European financial regulators have added quantum computing to their official risk map, warning that a sufficiently powerful quantum computer could break the cryptography protecting blockchain networks before the technology becomes commercially viable. About 6.9 million bitcoin, worth roughly $586 billion, sit in addresses regulators call especially exposed.
EU Watchdogs Flag a Quantum Risk to Bitcoin
The Joint Committee of the European Supervisory Authorities — the European Banking Authority, the European Securities and Markets Authority, and the European Insurance and Occupational Pensions Authority — warned that an advanced quantum computer could undermine cryptography systems used to secure blockchains. According to the ESAs' Autumn 2026 Risk and Vulnerabilities report released Wednesday: "Threats could materialize earlier than any viable commercial application."
Publishing their Autumn 2026 Joint Committee Risk Update on September 23, 2026, the regulators listed quantum computing alongside AI-driven cyber risk and private credit as emerging systemic threats. The core concern is a so-called "harvest now, decrypt later" attack, where adversaries collect encrypted data and exposed public keys now, intending to decrypt them once a powerful enough quantum machine exists.
Older Bitcoin Addresses Carry the Most Exposure
Roughly 6.9 million bitcoin, worth roughly $586 billion, are currently vulnerable, according to Cryptoquant. Older or reused addresses face the greatest risk because their public keys may already be visible onchain, which would let a sufficiently powerful quantum computer derive the private key and take control of the coins. Many unspent bitcoin outputs, by contrast, still hide the public key behind a cryptographic hash, leaving them less exposed for now.
A recent IBM report says commercially viable quantum computing could arrive in four years or less. Moving bitcoin to quantum-resistant signatures would require network-wide consensus, and holders of exposed coins would need to move them before such an attack becomes possible.
Regulators and Networks Set Migration Deadlines
The European Commission has urged member states to begin post-quantum transitions by the end of 2026, with high-risk use cases protected by 2030. Coinbase is separately building post-quantum custody for $250 billion in institutional assets, while Ethereum has set a target of a quantum-resistant Layer 1 by December 2029. Bitcoin's own path remains less settled than either.
Trading involves risk.
Risk Disclaimer
