Europol released a report: Cryptocurrency wallets are a major risk point for quantum attacks

The European Union law enforcement agency Europol released two reports on Wednesday, urging the industry and policymakers to proactively address the threats posed by quantum computing. One report, titled "Quantum Computing and Cryptocurrency," written by Europol's European Cybercrime Centre, points out that cryptocurrency wallets are "the main exposure point for quantum threats." Wallets rely on private keys for authorized transactions and public keys for verification; sufficiently powerful quantum computers could derive private keys from exposed public keys, allowing attackers to access funds without authorization, a moment often referred to as Q-Day. The report states that the hash functions used to link blocks and support mining are fundamentally resistant to quantum attacks.

The report believes that cryptocurrencies will not collapse due to quantum computing but recommends adopting "proactive defenses," including a phased transition to quantum-resistant cryptography and improvements in wallet security and key management. Wallets with public keys already exposed on-chain cannot be remedied afterward; the report states that the only solution is to migrate in advance. Glassnode estimated in May this year that 6.04 million BTC (30.2% of the issued supply) public keys have been exposed. Upgrading Bitcoin also comes with costs: NIST standardized post-quantum signatures are 10 to 120 times larger than the ECDSA signatures currently used in Bitcoin, which could lead to block space overload and increased transaction fees. The report cites a 2024 study estimating that migrating all unspent transaction outputs would require at least 76 days of cumulative downtime.

The second report, "Collect First, Decrypt Later," was completed in collaboration with Carlos III University of Madrid, studying the behavior of attackers who collect encrypted data today and decrypt it later, finding risks in protocols such as TLS, SSH, and OpenPGP.