Quantum Computing Timelines and Digital Asset Key Risk

Europol published two reports on October 7, 2026 warning about quantum risk to crypto wallets, and the European Commission's roadmap asks member states to begin moving to post-quantum cryptography by the end of this year. Neither depends on a working quantum computer existing. The exposure being managed in 2026 is a governance deadline, and it arrives on a schedule set by protocol developers and regulators rather than by physics.

What Is Actually Exposed

The mechanics are narrower than the headlines. Shor's algorithm threatens signature schemes by recovering a private key from a public key. Hashing is weakened only quadratically by Grover's algorithm, so mining and address hashing are not the exposure. Signatures are.

Most Bitcoin outputs commit to a hash of the public key, so the key stays hidden until the coins are spent. But as of October 2026 roughly 6.26 million BTC, about 31.2 percent of supply, sits at addresses whose public keys are already visible on-chain, up from 24.8 percent in early 2021.

The breakdown matters more than the total. Address reuse accounts for roughly 4.33 million BTC, the larger share. Script types that expose the key by design, including pay-to-public-key and Taproot outputs, account for about 1.94 million. Exchanges hold roughly 1.79 million BTC at exposed keys, 57 percent of identified exchange holdings.

The largest single contributor is address reuse, an operational practice rather than a protocol constraint. The biggest piece of the problem is self-inflicted and free to stop.

The Deadline Arrives Before the Computer

BIP 361, assigned on February 11, 2026 and authored by Jameson Lopp, Christian Papathanasiou and four co-authors, proposes a pre-announced sunset of legacy signatures as a soft fork.

Phase A permits sends only from legacy scripts to post-quantum scripts, running 160,000 blocks or roughly three years from activation. Phase B is a flag day about two years later, approximately five years after activation, at which nodes reject transactions relying on ECDSA or Schnorr keys. Mainnet signalling starts at midnight on January 1, 2027 UTC.

After Phase B, coins at exposed keys cannot be spent under those rules. A Phase C recovery mechanism using a zero-knowledge proof of seed possession is contemplated but undefined and may require a hard fork.

So the first thing that breaks is not a theft. It is the inability to move coins before a date the network sets. An institution can hold entirely unexploited assets and still lose access to them by missing a calendar entry, and that failure mode exists whether or not a quantum computer ever runs.

There Is No Early Warning on the Attack Side

There is no leading indicator of the attack. Nothing appears in the mempool, no latency drifts, no anomaly precedes a key being recovered. The first observable event is a spend from an address whose owner did not authorize it, and on a final ledger that observation arrives too late to act on.

The detection therefore has to invert. The only measurable leading indicators are the ones describing your own position, and both are available monthly.

The first is exposure share: what percentage of holdings sits at addresses with revealed public keys, computed from the chain rather than taken from a vendor. The industry baseline of 31.2 percent, and 57 percent for exchange-held coins, gives a comparison.

The second is time-to-migrate, and it is the one almost nobody has. How long would it take to re-sign the entire book, and under whose authority? That number is not a technical estimate. It is a function of how many ceremonies are required, where the key material sits, and whether the named signatories on each quorum are still employed and reachable.

Defenses That Work and Defenses That Do Not

Deferring the migration is not a strategy. Migration gets harder with time rather than easier, because signatories leave, cold storage ages, documentation decays and quorums become unassemblable. The window narrows from the inside.

Treating it as an IT project is the second error. The binding constraint is the authority to sign, not the software to sign with. Buying a post-quantum-capable wallet changes nothing about assets sitting in a vault whose signing quorum requires three people, two of whom have moved on.

Assuming the exposure is mining is the third. So is a chain advertising post-quantum signatures while existing holdings, bridges and custody providers remain on elliptic curves.

Three things work. Eliminate address reuse now, since it is the largest contributor, costs nothing and sits within operational control. Pre-authorize and rehearse a mass-migration ceremony with currently named signatories and a tested quorum, documented as standing board authority so it survives staff turnover. And require custodians to state in writing their migration plan and who bears the loss if a flag day passes with assets unmigrated, an allocation absent from nearly every agreement today.

Residual Risk and the Contested Timeline

The residual risk is permanent for a specific category: coins whose keys are lost, or whose quorum can no longer be assembled, become unspendable after a sunset unless a recovery mechanism lands. Roughly 1.1 million BTC attributed to Satoshi Nakamoto sits in old pay-to-public-key outputs that have not moved in over a decade, and proof of hierarchical wallet ownership is not possible for coins created before BIP-32. No policy fixes that.

On timing the forecast range is very wide and the disagreement is genuine. In November 2025 Vitalik Buterin warned that elliptic curve cryptography could be broken before the 2028 US election, citing Metaculus forecasts putting roughly a 20 percent chance of a break before 2030. A Google Quantum AI paper in March 2026 cut the physical qubit estimate to fewer than 500,000, around twenty times lower than earlier figures, with a private key derivable in about nine minutes. Against that, Willow sits at roughly 100 qubits and Blockstream's Adam Back argues a real threat is at least twenty years out.

The useful conclusion is that the policy does not depend on resolving the argument. The protocol sunset and the regulatory calendar, with NIST's transition guidance deprecating these algorithms around 2030 and disallowing them by 2035, set a deadline independent of the physics. An institution that measures its exposure share, stops reusing addresses and can prove it could re-sign its book on demand is prepared under either forecast, and one that waits for the timeline to settle has chosen the option that expires.

For informational purposes only. Not an offer to buy or sell any security. Available only to accredited investors who meet regulatory requirements.

‍