The European Banking Authority, the European Securities and Markets Authority, and the European Insurance and Occupational Pensions Authority published their Autumn 2026 Joint Risk Update on September 23, listing quantum computing alongside AI-driven cyber risk and private credit as emerging syst...
"Threats could materialize earlier than any viable commercial application." — Joint Committee of European Supervisory Authorities (EBA, ESMA, EIOPA), Autumn 2026 Risk and Vulnerabilities Report
The European Banking Authority, the European Securities and Markets Authority, and the European Insurance and Occupational Pensions Authority published their Autumn 2026 Joint Risk Update on September 23, listing quantum computing alongside AI-driven cyber risk and private credit as emerging systemic threats to the financial system. The report warns that quantum advances could compromise the cryptographic systems securing blockchain transactions, communications, and distributed ledgers — potentially before quantum computing reaches commercial maturity.
The warning arrives six months after Google Quantum AI published a 57-page paper estimating that breaking the 256-bit elliptic curve cryptography (secp256k1) protecting Bitcoin and Ethereum would require fewer than 500,000 physical qubits and roughly nine minutes of runtime. That figure represents a 20x reduction from prior estimates. Current hardware — IBM's Kookaburra at 4,158 physical qubits, Google's Willow at approximately 1,000 — remains orders of magnitude below the threshold. But in May 2026, IBM and Google jointly demonstrated quantum low-density parity-check (qLDPC) codes that reduced error-correction overhead from roughly 1,000 physical qubits per logical qubit to a fraction of that, formally shifting the industry from the Noisy Intermediate-Scale Quantum (NISQ) era into early Fault-Tolerant Quantum Computing (FTQC).
The gap between current capability and cryptographic threat is narrowing faster than most blockchain protocol governance structures can respond. Approximately 6.9 million BTC — valued at roughly $586 billion at current prices — sits in addresses with exposed public keys. Migration proposals exist. Consensus on implementing them does not.
The ESAs' Autumn 2026 risk update, published September 23, identifies quantum computing as a threat to the cryptographic foundations underpinning distributed ledger technology. The report explicitly flags the "harvest now, decrypt later" (HNDL) attack vector: adversaries collecting encrypted blockchain data and exposed public keys today with the intent to decrypt them once fault-tolerant quantum machines arrive.
This is the first time the three EU supervisory bodies have jointly classified quantum risk to blockchain as a near-term financial stability concern rather than a long-horizon research topic.
The European Commission's post-quantum technology roadmap, adopted in June 2025, calls on member states to begin transitioning cryptographic infrastructure by end of 2026 and to protect high-risk use cases by 2030. The U.S. National Institute of Standards and Technology (NIST) has set parallel deadlines: ECC-256 deprecated by 2030, disallowed after 2035. NIST finalized three post-quantum cryptographic standards in 2024 — ML-KEM, ML-DSA, and SLH-DSA.
The regulatory pressure is bilateral. Blockchain networks that fail to migrate face potential classification as non-compliant infrastructure under both EU and U.S. frameworks within the decade.
The Google Quantum AI paper, published March 2026 and co-authored by Craig Gidney (whose RSA-2048 resource estimates are the field's standard reference), Hartmut Neven (VP of Engineering and founder of Google Quantum AI), Justin Drake (Ethereum Foundation), and Dan Boneh (Stanford University), compiled two quantum circuits implementing Shor's algorithm for the secp256k1 curve:
| Circuit Variant | Logical Qubits | Toffoli Gates | Physical Qubits (est.) | Runtime | |---|---|---|---|---| | Qubit-optimized | < 1,200 | 90 million | ~500,000 | ~9 min | | Gate-optimized | < 1,450 | 70 million | ~500,000 | ~9 min |
A September 2026 follow-up study produced a circuit requiring 1,151 logical qubits and 1.30 million Toffoli gates, though researchers emphasized this does not constitute a complete attack and excludes physical error-correction overhead.
Roughly half the quantum computation can be precomputed before the target public key is known, enabling the compressed nine-minute runtime once a key is identified. This precomputation capability distinguishes the on-chain threat from conventional "store-and-break" scenarios: a sufficiently powerful quantum computer could derive a private key during the transaction confirmation window (seconds to minutes) and front-run the original sender with a higher-fee competing transaction.
Previous estimates had pegged the physical qubit requirement in the millions. The 20x reduction compresses the timeline significantly.
According to CryptoQuant data cited in the ESAs' report, approximately 6.9 million BTC — one-third of the circulating supply — resides in addresses with exposed public keys. A separate estimate from the Coinbase Independent Advisory Board places the figure at roughly 7 million BTC, with approximately 5 million linked to address reuse.
The vulnerability breaks down into two categories:
Legacy Pay-to-Public-Key (P2PK) addresses: Approximately 1.7 million BTC sits in early P2PK outputs where public keys have been visible on-chain for over a decade. This includes an estimated 1.1 million coins attributed to Satoshi Nakamoto's early mining activity. These coins cannot migrate without active key holders.
