Europol says crypto’s quantum upgrade could take years and urges work to start now

Europol, the EU’s law enforcement agency, is urging the cryptocurrency industry to begin preparing wallet and protocol upgrades for quantum threats, warning that a coordinated migration could take years. Its report published Oct. 7 identifies the cryptographic keys controlling funds as the main point of exposure.

The agency recommends a phased transition to quantum-resistant cryptography, designed to withstand attacks from quantum computers, with blockchain developers, wallet providers and users taking different parts of the work. For users, its recommendation is to migrate funds to quantum-resistant wallets as those wallets become available.

The warning concerns a future capability. Europol’s European Cybercrime Centre (EC3) says quantum computers powerful and reliable enough to break the relevant cryptography do not yet exist, and their arrival remains uncertain. Early preparation matters because upgrading millions of wallets and nodes depends on both technical changes and agreement across decentralized networks.

The EC3 report separates the cryptography used to control funds from the hash functions supporting important aspects of blockchain integrity.

Wallets use a secret private key to authorize spending and a public key to let the network check that authorization. A sufficiently powerful, fault-tolerant quantum computer could derive a private key from an exposed public key, the agency says. That could allow an attacker to forge signatures and spend funds without the owner’s permission.

Hash functions have a different risk profile. Europol describes them as comparatively resilient to quantum attacks, while acknowledging that they are not entirely immune. That distinction helps explain the report’s emphasis on protecting ownership and control of assets without treating every part of a blockchain as equally vulnerable.

Europol argues that incremental upgrades and post-quantum cryptography give cryptocurrencies a path to adapt. Its proposed response depends on developers, providers and users completing the defensive changes.