The EU's quantum warning, and why "harvest now, decrypt later" works differently for Bitcoin

Updated September 2026

The phrase "harvest now, decrypt later" was written for encrypted data: record the traffic today, read it once a quantum computer exists. Bitcoin's chain holds almost nothing encrypted. What sits there in public is keys, and a key is only worth attacking while coins still sit behind it. That one difference decides what the EU warning means for the box.

What the EU supervisors published

The document is the Joint Committee Update on Risks and Vulnerabilities in the EU Financial System, Autumn 2026, reference JC 2026 29, dated September 23, 2026. The Joint Committee is where the three European Supervisory Authorities work together: the European Banking Authority (EBA), the European Insurance and Occupational Pensions Authority (EIOPA) and the European Securities and Markets Authority (ESMA), with the European Systemic Risk Board. It is a 19-slide presentation summarizing the cross-sector risk assessment they prepare for the Economic and Financial Committee's Financial Stability Table, where member states' finance officials meet.

Quantum computing sits on slide 17, under "Risks driven by technological developments", next to cyberattacks and frontier AI models. The slide's heading reads "Quantum computing offers opportunities, but potential threats warrant early system upgrades." Its points, in order:

• Quantum computing could bring medium-term benefits to finance, such as process optimization, fraud and compliance work, pricing and simulation.
• An advanced quantum computer "could undermine some cryptography systems widely used to secure communications, transactions, databases and blockchains".
• "Threats could materialise earlier than any viable commercial application."
• Information gathered today could be decrypted in the future, which the slide labels "harvest now, decrypt later".
• DORA, the EU's Digital Operational Resilience Act, requires financial entities to adopt state-of-the-art cryptography against new threats.
• The EU NIS Cooperation Group recommended that member states adopt a post-quantum migration strategy by the end of 2026.

The policy recommendations at the end repeat the theme: "Continue to plan and prepare for the risks from the rapid development of AI and quantum computing."

What the report does not say

It does not name Bitcoin. The only crypto-market material in the report is elsewhere, about where crypto trading happens: it notes that only 8% of crypto trades are against the euro, and that no EU-headquartered crypto exchange is in the top 15. The quantum slide says "blockchains" once, in a list with communications, transactions and databases.

It gives no date for a capable quantum computer, no qubit count and no estimate of coins at risk. CoinDesk's report on the warning added a figure of about 6.9 million exposed bitcoin, and credits it to the analytics firm CryptoQuant, not to the supervisors. Counts like that depend on what you call exposed, which is why this site's own count of coins in open boxes spells out which outputs it includes.

And it tells nobody holding bitcoin to do anything. It is a risk map for supervisors of banks, insurers and markets. The nearest thing to an instruction is aimed at the institutions it supervises: keep planning for quantum risk, and use current cryptography, as DORA already requires.

Why regulators say the threat could come before the useful machine

The line that got the headlines, that threats could arrive before any viable commercial application, sounds alarming but has a plain reading. A quantum computer that pays its way in finance has to beat classical computers across many ordinary jobs, reliably and cheaply. A machine that breaks one elliptic curve key has to do one job once, however slowly and expensively.

The most detailed public costing of that one job came three weeks earlier. IonQ's September 2026 estimate puts one secp256k1 key at 19,397 physical qubits and about 25.7 days per attempt, on a trapped-ion machine that does not exist. Nobody would buy that machine to price bonds. Somebody might build it to break keys. That asymmetry is all the supervisors' sentence claims.

"Harvest now, decrypt later", and what the Bitcoin version is

The classic version goes like this. An adversary records encrypted traffic today, say a bank's messages protected by a key exchange that a quantum computer could later break. The recording costs almost nothing. Years later, with the machine in hand, the adversary opens the recording. The data was secret in 2026 and is readable in 2035, and there is nothing the sender can do about it after the fact. That is why governments want key exchange upgraded now, long before the machine exists.

Bitcoin transactions are not encrypted. Amounts, addresses and the whole history are public by design, so there is no secret ledger for anyone to decrypt later. What an attacker can collect today is public keys: every key a spend has already put on chain, every Taproot output, every old pay-to-public-key coin. The later step is not decryption but derivation. Shor's algorithm would work backward from a public key to the private key, and that private key could then sign coins away.

BIP 360 gives this a precise name. A long exposure attack targets public keys "exposed for an extended period of time", longer than a transaction usually waits in the mempool. It lists P2PK, bare multisig and Taproot outputs as open to it. A short exposure attack is the other kind: racing a spend during the minutes or hours it sits unconfirmed.

