The European Union’s law enforcement agency, Europol, is calling on the cryptocurrency sector to start adapting protocols and wallets to guard against quantum threats, cautioning that a coordinated transition could span several years. Released on Oct. 7, the agency’s report points to the cryptographic keys that govern funds as the primary area of vulnerability.
To withstand potential attacks from quantum computers, the agency suggests a phased shift toward quantum-resistant cryptography. This effort will require distributed labor among blockchain developers, wallet service providers, and everyday users—the latter of whom are advised to transfer their holdings into quantum-resistant wallets once they become accessible.
This advisory addresses future scenarios. According to Europol’s European Cybercrime Centre (EC3), quantum computers that possess the reliability and power needed to crack this cryptography do not currently exist, and the exact timeline for their development remains unclear. Nonetheless, early preparation is essential because updating millions of nodes and wallets relies on both technical modifications and widespread consensus across decentralized networks.
The EC3 publication draws a clear line between the cryptography used to secure funds and the hash functions that underpin vital elements of blockchain integrity.
Wallets depend on a private secret key to authorize transactions and a public key enabling the network to verify that approval. The agency points out that a fault-tolerant, sufficiently advanced quantum computer could potentially deduce a private key from a known public key. Such a breach could permit bad actors to forge signatures and access funds without authorization from the owner.
By contrast, hash functions face a different risk landscape. Europol views them as relatively robust against quantum assaults, though it notes they are not entirely immune. This distinction helps clarify why the report focuses heavily on safeguarding asset ownership and control without assuming every component of a blockchain is equally exposed.
By leveraging post-quantum cryptography and incremental updates, Europol contends that cryptocurrencies have a viable route toward adaptation. Carrying out this proposed defense relies on developers, providers, and users executing the necessary security measures.
The agency outlines specific duties for different industry participants. Core blockchain initiatives should prioritize building post-quantum cryptographic algorithms directly into their protocols while assisting wallet developers with the integration. Meanwhile, providers ought to test and release compatible wallets while informing users about the associated risks and advantages.
Europol also advises upgrading key and address management practices during the migration period. While these steps help minimize exposure, they serve as a complement to, rather than a replacement for, true quantum-resistant cryptography; simply transferring assets to a new address does not inherently render the underlying signature scheme secure against quantum threats.
Furthermore, the agency highlights the need for transparent communication concerning safeguards, timelines, and risks. Accessible explanations and clear roadmaps form a key part of its strategy, designed to help users prepare for upcoming shifts while preventing unnecessary panic over an uncertain technological schedule.
Why migration can take years
The document characterizes the rollout of novel cryptographic standards across millions of nodes and wallets as a complex, multi-year undertaking requiring substantial resources. Because technical changes must go hand in hand with community agreement, coordinating the migration process effectively becomes a security challenge on its own.
Implementing these changes may go beyond a standard software patch. Europol notes that older hardware wallets might require physical replacements if they fail to support the new setups. For assets tracked as unspent transaction outputs (UTXOs), executing the migration also demands on-chain transactions.
These requirements compound the difficulties of deploying larger post-quantum signatures alongside the necessity of user adoption. To navigate capacity, compatibility, and governance hurdles, Europol advocates for a phased strategy that prioritizes the assets facing the highest degree of risk.
Ultimately, the agency’s announcement urges the industry to prepare before the threat materializes. For the crypto ecosystem, the immediate priority involves testing upgrades, coordinating deployment strategies, and clarifying what future migrations will demand. Even though the precise arrival of a functional quantum computer remains unknown, the report stresses that the extensive preparation time required is the primary reason to begin work today.