In August 2024, NIST finalized FIPS 204 and FIPS 205. In early 2025, Europol's European Cybercrime Centre published a report warning that cryptocurrency wallets are a major risk point for quantum attacks. The two documents are connected by one testable number: 10 to 120.
That range describes how much larger a post-quantum signature is than the ECDSA signature Bitcoin has relied on since 2009. The report treats it as a technical footnote. I treat it as the headline. Based on my own audit experience, the numbers a security report chooses to emphasize โ and the ones it buries โ tell you more about its real threat model than its stated conclusions do.
I spent the past week pulling the report apart against the NIST specifications it implicitly cites, verifying signature byte lengths line by line, and mapping the result onto Bitcoin's block space economics. The conclusion is uncomfortable. The quantum computer is not the threat holders should be pricing. The migration is.
The Report's Threat Model Is Selective, and That Is the Point
Europol's warning does something most crypto security warnings do not: it distinguishes between two cryptographic primitives that the market routinely conflates.
Signatures and hashes are not the same class of problem.
ECDSA, the signature scheme securing Bitcoin, Ethereum, and nearly every EVM-compatible chain, rests on the elliptic curve discrete logarithm problem. Shor's algorithm solves that problem in polynomial time on a sufficiently large fault-tolerant quantum computer. When that machine exists, any public key that has been exposed can be reversed into its private key. The signature algorithm does not degrade gracefully. It fails.
Hash functions are a different animal. SHA-256, the hash underpinning Bitcoin's proof of work and address derivation, is only weakened by Grover's algorithm, which provides a quadratic speedup. A quadratic speedup is manageable. Doubling the output length restores the effective security margin. Grover does not break hashes the way Shor breaks elliptic curves.
The report states this distinction explicitly. It concludes that cryptocurrency will not collapse because of quantum computing. That is a technically careful, measured statement, not a fear narrative. The people who wrote this understood the primitives they were describing.
This matters because it establishes what kind of document we are reading. This is not a FUD release designed to move markets. It is an enforcement agency flagging a structural cryptographic exposure that its authors believe warrants a long-horizon response. The recommendation is phased migration: move funds held in wallets with already-exposed public keys before an attack becomes feasible.
That recommendation is where the report stops being careful and starts being optimistic. But to see why, we need to verify the number first.
Verifying the 10โ120x Claim Against the Actual Standards
I do not accept a performance figure without checking the underlying specification. The report cites post-quantum signatures being 10 to 120 times the size of an ECDSA signature. Let me test that against the NIST standards.
An ECDSA signature is approximately 64 bytes in raw form. With DER encoding, which Bitcoin historically used, the encoded signature runs roughly 71 to 73 bytes. Call it 64 to 72 bytes as the baseline.
Now the post-quantum candidates that NIST standardized in August 2024 under FIPS 204 and FIPS 205:
- Falcon-512 produces a signature of approximately 666 bytes. That is roughly 10 times the ECDSA baseline.
- ML-DSA-44, the Dilithium variant, produces approximately 2,420 bytes. That is roughly 38 times.
- SLH-DSA-128s, the stateless hash-based scheme, produces approximately 7,856 bytes. That is roughly 120 times.
The 10-to-120 range maps almost exactly onto the three standardized families. Falcon anchors the low end, ML-DSA the middle, SLH-DSA the high end. This is not a rough estimate pulled from a blog post. It is a range derived directly from the NIST parameter sets.
The report is citing the NIST standards with high fidelity, which tells me its technical content was likely sourced from cryptographers rather than generated by policy staff.
That verification matters because it means the report's numbers are load-bearing. When a document cites the exact spread of three real signature schemes, the implications that follow are not hypothetical. They are arithmetic.
And the arithmetic is where Bitcoin's problem begins.
Signature Bloat Is a Block Space Tax, Not a Footnote
Here is the part the market consistently skips. A larger signature is not merely a larger data blob. On a blockchain, block space is the scarce resource. Signature bytes compete directly with transaction bytes for inclusion.
Bitcoin's block space is capped. Under SegWit, the effective block weight is 4 million weight units, with a practical capacity that translates to roughly 1 to 2 megabytes of transaction data depending on the mix of inputs and outputs. A typical transaction spends one or more inputs, each carrying a signature.
If every signature grows by a factor of 10 to 120, the per-transaction footprint grows accordingly. Fewer transactions fit per block. The fee market clears at a higher price. Effective throughput โ the number of value transfers the network can settle per unit of time โ collapses unless block space expands to compensate.
