Does Quantum Computing Already Expose 30% of Bitcoin?

A quantum computer doesn't need to steal your seed phrase if your Bitcoin address has already shown its public key on-chain.

On October 7, 2026, Europol's cybercrime unit published a report naming wallets, not blockchains, as "the primary point of exposure" to quantum attacks. The same report leans on a Glassnode estimate from May 2026 that's blunter than most of the coverage around it: 6.04 million BTC, 30.2% of the entire issued supply, already has its public key sitting in plain sight on-chain.

Most "is Bitcoin quantum-safe" explainers treat this as a problem for the 2030s. The exposure part already happened. What hasn't happened yet is a machine capable of using it.

What did Europol actually say about quantum computers and crypto wallets?

The report, Quantum Computing and Cryptocurrencies, comes from Europol's European Cybercrime Centre. Its core claim: a wallet has two keys, a private one that authorizes spending and a public one the network uses to verify a signature. Today, a quantum computer strong enough to reverse that math doesn't exist. If one did, it could derive the private key from a public key that's already visible on-chain, then move funds the owner never approved.

The blockchain itself isn't the weak point. Europol's own language on the hash functions behind block structure and mining calls breaking one "astronomically high with foreseeable technology," and the report states plainly: "Cryptocurrencies will not collapse due to quantum computing." The chain holds. The wallet doesn't, once its public key is out.

Which wallets are already exposed right now?

A Bitcoin address reveals its public key the moment it spends funds, not the moment it receives them. Reuse that address, or any address type that exposes the key on the first outgoing transaction, and the key sits there permanently, readable by anyone, forever. That's what Glassnode's 6.04 million BTC figure actually measures: not stolen funds, not hacked wallets, just addresses where the second ingredient a quantum computer would need is already public.

Exposed doesn't mean compromised. Nobody has the machine yet. For wallets whose keys are already visible, Europol's own recommendation is blunt: "the only solution is pre-emptive migration" to a fresh address before that machine arrives.

This isn't a Bitcoin-only problem. Ethereum and most of the EVM chains Plastron screens sign transactions with the same ECDSA math Bitcoin uses, built on the same secp256k1 curve. Any address that's ever sent a transaction on any of those chains has exposed the identical ingredient. No post-quantum fix has shipped on Bitcoin, Ethereum, or any chain built this way. Not yet.

How urgent is the quantum threat, really?

IBM and Microsoft both target 2029 for a fault-tolerant, scalable quantum computer. A 2025 survey of 32 cryptography experts put the odds of cracking RSA-2048 inside 24 hours sometime in the next decade at 28% to 49%. Europol's own phrase for the timeline is "remains uncertain," which is a government agency's way of saying nobody actually knows.

Here's the part most coverage skips. Europol flags real-time, "just-in-time" interception as the nearer-term payment risk, not the slower harvest-now-decrypt-later scenario everyone worries about for stored data. The window there is the gap between a transaction broadcasting its public key and that transaction confirming, a few seconds to a few minutes. A machine fast enough to exploit that gap is a much higher bar than one that can eventually crack an old, dormant exposed address at leisure.

And a full network migration isn't trivial either. NIST's post-quantum signature standards run 10 to 120 times larger than Bitcoin's current signatures, enough to strain block space and raise fees across the board. A 2024 study estimated moving every unspent Bitcoin output to a quantum-resistant scheme would cost at least 76 days of cumulative network downtime, or roughly 300 days if the work used a quarter of each block's capacity. That's a protocol-level number, not something any individual holder has to wait on.

What does BitGo's new quantum risk checker tell you, and what does it miss?

BitGo opened a free public version of its quantum-risk tooling the week of August 11, 2026, a scaled-down release of the Quantum Resistance Score it had already shipped to institutional clients that July. Enter one or more Bitcoin addresses and it reads nothing but public on-chain data: no account, no wallet connection, no stored submissions. It returns the one number that matters for this specific threat, the share of your BTC sitting in addresses with an exposed public key versus addresses that haven't sent a transaction yet.

It's a genuinely useful, narrow tool. It also answers exactly one question. It says nothing about whether that same address has ever touched a sanctioned wallet, a mixer, or a pile of stolen exchange funds, and that's a risk an exchange's compliance desk enforces against you today, with no quantum computer required.

Checking that by hand means pulling a transaction history off a block explorer and tracing counterparties one hop at a time. Screen the address on Plastron instead, free, against 3,907 labeled wallets, 780 of them matched to OFAC's sanctions list, across Ethereum and six other EVM chains, and get both pictures of the same address in one pass. An exposed public key and a clean compliance history aren't the same question, and a reused address that's been sitting dormant for years, the exact profile a reactivated dormant wallet triggers at an exchange, is worth checking on both counts before it moves anywhere.

What should you actually do about an exposed wallet today?

If an address has ever sent a transaction and still holds meaningful value, move it. Generate a brand-new key pair, send the balance to the fresh address, and stop reusing the old one for anything. That's a single normal transaction on your end, not a network-wide migration; the 76-to-300-day downtime estimate above belongs to Bitcoin's entire unspent-output set, not to you.

A hardware wallet doesn't change this calculation. It protects the private key in storage. It does nothing about a public key your address already broadcast three transactions ago. The fix is the same regardless of where the old key lived: new address, same device, move the funds.

Address reuse is also the exact pattern exchanges already lean on to cluster your wallets together for AML purposes, well before quantum computing enters the picture. One habit, two separate reasons to break it.

FAQ

Does this affect Ethereum, Solana, and other chains too, not just Bitcoin?

Ethereum and the other EVM chains sign with the same ECDSA secp256k1 scheme Bitcoin uses, so any address that's ever sent a transaction there has exposed the same ingredient, and no fix has shipped there either. Solana signs differently, with Ed25519, and Europol's report doesn't cover it, so don't extend this specific finding to it.

Will my coins just disappear once a quantum computer exists?

No. Europol's own conclusion is "cryptocurrencies will not collapse due to quantum computing," and any address that's never sent a transaction hasn't exposed its public key at all, exposed or not. The risk concentrates entirely on addresses that have already revealed that key.

Does a hardware wallet protect against this?

It protects the private key from theft or malware, which is a different problem. It can't un-expose a public key your address already put on-chain. Moving the balance to a freshly generated address on the same device closes that gap.

Should I move my Bitcoin to a new address right now?

If the address has already spent funds and holds a meaningful balance, yes, there's no reason to wait. There's also no fire-drill deadline today: the machine capable of using that exposure doesn't exist yet, and Europol itself calls the timing uncertain.