Europol says crypto’s quantum upgrade could take years and urges work to start now

Europol, the EU’s law enforcement agency, is urging the cryptocurrency industry to begin preparing wallet and protocol upgrades for quantum threats, warning that a coordinated migration could take years. Its report published Oct. 7 identifies the cryptographic keys controlling funds as the main point of exposure.

The agency recommends a phased transition to quantum-resistant cryptography, designed to withstand attacks from quantum computers, with blockchain developers, wallet providers and users taking different parts of the work. For users, its recommendation is to migrate funds to quantum-resistant wallets as those wallets become available.

The warning concerns a future capability. Europol’s European Cybercrime Centre (EC3) says quantum computers powerful and reliable enough to break the relevant cryptography do not yet exist, and their arrival remains uncertain. Early preparation matters because upgrading millions of wallets and nodes depends on both technical changes and agreement across decentralized networks.

The EC3 report separates the cryptography used to control funds from the hash functions supporting important aspects of blockchain integrity.

Wallets use a secret private key to authorize spending and a public key to let the network check that authorization. A sufficiently powerful, fault-tolerant quantum computer could derive a private key from an exposed public key, the agency says. That could allow an attacker to forge signatures and spend funds without the owner’s permission.

Hash functions have a different risk profile. Europol describes them as comparatively resilient to quantum attacks, while acknowledging that they are not entirely immune. That distinction helps explain the report’s emphasis on protecting ownership and control of assets without treating every part of a blockchain as equally vulnerable.

Europol argues that incremental upgrades and post-quantum cryptography give cryptocurrencies a path to adapt. Its proposed response depends on developers, providers and users completing the defensive changes.

Europol assigns responsibilities across the industry. Blockchain projects should prioritize integrating post-quantum cryptographic algorithms into their core protocols and support wallet providers in implementing those changes. Providers should begin testing and deploying compatible wallets and explain the risks and benefits to users.

Europol also recommends improving address and key management during the transition. Those measures can reduce exposure, but they complement adoption of quantum-resistant cryptography. Moving to a fresh address does not itself make the underlying signature technology resistant to quantum attacks.

The agency emphasizes understandable communication about risks, timelines and safeguards. Clear roadmaps and accessible explanations are part of its proposed response, helping users prepare for changes while reducing the risk of panic around an uncertain technological timetable.

Why migration can take years

The report describes deploying new cryptographic standards across millions of wallets and nodes as a resource-intensive, multi-year undertaking. Technical adoption must be matched by community consensus, making the organization of the transition a security concern in its own right.

Practical changes may extend beyond an ordinary software update. Europol says wallets could need hardware upgrades if existing devices become incompatible with the new arrangements. For holdings recorded as unspent transaction outputs, or UTXOs, migration also requires transactions registered on the blockchain.

Those demands add to deployment challenges associated with larger post-quantum signatures and the need for users to adopt new systems. Europol favors a phased approach and prioritizing holdings facing higher risk, allowing the ecosystem to work through compatibility, capacity and governance constraints.

The agency’s accompanying announcement calls for preparation before the threat becomes practical. For the cryptocurrency industry, the immediate task is to test upgrades, coordinate their deployment and explain future migration requirements. The timing of a capable quantum computer remains uncertain; the report’s rationale for starting now is the time needed to make those changes.