Europol Says the Quantum Target Is Your Exposed Key. An Ethereum Researcher Says AI Could Get There First

What Happened

Europol's European Cybercrime Centre (EC3) published 2 reports on Wednesday, October 7. The first, 'Quantum Computing and Cryptocurrencies,' makes a narrow finding. A sufficiently powerful quantum computer could derive a private key from a public key already exposed on-chain and spend the funds without the owner, so the keys that control wallets are 'the primary point of exposure to quantum threats.'

The hash functions that link blocks are comparatively resistant. 'Cryptocurrencies will not collapse due to quantum computing,' the report concludes, recommending a phased transition to quantum-resistant signatures. For a wallet whose key is already public there is no fix after the fact: 'the only solution is pre-emptive migration.'

Per CoinDesk's and Crypto Briefing's readings, the report puts the exposed bitcoin at roughly 6 to 6.9 million BTC, about 30% of supply. The companion study, written with Universidad Carlos III de Madrid, found no clear evidence that anyone is systematically harvesting encrypted traffic at scale to decrypt later.

The same day, Ethereum Foundation researcher Justin Drake posted a different warning on X. 'Today I call upon the blockchain industry to calmly begin planning for bunker mode,' he wrote: 'a controlled mass migration of assets to fresh addresses, i.e. addresses whose pubkeys remain hidden behind a hash,' large holders first.

'It is now reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case in months not years,' he wrote, defining a break as recovery of a private key in about a week on hardware such as a large GPU cluster. The trigger was OpenAI's October 6 release of more than 700 mathematics manuscripts written by an unreleased model.

He called the plan a personal recommendation and said a rushed migration would do more harm than good. Vitalik Buterin replied that he does not 'recommend anyone scramble to move their funds to new wallets today.' Ledger chief technology officer Charles Guillemet, in a reply reported by Cryptonews, called the months-scale planning baseline 'FUD.'

No attack on the curve has been demonstrated.

A police agency and a protocol researcher agreed this week that the exposed key is the target. The hidden key buys time, the slow move is the only safe one, and the clock is set by people who do not hold the coins.

Two Warnings, One Variable

A police agency and a protocol researcher reached the same place by different roads: what decides whether your coins are reachable is whether your public key is already on the chain. Any key-recovery attack, quantum or classical, needs the public key as input. Bitcoin's hash-committed address types, pay-to-public-key-hash (addresses starting with 1) and P2WPKH (bc1q), publish only a hash until you spend.

Early pay-to-public-key coins, reused addresses with a remaining balance, and every Taproot output (bc1p) publish the key itself. Glassnode's May count put 6.04 million BTC in the exposed set: 1.92 million exposed by design and 4.12 million by address reuse, about 1.66 million of it on exchanges.

What is new this week is who is saying it, and which machine they think gets there first.

Drake's claim deserves the skepticism it drew. The best known classical attacks on secp256k1 are generic ones that scale with the square root of the group size, roughly 2^128 operations for a 256-bit curve, and nothing in OpenAI's release reports an attack on elliptic curves or RSA.

OpenAI's own repository says its manuscripts sit 'at different stages of verification' and that 'some of the unformalized results could have issues.' Europol's report says no capable quantum machine exists and that early adaptation, not collapse, is the likely outcome. Drake's argument is not that an attack exists but that confidence in unproven hardness assumptions is eroding faster than migration plans assume.

Both can be true: the curve is unbroken, and the planning calendar keeps shortening.

The Destination Is Now Part of the Argument

The sharper change is about where coins should eventually go. Until this summer the working assumption was that elliptic curves fall to quantum computers while lattice schemes, the family behind NIST's ML-DSA signature standard, and hash-based schemes hold. In July that assumption took a dent.

Anthropic reported on July 28 that its unreleased Claude Mythos Preview model had found a key-recovery shortcut against HAWK-256, a lattice signature candidate in NIST's additional-signatures process; the HAWK team withdrew the scheme on July 29, and NIST's round-3 page now lists 8 candidates.

The authors said the result does not affect ML-DSA or Falcon, and HAWK-256 was a challenge parameter rather than a security-level one. Buterin nonetheless named ML-DSA and fully homomorphic encryption as the schemes most at risk from 'the next two years of AI math,' and said hash-based constructions are preferable wherever they are workable, the direction Ethereum's own roadmap has taken.

Bitcoin has not chosen a destination. BIP-360's proposed P2MR output type, merged into the proposals repository in February, defines a quantum-resistant script path without committing to a signature scheme. The candidates are large: per CoinDesk's reading of the Europol report, standardized post-quantum signatures run 10 to 120 times the size of an ECDSA signature, and a 2024 University of Kent paper put the floor for re-keying every unspent output at about 76 days of the network's full block space.

Guillemet's objection cuts the other way: the loss of confidence Drake invokes against curves could be invoked against hashes too, and 'we already have a Post Quantum migration to execute, let's not add more confusion.' Buterin's answer, per The Block, is that breaking hashes would take something like a proof that P equals NP.

For a holder the upshot is that the safe parking spot today is still a hash, and that the argument over what replaces the curve is happening above your head, on a clock set by AI research rather than by the Bitcoin community.

What This Means for You

Read your coins by class, as this site set out on September 11. Anything on a Taproot address, an early pay-to-public-key output, or an address you have spent from and still hold a balance on is exposed at rest; both Europol and Drake are talking about those coins. Anything on a 1 or bc1q address you have never spent from is exposed only in the minutes a spend waits in the mempool.

A hardware wallet that generates a fresh receive address every time keeps you in the second class, and the private keys never leave the device either way. If you have handed an extended public key to a portfolio tracker or an accountant, treat those addresses as exposed.

Then move slowly, because every voice in this week's argument agreed on that point. Buterin's tally that botched migrations have cost him more than hacks and Guillemet's warning about operational mistakes describe the same loss vector: the wrong chain, a swapped address, a seed phrase typed into a screen, an untested multi-sig quorum.

Migrate exposed-at-rest savings 1 output at a time, confirm the destination on the device screen, send a test amount first, and never receive to an address you have spent from. When you spend from a hidden address, empty every output paying that script in 1 transaction. Do not move coins into any product that asks you to trust a new signature scheme or a custodian in the name of quantum safety, and expect this week's headlines in phishing mail by Friday.

Now name the limit. Self-custody lets you choose your exposure class and your pace, and that choice is real. It does not let you choose whether the curve breaks, by which machine, or on what date, and it does not let you choose what Bitcoin migrates to, because no individual can.

The migration everyone now agrees is coming will be slow by necessity and decided by the same open process that has debated it since 2021. After October 7 the honest position is that the hidden key buys time, the slow move is the only safe move, and the people who set the clock are not the people who hold the coins.

What to Watch

The first checkpoint is verification, not alarm: whether any of OpenAI's manuscripts survive review by the Institute for Advanced Study's advisory group with a result that bears on discrete logarithms or lattices, and whether anyone, human or model, publishes an attack on secp256k1 that beats the generic bound.

That would be the event; this week was commentary on its possibility. Watch NIST's remaining 8 additional-signature candidates for the next withdrawal, and whether BIP-360's authors name a signature scheme for P2MR. If EU supervisors, who flagged quantum risk in the European Supervisory Authorities' September 23 update, turn 'pre-emptive migration' into guidance for custodians, the exchanges holding 1.

66 million exposed BTC would move first. And as of this writing, Bitcoin Core developers and the BIP-361 co-authors had said nothing publicly about Drake's post.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.