Europol urges early action to protect cryptocurrencies from quantum threats

The timing of these capabilities remains uncertain. However, this should not be the main concern. Adapting systems and co-ordinating security upgrades will take time. Therefore, regardless of the nature of the threats that may emerge, crypto-agility should be pursued proactively to ensure that systems can withstand and overcome future threats, while also remaining secure.

Both reports highlight the need to identify and prioritise threatened assets according to their relevance, and also to plan the transition to post-quantum cryptography accordingly, focusing on algorithms designed to withstand attacks from both conventional and quantum computers, while ensuring interoperability and coexistence with existing cryptographic systems.

Cryptographic keys

Quantum Computing and Cryptocurrencies: Bridging Technical Expertise and Decision-Making, produced by Europol’s European Cyber Crime Centre, examines the implications for digital assets and challenges predictions that quantum computing will inevitably cause cryptocurrencies to collapse.

The report identifies the cryptographic keys used to control cryptocurrency wallets and authorise transactions as the primary point of exposure. A sufficiently powerful quantum computer could derive a private key from an exposed public key, potentially allowing an attacker to transfer funds without the owner’s permission.

The cryptographic hash functions underpinning important aspects of blockchain integrity are comparatively resistant to quantum attacks. This distinction is central to understanding the threat and directing dedicated protective measures to where they’re most needed.

The report recommends a phased transition towards quantum-resistant cryptography, supported by improvements to wallet security and key management. Blockchain developers, wallet providers, policymakers and users alike all have a role to play. Co-ordinating upgrades across decentralised networks will be a particular challenge, making early preparation essential.

Harvest now, decrypt later

The second report, Harvest Now, Decrypt Later (jointly developed by Europol and University Carlos III of Madrid (UC3M) as part of the Europol EC3 Advisory Group on Research and Development) examines a different risk: attackers collecting and storing encrypted information today with the intention of decrypting it when more advance computing capabilities become available.

This approach doesn’t require access to a quantum computer at the time the data’s collected. It’s particularly relevant to information that must remain confidential for many years, including Government communications, Intellectual Property, medical records and law enforcement files.

The report assesses the conditions under which encrypted communications and stored files could become vulnerable. It finds that exposure depends on the protocols, configurations and key management practices used.

At present, there’s no clear evidence to suggest that this technique is being systematically exploited at scale. Significant storage, processing and technical resources would be required, making high-value information with lasting sensitivity the most plausible target. Nevertheless, the potential consequences justify preparations being made now.

Both reports recommend that organisations identify where cryptography is used, assess which assets and information need long-term protection and then prioritise those systems most exposed to future quantum attacks.

Practical measures 

For organisations handling sensitive data, practical measures include removing outdated security protocols, limiting unnecessary data retention, strengthening flexible key management models and testing post-quantum solutions.

The transition should be planned in phases, duly prioritising systems, networks and information according to their relevance, while taking account of technical dependencies and the need to maintain essential services.

For the cryptocurrency ecosystem, preparation requires co-ordinated work on protocols and wallets, alongside clear information for users about future upgrades and migration requirements.

These publications complement Europol’s wider work designed to address evolving risks involving digital assets. On 15–16 September, Europol co-organised the 10th Global Conference on Criminal Finances and Cryptoassets with the Basel Institute on Governance and the United Nations Office on Drugs and Crime, hosted by Luxembourg’s Bureau de Gestion des Avoirs. Conference provided a forum for public authorities and private sector specialists to exchange expertise on the criminal misuse of cryptoassets, emerging risks and practical responses, supporting co-operation across borders and sectors.

EMPACT in focus

The European Multidisciplinary Platform Against Criminal Threats (EMPACT) tackles the most important threats posed by organised and serious international crime affecting the European Union (EU). EMPACT strengthens intelligence, strategic and operational co-operation between national authorities, EU institutions and bodies, in addition to international partners.

EMPACT runs in four-year cycles focusing on common EU crime priorities.

*Further information is available online at www.europol.europa.eu