Why moving coins voids the harvest

This is where Bitcoin's version is kinder than the classic one. A recording of encrypted traffic stays valuable forever: once captured, the secret it held is just waiting. A harvested Bitcoin public key is only valuable while coins still sit behind it.

Say your coins sit in an address you have reused, so its public key has been on chain for years. Somebody has certainly copied it. If you spend everything from that address to a fresh, never-spent bc1q address, the old key now controls nothing. Deriving it in 2035 would get the attacker a private key to an empty box. The new address shows only a hash of its key, and a hash gives Shor's algorithm nothing to work on.

So for holders the lesson of "harvest now" is not "it is already too late". It is closer to the reverse: the harvest only pays off for boxes that are still open when the machine arrives. The step-by-step move to a still-closed address is the whole defense available today, and it works whenever you do it, as long as it is before a capable machine exists.

Two limits keep this honest. First, every move must spend, and spending publishes the key of the address you spend from. That key is on chain from then on, but the coins have already left it. Second, a Taproot (bc1p) destination is open on arrival, so moving into Taproot keeps the key visible at rest; the Taproot page goes through the trade.

Where Bitcoin does have encrypted data

There are a few places around Bitcoin where the classic harvest does apply, and they are about privacy rather than theft.

• Peer-to-peer traffic. Since BIP 324, Bitcoin nodes can encrypt the traffic between them. BIP 324 sets up each session with an elliptic curve Diffie-Hellman exchange on secp256k1, then encrypts with ChaCha20-Poly1305. A quantum computer that could break that exchange could, in principle, read recorded sessions later. The BIP itself lists "post-quantum cryptography upgrades to the handshake" as a possible future version. What such a recording would reveal is which node relayed what, not anyone's keys.
• Wallet data sent to servers. A wallet that sends your xpub to a server over an encrypted connection is trusting that connection's key exchange. If the connection could be decrypted later, a recording would show every address the xpub derives. Your coins would still need a private key to move, but your privacy would not survive.

Neither of those moves coins. Both are the kind of thing the EU's roadmap is aimed at: key exchange in ordinary software, which is being upgraded across the internet with standards such as ML-KEM, described on the post-quantum cryptography page.

Why the EU's migration deadlines do not reach Bitcoin

The European Commission's post-quantum cryptography policy page sets out the timeline the report refers to. The Commission published a Recommendation on post-quantum cryptography in April 2024. Member states, supported by the Commission, adopted a Coordinated Implementation Roadmap in June 2025. Under it, all member states should start transitioning by the end of 2026, and high-risk use cases should move "as soon as possible, no later than by the end of 2030."

A bank can meet a deadline like that by changing its own systems. Bitcoin cannot be ordered to change its signature scheme, by the EU or anyone else. A new output type has to be proposed, reviewed, written into software and activated by the network. The furthest-along proposal, BIP 360, is a Draft that adds a Pay-to-Merkle-Root output type with no key path. It says of itself that it "does not, by itself, protect against short exposure quantum attacks", which would need post-quantum signatures activated later. A separate draft, BIP 361, sketches how old signature types might be phased out after such an upgrade. Neither is active.

What EU rules can reach is the firms they supervise. An exchange or custodian in scope of DORA has to keep its own cryptography current. That is about its systems, and it does not decide which Bitcoin output types hold customer coins. If your coins sit with one, the questions to ask are on the exchange custody page.

Key facts, with dates

• April 2024: the European Commission publishes its Recommendation on post-quantum cryptography.
• June 2025: EU member states adopt the Coordinated Implementation Roadmap: start the transition by the end of 2026, move high-risk uses by the end of 2030.
• September 4, 2026: IonQ's paper estimates 19,397 physical qubits and 25.7 days per attempt for one secp256k1 key, for a machine that does not exist.
• September 23, 2026: the ESAs' Autumn 2026 risk update lists quantum computing as a risk to cryptography, including for blockchains, with no date and no Bitcoin-specific figure.

What to do with this

Nothing new, and nothing urgent. A supervisor saying the threat is real but undated is the same position this site has taken since it launched. The steps are the ones you already had:

• Check which of your boxes are open. Paste an address, never a seed, into the wallet checker.
• Stop reusing addresses, so each spend leaves the next coins in a closed box.
• If long-term savings sit in an open box, plan a calm move to a fresh, never-spent address. It voids any harvest of the old key.
• Read "harvest now, decrypt later" for what it is in Bitcoin: a reason not to leave coins behind a public key, not proof that anything is lost.