Approximately 6.9 million Bitcoin held in legacy or reused addresses face potential quantum vulnerabilities, a stash valued at roughly $586 billion, according to two reports published by Europol on October 7, 2026.

The European Union's law enforcement agency released the documents through its European Cybercrime Centre (EC3). Both point to cryptocurrency wallets as the primary attack surface if quantum computing matures into a practical cryptographic threat.

What did Europol identify?

The reports name wallets rather than any specific protocol or asset. Europol framed the weakness as a structural problem across the crypto spectrum, with the greatest exposure concentrated in addresses that have already broadcast public keys on-chain.

That distinction matters because public keys become visible after a transaction is sent. Once exposed, a sufficiently powerful quantum computer running Shor's algorithm could mathematically derive the private key and forge signatures.

Why are current wallets exposed?

Today's public-key cryptography relies on math that classical computers cannot reverse in any practical timeframe. Europol's concern is that quantum machines capable of running Shor's algorithm at scale would break that assumption entirely.

Shor's algorithm solves the mathematical problems underpinning modern public-key cryptography. A successful run would let an attacker derive a private key from an exposed public key and sign transactions as the legitimate owner.

The reports warn that without robust cryptographic protections, unauthorized fund transfers become technically feasible.

What is the "harvest now, decrypt later" risk?

The second theme across both documents is a tactic known by the acronym HNDL: harvest now, decrypt later. Adversaries collect encrypted data today, archive it, and decrypt once quantum hardware becomes capable.

Blockchains present a particular problem under this model. On-chain data is permanent and public. Information exposed today remains available to a future attacker indefinitely.

The 6.9 million Bitcoin figure, drawn from CryptoQuant estimates, illustrates the scale. Those coins sit in older address formats whose public keys have already been exposed on-chain, giving any future quantum adversary a ready target set.

What regulatory pressure is building?

Europol's warning lands alongside a September 2026 alert from the Joint Committee of European Supervisory Authorities (ESAs). That alert flagged the same risk: quantum hazards could arrive before commercial applications of the technology do.

The European Commission has set its own deadline. A Commission roadmap requires member states to begin transitioning to post-quantum security measures by the end of 2026.

What does the migration actually require?

Europol's recommended response is a phased, systematic move to quantum-resistant cryptography, addressed to blockchain developers, wallet providers, policymakers, and everyday users.

The most direct operational pressure lands on wallet providers and protocol developers. They would need to build, test, and ship post-quantum signature schemes, then drive user migration.

Migration is the hard part. A new cryptographic standard does nothing for coins that never move. Owners of dormant legacy addresses would need to transfer funds to quantum-resistant formats before any cutoff, a coordination problem rather than a purely technical one.

The reports also stress key management hygiene, including avoiding address reuse and minimizing time funds sit in older format addresses. The risk profile of any holding compounds the longer it remains in a vulnerable state.

How urgent is the timeline?

Europol did not claim quantum attacks on wallets are imminent. The agency's argument is lead time: cryptographic transitions take years, and the window for orderly migration narrows the longer the industry waits.

The end-2026 Commission deadline for member-state transitions is the first regulatory marker. Wallet providers and protocol teams operating in EU markets will face the most concrete compliance pressure as national implementations follow.