Europe’s top financial supervisors have cautioned that sufficiently powerful quantum computers could compromise the cryptographic foundations of blockchains, transactions, communications and databases. The warning appeared in the Autumn 2026 joint risk report from the European Supervisory Authorities, which group the European Banking Authority, the European Securities and Markets Authority and the European Insurance and Occupational Pensions Authority.

The authorities stated that quantum computing could eventually undermine widely used cryptography systems. They stressed that related security risks might surface sooner than any commercially viable quantum applications, creating exposure for financial institutions and blockchain networks well before the technology delivers broad practical benefits.

Broader Context of the Risk Assessment

The quantum caution formed part of a wider review of vulnerabilities facing the European Union financial system. Supervisors highlighted the sector’s heavy dependence on non-EU technology providers and infrastructure for critical information and communication technology services. Such reliance, they said, leaves the industry exposed to geopolitical disruptions that could interrupt access to essential systems.

The report also pointed to the rising sophistication of artificial intelligence-enabled cyberattacks, noting that advanced AI systems could make such attacks more powerful and harder to contain. Separately, supervisors examined the expanding private credit market, which remains relatively small yet is growing rapidly with limited transparency, infrequent valuations and unclear leverage. Liquidity mismatches in private credit funds, they warned, could transmit stress into the banking sector under tighter conditions.

Despite these concerns, the authorities described the overall EU financial system as resilient, citing solid bank capital positions, stable investment fund performance and sound insurance sector fundamentals. The central message was one of preparedness rather than immediate crisis.

Implications for Blockchain and Cryptographic Systems

For blockchain networks, the core issue centres on public-key cryptography. Bitcoin and many other systems rely on elliptic-curve signatures to authorize ownership and transfers. A sufficiently advanced quantum computer could apply algorithms such as Shor’s to break these schemes, along with RSA-based systems used more broadly in finance.

A separate technical analysis from the European Securities and Markets Authority earlier in the year examined these mechanics in greater detail. It concluded that practical attacks remain beyond the reach of current noisy intermediate-scale quantum devices. Systems capable of threatening existing cryptography are not expected in the immediate term, yet the long periods required for migration make early planning essential.

The authorities also flagged the “harvest now, decrypt later” scenario. Attackers could collect encrypted data today and store it until future quantum machines become capable of decryption. Given the long useful life of certain financial information, this turns migration into a multi-year security priority.

Estimates of Exposed Bitcoin Holdings

Analysts have produced varying estimates of Bitcoin that could face elevated risk if quantum capabilities mature. One assessment associated with CryptoQuant founder Ki Young Ju placed the figure at approximately 6.89 million BTC. This total includes coins linked to directly visible public keys and others whose keys may have been revealed through prior spending or address practices, encompassing some dormant early holdings.

Other research has measured similar volumes of supply with public-key exposure at rest. Certain older address formats and reused keys leave public keys visible on the blockchain by design or through operational behaviour, creating a longer window for potential future attacks compared with address types that keep keys hidden until spending.

Migration Timelines and Industry Responses

The European Commission has already set a post-quantum cryptography roadmap for public institutions and critical infrastructure. Member states are expected to begin the transition by the end of 2026, with high-risk use cases protected no later than the end of 2030. The plan prioritises clear deadlines, risk-based sequencing, hybrid approaches and crypto-agility.

Within the Bitcoin community, draft proposals such as BIP-360 and BIP-361 outline potential paths toward quantum-resistant outputs and eventual restrictions on vulnerable legacy signature types. These remain drafts and have not been activated as consensus rules. Any network-wide change would require broad agreement among developers, miners, businesses, wallet providers and node operators. Handling of dormant or inaccessible coins presents an additional unresolved challenge.

Some institutional custodians have begun designing flexible post-quantum custody architectures capable of supporting multiple signature schemes, while hardware wallet providers have noted that coordinating wallet updates, custody systems and existing holdings could prove more complex than selecting an algorithm.

Supervisors and market participants have been urged to strengthen monitoring and readiness for risks arising from quantum computing, external dependencies and other emerging technologies. The report frames these steps as necessary preparation ahead of any practical threat materialising.