Europol published two reports on October 7, 2026, on how quantum computers could expose cryptocurrency wallets and decrypt sensitive data collected years earlier. The European Union’s law enforcement agency urged organizations, policymakers, and the cryptocurrency industry to begin preparing now.
Europol said the timing of those quantum capabilities is uncertain but “should not be the main concern,” because adapting systems and coordinating security upgrades will take time. The agency also said “crypto-agility should be pursued proactively,” meaning that organizations should be able to replace cryptographic algorithms quickly.
In neither report did Europol give its own forecast of when a quantum computer could break current encryption. In the reports, the agency set out which assets it considers most exposed and what different groups of users should do first.
Cryptocurrency report
Europol’s European Cybercrime Centre (EC3) produced the first report, Quantum Computing and Cryptocurrencies. EC3 identified the public-key cryptography used to authorize transactions and control funds in wallets as the main exposure.
Wallet owners sign each transaction with a private key that others check against a matching public key. EC3 wrote that Shor’s algorithm, run on a large enough quantum computer, would derive a private key from its public key. An attacker could then sign transactions in the owner’s name.
EC3 described the hash functions used in proof-of-work mining and in linking blocks as “largely quantum-safe.” Hash functions are one-way calculations that reduce data to a short, fixed-length fingerprint. EC3 also rejected predictions that quantum computing will end cryptocurrencies and called proactive adaptation the most likely outcome.
EC3 grouped its recommended defenses into three types: incremental upgrades such as multi-signature schemes, a move to NIST-standardized post-quantum algorithms designed to resist quantum attacks, and quantum key distribution. For quantum key distribution, a method of sharing encryption keys over optical links using quantum physics, EC3 wrote that “scalability remains a challenge.” A multi-signature wallet built only from elliptic-curve keys remains open to the same quantum attack, and quantum key distribution does not replace the signatures that authorize blockchain transactions.
EC3 advised users to “proactively migrate funds to quantum-resistant wallets as they become available.” It proposed a working group led by the European Commission and including EU agencies such as Europol, the cybersecurity agency ENISA, the EU institutions’ cybersecurity team CERT-EU, and the Anti-Money Laundering Authority. It also asked policymakers to assess whether central bank digital currencies are vulnerable to quantum attacks.
Harvest now, decrypt later
Europol and Universidad Carlos III de Madrid developed the second report, Harvest Now, Decrypt Later, through Europol’s advisory group on research and development. In a harvest-now, decrypt-later (HNDL) attack, an adversary records encrypted data today and decrypts it once a quantum computer can break the encryption.
The authors based their protocol analysis on a March 2026 preprint by five researchers at the Madrid university. They found that recorded TLS and SSH sessions set up with classical key exchange are susceptible, as are files encrypted with OpenPGP’s classical public-key algorithms. TLS and SSH are the protocols that secure web traffic and remote server logins.
Under TLS 1.2 with RSA key transport, in which a server’s long-term key protects every session key, “obtaining the server’s private key can be enough to decrypt past recorded TLS 1.2 sessions,” the authors wrote.
With forward secrecy, which standard TLS 1.3 handshakes and common SSH configurations provide, the two sides agree on a fresh key for each session. An attacker would then have to break each recorded session separately. The authors wrote that both TLS versions remain vulnerable to a quantum attacker.
Europol rated the risk as high for governments, citing diplomatic cables, intelligence reports, and law enforcement case files, including informant identities. It rated the risk for companies as medium to high and for citizens as low to medium.
The authors wrote that there is “currently no clear evidence that HNDL is being systematically exploited at scale.” They wrote that HNDL is “currently mostly viable against high-value targets where long-term confidentiality is critical.”
For those it rated at high risk, a group that includes governments, Europol recommended disabling TLS 1.0 and 1.1 immediately, starting pilot projects that include hybrid cryptography, and developing a national post-quantum strategy. In hybrid key exchange, two computers agree on a key by using a classical algorithm and a post-quantum algorithm together, so an attacker would need to break both.
For those at medium risk, Europol recommended upgrading to TLS 1.3, enforcing forward secrecy, and limiting long-term storage of confidential information. The authors wrote that OpenSSL and OpenSSH already ship a hybrid post-quantum and classical key exchange by default.
They also wrote that attackers can already compromise TLS 1.0 and 1.1 with classical techniques. They called continued use of those versions an immediate “Harvest Now, Decrypt Now” risk.
EU deadlines
EU member states adopted a coordinated post-quantum roadmap in June 2025 through the NIS Cooperation Group, with the European Commission’s support. Under the roadmap, all member states should start transitioning to post-quantum cryptography by the end of 2026. According to the Commission’s summary, high-risk use cases should be moved to post-quantum cryptography “as soon as possible, no later than by the end of 2030.”
