers could already be harvesting public keys from the blockchain, storing them for future decryption once a quantum computer reaches the necessary scale. This “harvest-now, decrypt-later” model means the risk is not purely speculative; it is a matter of timing. If a quantum machine capable of breaking elliptic-curve cryptography (ECC) emerges within the next few years, the stored keys could be decrypted retroactively, compromising funds that appear dormant today.

Technical feasibility timeline

The report does not provide a concrete date for when quantum computers will achieve the required qubit count and error-correction thresholds. However, a recent IBM roadmap predicts that commercially useful quantum processors could appear in four years or less. Independent analysis from the National Institute of Standards and Technology (NIST) aligns with a similar horizon for practical quantum attacks on ECC. While these timelines remain estimates, the convergence of multiple industry forecasts suggests that the window for proactive mitigation is narrowing.

Bitcoin’s upgrade dilemma

Unlike traditional financial institutions that can roll out post-quantum cryptography (PQC) via software patches, Bitcoin requires a network-wide consensus to change its signature scheme. Proposals such as switching from ECDSA/Schnorr to lattice-based or hash-based signatures have been discussed, but any hard fork would need overwhelming miner, developer, and user support. Moreover, holders of vulnerable coins would need to move their assets to quantum-resistant addresses before an attack occurs – a logistical challenge given the sheer volume of at-risk BTC.

The EU’s call for member states to begin post-quantum transitions by the end of 2026 underscores the regulatory pressure on the broader digital-asset ecosystem. While the report focuses on blockchain encryption, the same quantum risk applies to custodial services, DeFi protocols, and any system relying on ECC for key management.

Market reaction and immediate actions

The warning arrived amid a volatile market environment, with Bitcoin trading just below $84,000 and Treasury yields at multi-year highs. Although price impact was muted, the announcement prompted several custodians to issue advisories urging users to audit their wallets for legacy address exposure. Security-focused firms such as CertiK have updated their threat models to include quantum vectors, and Chainalysis continues to monitor illicit activity that could exploit future quantum breakthroughs.

For individual users, the actionable steps are clear:

  1. Identify any Bitcoin addresses that have ever revealed a public key (e.g., P2PK outputs or reused addresses). Tools that scan the blockchain for such patterns are emerging.
  2. Consolidate vulnerable funds into fresh P2WPKH or P2TR (Taproot) addresses, which hide the public key until spend time.
  3. Stay informed about upcoming Bitcoin Improvement Proposals (BIPs) that aim to introduce quantum-resistant signatures.

The broader crypto-industry perspective

Critics argue that the EU’s alarm may overstate the immediacy of the quantum threat, pointing out that no quantum computer today can break the 256-bit security level of Bitcoin’s elliptic curve. However, the regulators’ stance reflects a precautionary principle: the cost of a successful quantum attack would be catastrophic, justifying early preparation.

A controversial viewpoint emerges when we consider the opportunity cost of diverting development resources toward quantum readiness. Some developers contend that focusing on quantum-proofing could delay critical upgrades such as scaling solutions or privacy enhancements, potentially stalling Bitcoin’s competitive edge against faster, more adaptable blockchains.

The heightened security concerns also revive interest in privacy-focused exchanges. A zero-logging asset exchange claims to offer enhanced anonymity, though it does not mitigate quantum risk directly. A zero-logging asset exchange (Sponsored).

Corroborating reports

The quantum risk narrative aligns with analysis from cointelegraph.com, which highlighted the concentration of Bitcoin holdings in legacy addresses and the potential market shock of a large-scale quantum breach.

What to watch next

  • Post-quantum BIP submissions: Track any formal proposals submitted to Bitcoin Core that aim to replace ECDSA/Schnorr.
  • Regulatory follow-ups: The European Commission may issue binding directives for custodians to adopt quantum-resistant key management.
  • Quantum hardware milestones: Monitor announcements from IBM, Google, and Chinese research labs regarding qubit counts and error-correction breakthroughs.
  • Custodian migration patterns: Large custodians moving funds to newer address types could signal industry-wide risk mitigation.

By treating the quantum warning as a catalyst rather than a panic trigger, the crypto community can prioritize pragmatic upgrades while preserving the innovation pipeline that defines the space.

Explore more on this topic