Spent-from addresses: Any address that has previously sent a transaction has its public key exposed in the transaction signature. Wallets using Pay-to-Public-Key-Hash (P2PKH) that have never spent funds retain their public keys hidden behind hash functions and face lower immediate risk.
Beyond Bitcoin, the Google paper identified quantum attack surfaces within Ethereum's smart contracts, staking consensus mechanisms, and data availability sampling. Ethereum's proof-of-stake validator set relies on BLS signatures — also vulnerable to Shor's algorithm.
The blockchain industry's response to quantum risk varies significantly in speed, approach, and governance friction.
BIP-360, published February 11, 2026, introduces Pay-to-Merkle-Root (P2MR), a SegWit version 2 output type using bc1z address encoding via bech32m. It employs NIST-approved ML-DSA (Dilithium) signatures and operates as a soft fork. BTQ Technologies released a testnet implementation (v0.3.0) in March 2026 with full P2MR consensus validation and five ML-DSA signature opcodes.
BIP-361, published April 14, 2026, proposes "Post Quantum Migration and Legacy Signature Sunset" — setting deadlines for migrating vulnerable coins and eventually sunsetting quantum-vulnerable signature types. The proposal has generated community backlash, with critics calling it "authoritarian" for potentially freezing 1.7 million dormant BTC permanently.
As of September 2026, both BIPs remain draft proposals. Neither has achieved consensus activation. Bitcoin's governance model — requiring broad community agreement for consensus changes — means implementation will unfold over years. The trade-off: post-quantum signatures (SLH-DSA) produce outputs up to 8 kilobytes, raising transaction fees and block space consumption.
Vitalik Buterin published the "Extremely Lean" Ethereum proposal on July 6, 2026, describing a multi-year protocol overhaul comparable in scope to the 2022 Merge. The plan has three pillars: Lean Consensus (replacing BLS validator signatures with hash-based alternatives), Lean Data (post-quantum data handling), and Lean Execution (a SNARK-friendly virtual machine, potentially RISC-V-based).
The approach relies on recursive STARK proofs — inherently quantum-resistant — to minimize on-chain data while supporting single-slot finality. Each validator would leave approximately 6 bytes of on-chain state. The timeline spans three to four years.
Ethereum's centralized development coordination under the Ethereum Foundation enables faster protocol-level response than Bitcoin's consensus-driven model, though the scope of changes introduces execution risk.
Algorand is the furthest along. The Algorand Foundation executed the first post-quantum transaction on mainnet using Falcon-1024 signatures on November 3, 2025. By early 2026, over 140,000 quantum-resistant transactions had been recorded on mainnet. Native Falcon-1024 accounts went live with the Algorand v5.0.0 upgrade in August 2026, supported by SDKs, AlgoKit, and Pera Wallet.
Algorand plans to unveil a full quantum resistance roadmap by end of 2026, with complete quantum resilience targeted for 2027. Options under research include using Falcon-1024 or Falcon-512 for short-term voting keys, or a hybrid mix of classical and Falcon signatures.
The gap between current quantum hardware and the cryptographic threat threshold remains substantial but is closing at an accelerating rate.
| System | Physical Qubits | Milestone | |---|---|---| | Google Willow | ~1,000 | Below-threshold error correction demonstrated | | IBM Kookaburra | 4,158 (3-chip) | First multi-chip quantum processor | | Microsoft/Quantinuum H2 | 12 logical qubits | 2-in-1,000 logical error rate (March 2026) | | Threshold for secp256k1 | ~500,000 | Google estimate (March 2026) |
Expert probability assessments for when a Cryptographically Relevant Quantum Computer (CRQC) emerges:
In April 2026, a researcher demonstrated breaking a 15-bit elliptic-curve key on real quantum hardware — trivial from a security standpoint, but a proof-of-concept that the mathematical attack works on physical machines.
The quantum threat to blockchain cryptography is a logistics problem, not a physics problem. The mathematics of Shor's algorithm are settled. The engineering timeline is uncertain but measurably compressing. The question is whether decentralized governance structures can coordinate protocol upgrades within the window that regulators, hardware manufacturers, and cryptographers are converging on: 2029-2035.
Bitcoin faces the steepest coordination challenge: a consensus-driven governance model, 6.9 million exposed BTC, and draft-stage proposals that have already generated community opposition over the treatment of dormant coins. Ethereum has moved faster at the protocol design level but faces a three-to-four-year implementation timeline for changes its co-founder compares to the Merge. Algorand has shipped production code but commands a fraction of the economic value at stake.
The EU regulators' framing — that threats could materialize before commercial viability — underscores an asymmetry the industry has not fully priced. Blockchain networks do not need to be attacked by a quantum computer to be affected by one. The credible approach of quantum capability could trigger preemptive regulatory action, insurance repricing, or institutional custody policy changes well before a single key is cracked.