Europol has warned that advances in quantum computing could eventually place crypto-assets at risk, and it is urging the industry, policymakers and technical operators to start preparing well before any such capability exists.On 7 October 2026 the EU law-enforcement agency released two studies examining how future quantum machines might undermine today’s cryptography.
One, produced by the European Cybercrime Centre, focuses on digital assets.
The other, prepared with Universidad Carlos III de Madrid, looks at the broader problem of encrypted information that could be stored now and broken open later.
Together they argue that the uncertain timing of practical quantum attacks is less important than the long lead time needed to redesign systems, coordinate upgrades and keep services running during a migration.
For cryptocurrencies, the agency’s central finding is that wallets, not the ledgers themselves, are the main point of exposure.
Control of funds rests on a pair of cryptographic keys: a private key that authorises a transfer and a public key that the network uses to check it.
If a public key has already been revealed on-chain, a sufficiently powerful quantum computer could, in principle, work backwards from that public key to recover the private one and move the associated coins without the owner’s consent.
Hash functions that secure mining and link blocks are described as comparatively more resistant, so the integrity of the chain is not the immediate concern.
The practical risk is unauthorised control of assets whose keys are already visible.
That distinction undercuts predictions of an automatic collapse of crypto markets. Europol’s assessment is that networks can adapt if they move early to cryptography designed to resist both conventional and quantum attacks.
The recommended path is a staged shift, paired with stronger wallet practices and clearer key management.
Developers, wallet providers, policymakers and holders each have a role.
Because many networks are decentralised, agreeing on and rolling out protocol changes is expected to be slow and uneven, which is why preparation cannot wait until machines capable of the attack are close.
The second study addresses a related tactic sometimes called harvest-now, decrypt-later.
Adversaries could collect encrypted traffic or stored files today, without needing a quantum computer at the moment of collection, and attempt decryption once stronger machines appear.
The technique is most relevant to material that must stay confidential for many years, such as government communications, intellectual property, medical records and investigative files.
Exposure would depend on the protocols, configurations and key-handling methods in use.
Europol notes there is no clear evidence the method is already being used systematically at scale, and that it would demand substantial storage and processing resources, so high-value, long-lived data is the more plausible target. Even so, the agency says the possible consequences justify action now.
Both reports advise organisations to map where cryptography is used, rank assets by how long they must remain protected, and prioritise the systems most exposed.
Practical steps include retiring outdated protocols, limiting unnecessary retention of sensitive data, building more flexible key management and testing post-quantum options while older systems still operate.
For the crypto sector specifically, that means coordinated work on protocols and wallets, plus clear guidance so users understand future migration requirements.
The publications sit alongside Europol’s wider efforts on criminal finance and digital assets, including a September 2026 conference in Luxembourg held with the Basel Institute on Governance and the UN Office on Drugs and Crime. The message is consistent: quantum risk to crypto-assets is real but manageable if the transition begins before the threat becomes operational.