Quantum computing has been crypto's slow-motion boogeyman for years — a threat everyone acknowledges and nobody treats as urgent. The Joint Committee of the European Supervisory Authorities, which covers the EU's banking, securities, and insurance regulators, just made it a lot harder to keep deferring: their new warning says the threat to blockchain encryption could materialize before a quantum computer is even commercially viable for anything else.

The core warning

The Joint Committee — spanning the European Banking Authority, the European Securities and Markets Authority, and the European Insurance and Occupational Pensions Authority — cautioned that a sufficiently advanced quantum computer could eventually undermine the cryptographic systems protecting blockchains generally, Bitcoin included. The pointed part of the warning is the timeline: threats, the authorities said, could arrive earlier than any viable commercial application for the technology, meaning the first real-world use of a cryptography-breaking quantum computer might be an attack, not a product launch. That's a notably more urgent framing than the industry's usual "this is decades away" shrug, and it lines up with an IBM estimate cited in the same reporting that puts a working system as close as four years out.

Which bitcoin is actually exposed

The number that makes this concrete: roughly 6.9 million bitcoin, worth about $586 billion at current prices, sits in addresses where the underlying public key is already visible on-chain — typically because the address has been reused or has made at least one outgoing transaction. That matters because Bitcoin's actual cryptographic protection relies on the public key staying effectively one-way: easy to derive an address from a public key, practically impossible to derive the private key from a public key using classical computers. A large enough quantum computer running Shor's algorithm could break that one-way assumption, meaning any address with an exposed public key is a lock a quantum computer could eventually pick. Addresses that have only ever received funds and never spent from them keep their public key hidden and are considerably better protected — one practical reason security-conscious holders are told never to reuse an address.

'Harvest now, decrypt later' is the part that makes this urgent today

The scariest part of the warning isn't a future quantum computer — it's what can be done right now in preparation for one. An attacker doesn't need a working quantum computer today to benefit from one eventually; they just need to record the exposed, currently-public data now and hold onto it until decryption becomes possible. Every exposed bitcoin public key sitting on-chain today is already harvestable in exactly that sense. That's why regulators are pushing urgency now rather than waiting for quantum computers to actually arrive — the vulnerable data is being created and exposed continuously, and none of it can be retroactively hidden once it's on a public blockchain.

What the fix actually looks like

The European Commission's own post-quantum roadmap calls for member states to begin transitioning to quantum-resistant cryptography by the end of 2026, with high-risk systems protected by 2030. For Bitcoin specifically, the fix is much messier than a routine software update: it requires network-wide consensus on a new cryptographic standard, and — critically — it requires every holder with coins in an exposed address to actually move those coins to a new, quantum-resistant address before an attack happens, not after. Coins belonging to lost keys, dormant wallets, or holders who simply never get the message (Satoshi's own early holdings among them) would have no such recourse and would remain exposed indefinitely.

Why it matters

This isn't a reason to panic-sell bitcoin — the timeline, even on the EU's more urgent framing, is still years away, and Ethereum, Solana, and other major networks face structurally similar exposure and are having the same internal conversations about post-quantum migration. But it is a reason for anyone holding bitcoin in an old, reused, or previously-spent-from address to understand that "quantum-safe" isn't a binary industry-wide switch that flips on one day — it's a per-address migration that depends on individual holders actually acting, and the addresses most at risk are disproportionately the oldest, most dormant ones with the least active management behind them.

Further reading

Frequently asked

Can quantum computers break Bitcoin today?

No. No quantum computer built so far comes close to the scale needed to break the cryptography protecting Bitcoin. The EU warning is about the timeline shrinking faster than expected and the specific vulnerability window that opens well before a quantum computer is powerful enough for ordinary commercial use.

Why are some bitcoin addresses more at risk than others?

The risk applies specifically to addresses where the public key has already been exposed on-chain — typically reused addresses, or addresses that have made an outgoing transaction. A sufficiently powerful quantum computer could theoretically derive the private key from an exposed public key; addresses that have only ever received funds and never spent from them don't expose their public key at all, and are much better protected.

What is 'harvest now, decrypt later' and why does it matter for crypto held today?

It's the strategy of recording encrypted or exposed data today with the intent of decrypting it once quantum computers become powerful enough — meaning an attacker doesn't need a working quantum computer right now to eventually compromise old, exposed bitcoin addresses. That's why the EU's warning is framed as urgent even though no current quantum computer poses an immediate threat: the data being harvested today is exactly the exposed public keys already sitting on the blockchain.