Europol Says 6.9 Million Bitcoin (BTC) in Exposed Wallets Face Quantum Risk

Update 23:15 UTC: The report pushes back directly on the "quantum apocalypse" narrative that a future machine could shatter Bitcoin's ledger itself.

Europol's Twin Reports Point at Wallet Keys

Europol, the European Union's law enforcement agency, published two reports on Oct. 7 urging the crypto industry to prepare for quantum computers before practical attacks become possible. Its European Cybercrime Centre concludes in the first report, “Quantum Computing and Cryptocurrencies,” that the crypto wallet, not the blockchain itself, is the main point of exposure to future quantum threats. A sufficiently capable quantum machine could, in principle, work backward from an exposed public key to the private key that authorizes spending, allowing funds to be moved without the owner's consent. The agency estimates roughly 6.9 million Bitcoin (BTC) sits in addresses whose public keys are already visible on-chain, including Satoshi-era coins and long-dormant holdings. Hash functions that secure a chain's history are far more resistant, since breaking a 256-bit hash would take what the report calls an astronomically high number of operations with foreseeable technology. The warning concerns asset ownership rather than the Bitcoin price. Europol framed the timing itself as the core uncertainty: nobody knows when a capable machine arrives, but upgrading cryptographic systems across decentralized networks could take years, and the agency recommends a phased migration to quantum-resistant cryptography alongside stronger wallet security and key management.

Beyond the technical findings, the reports assign responsibility for preparation across the whole stack, naming blockchain developers, wallet providers, policymakers and users as each carrying a duty in the migration. Europol argues that coordinating upgrades on decentralized networks is uniquely difficult, which is why early action matters, and it calls on the industry to pursue "crypto agility," the capacity to swap in new encryption algorithms as they mature, regardless of when quantum capability arrives. On the harvest-now side, the agency singles out government communications, intellectual property, medical records and law enforcement files as the information most likely to be targeted for later decryption.

A new on-chain breakdown at block 950,000 offers a finer cut of the 6.9 million Bitcoin (BTC) exposure Europol cited. The dashboard data puts raw exposed supply at 6,900,573 BTC, or 34.45% of circulating coins, but argues practical theft risk is far narrower: active balances of at least 1 BTC account for 3,331,639 BTC, concentrated in 46,163 groups held mostly by exchanges, custodians and mining operators likely to migrate first. The stubborn core is dormant, never-spent exposure of 2,277,978 BTC across 73,658 groups once known entities are removed, with Satoshi-era coins retained. Attack economics compress the target set further: at the 100 BTC threshold the plausible victim pool shrinks to 351,654 BTC spread over just 675 groups and 33,573 UTXOs, mostly P2PKH outputs, turning the problem into a concentrated dormant-coin issue rather than uniform exposure.

The report pushes back directly on the "quantum apocalypse" narrative that a future machine could shatter Bitcoin's ledger itself. Europol's researchers calculate that Grover's algorithm, which speeds up search problems, would still require roughly 2^128 quantum operations to break a 256-bit hash, leaving proof-of-work and proof-of-stake chains protected by hash functions largely quantum-safe. The real vulnerability stays in public-key cryptography, where a machine running Shor's algorithm could derive private keys from public data and forge signatures. Exposed externally owned addresses, the agency concludes, cannot be fixed retroactively and must be abandoned for quantum-resistant alternatives. Its bottom line: crypto will not collapse under quantum computing, but the threat is "an imminent deadline" rather than a distant possibility, making the present the moment to act.

76 Days of Block Space for a Full Migration

The harder task is updating the network itself. Exposed keys cannot be made safe retroactively, and the report's remedy for old outputs is pre-emptive migration to fresh addresses before any attack, a path already dividing the Bitcoin (BTC) community over whether dormant Satoshi-era funds should be frozen or left alone. Migration carries costs of its own: post-quantum signature schemes standardized by NIST run 10 to 120 times larger than the ECDSA signatures Bitcoin uses today, which threatens to overload block space, raise fees and slow confirmations. A 2024 study cited in the document estimates a full conversion of every unspent transaction output needs at least 76 days of block space in total, stretching to about 300 days if a quarter of each block were reserved. Bitcoin's developers are already circling the problem: draft BIP-361 proposes moving away from legacy ECDSA and Schnorr signatures once a post-quantum output type exists, a consensus-level change comparable to a fork that has not been activated. Timing pressure is explicit: IBM targets a fault-tolerant machine by 2029, and a 2025 survey of 32 experts put the odds of breaking RSA-2048 within 24 hours inside the next decade at 28% to 49%.

Custodians and Standards Bodies Move First

The second report, “Harvest Now, Decrypt Later,” produced with Spain's University Carlos III of Madrid, examines attackers who store encrypted data today for decryption years from now; Europol found no clear evidence the technique is being exploited systematically at scale, given the storage and processing it would demand. Preparation on the crypto side is already under way. NIST approved three post-quantum standards, FIPS 203, FIPS 204 and FIPS 205, in August 2024 and has proposed deprecating today's most common public-key configurations by 2030, with classical public-key cryptography phased out by 2035. BitGo and Silence Laboratories tested post-quantum multiparty computation signing with the ML-DSA scheme earlier this year, and BitGo later added institutional wallet controls that measure public-key exposure and consolidate outputs. Coinbase's quantum advisory council urged developers in June to begin post-quantum migration work, and the company is designing custody infrastructure able to support different signature schemes while standards remain unsettled. In July, nine firms including BlackRock, Coinbase and Strategy pledged $15 million over three years for Bitcoin security research, on top of Galaxy Digital's $5 million program for quantum-resistant signature work, and Sui targets optional quantum-safe accounts on mainnet in 2027.

A Coordination Problem, Not a Collapse

COINOTAG's read: Europol's two reports land on the same diagnosis the industry's own researchers reached. The binding constraint is not cryptography but coordination, since any signature migration needs agreement among developers, custodians, miners and holders across a decentralized network, and the 6.9 million BTC exposure sharpens the unresolved question of what happens to dormant coins that never migrate. With IBM and Microsoft both pointing to 2029, the warning moves from distant theory to a scheduling question, and Europol's proposed Commission-led working group, which would include the EU cybersecurity agency ENISA and the bloc's Anti-Money Laundering Authority, would keep the file open on the regulator side (as of 17:51 UTC).