Let me put concrete numbers on it. In a standard single-input, two-output transaction, the signature dominates the input cost. If that signature expands from roughly 72 bytes to roughly 666 bytes, the transaction grows by nearly 600 bytes. If it expands to 7,856 bytes โ the SLH-DSA case โ the transaction grows by nearly 7,800 bytes. At Bitcoin's current block cadence, that is a hard reduction in settlement capacity.
The quantum migration, if executed with large-signature schemes, amounts to an implicit block space tax imposed on every user.
Who pays that tax? Miners collect the fees, so they nominally benefit from higher fee pressure. Users pay more. But the redistribution is not neutral. Higher fees price out small transactions, pushing retail settlement toward custodial layers and off-chain systems. The economic character of the base chain changes.
I have seen this pattern before. In 2017, I spent forty hours manually auditing the Solidity contracts of an ICO that promised decentralized cloud storage. The whitepaper was full of throughput claims. The token minting function had an integer overflow I found with a custom Python script. I emailed the team. No response. I published the breakdown on my personal blog. The lesson I took from that episode was structural: the marketing layer and the execution layer are almost never describing the same system. The Europol report's 10-to-120x figure is the execution layer talking. The market's calm reaction is the marketing layer talking. They have not met.
Which Bitcoin Actually Sits Exposed
The report names crypto wallets as the primary risk point because a wallet is where a public key becomes visible. That framing is correct but incomplete. On Bitcoin, not all addresses expose their public keys equally. The exposure depends on the output type.
A legacy P2PKH address, the classic "1..." format, stores a hash of the public key until the coins are spent. The public key is revealed only at spend time. Before spending, such an address is comparatively protected โ an attacker would need to break the hash to recover the key, which Grover only weakens quadratically.
But three categories break that protection:
- P2PK outputs. These are the earliest outputs, from the Satoshi era, which embedded the full public key directly in the output script. The key has been public since the block was mined. These coins have never had the hash-based protection that later address types enjoy.
- Reused addresses. Any address that has already spent once has published its public key on-chain permanently. The hash protection is gone. Reuse converts a protected address into an exposed one.
- Taproot (P2TR) outputs. Taproot, activated in 2021, was designed for efficiency and privacy, and part of that design exposes the public key directly in the output. This is a deliberate trade-off. It also means Taproot outputs are exposed from the moment they are created, not merely at spend time.
The market often cites an estimate of roughly 4 to 5 million BTC sitting in exposed or dormant addresses of these types. I cannot verify that figure to the coin, and neither can anyone else without a full UTXO-set analysis. But the order of magnitude is consistent with the known distribution of early P2PK outputs and Taproot adoption.
The exposed set is not a rounding error. It is a meaningful fraction of the supply, and it is identifiable on-chain by anyone with a block explorer.
This is where the blockchain's core design property stops being an asset and becomes a liability.
Immutability Is the Migration Trap
In a traditional cryptographic system, key rotation is routine. A compromised key is retired, a new key is issued, and the old material is discarded. The system heals.
Bitcoin cannot heal this way.
Once a public key is written to the blockchain, it is permanent. The ledger is append-only and immutable. There is no administrative function to scrub a public key from history. An exposed key stays exposed forever, in every full node, in every archive, in every block explorer, in perpetuity.
This is the point where the blockchain's exposure to quantum attack diverges sharply from traditional systems, and it is the point Europol's phased-migration recommendation quietly assumes away.
Consider the standard "harvest now, decrypt later" threat model. In conventional communications, an adversary intercepts encrypted traffic today, stores it, and decrypts it later once a quantum computer is available. The defense is to stop generating harvestable ciphertext and rotate to post-quantum encryption before the machine arrives.
On Bitcoin, there is nothing to harvest. The public keys are not encrypted traffic waiting to be captured. They are already public, already permanent, already stored by every node on the network. The harvest-now-decrypt-later window that traditional systems are racing to close has been permanently open on Bitcoin since the first P2PK output was mined.
That reframing is the most underappreciated insight in this entire discussion. The blockchain does not have a future exposure problem. It has a present, permanent, and publicly verifiable exposure that no future action can retract. The only defense is to move the coins โ to spend them to a post-quantum-secured address before an attacker can spend them first.
And that raises the coordination problem.
The Real Bottleneck Is Coordination, Not Cryptography
The report recommends phased migration. The phrase sounds orderly. It is not.
Who executes a phased migration on a decentralized network? There is no administrator. There is no compliance department. There is no authority that can force a holder to move funds. A migration of exposed public key funds requires every individual holder to voluntarily spend their coins to a new address type โ and that new address type does not exist yet in production.
This is where the report's optimism becomes visible. It treats migration as a planning exercise. On Bitcoin, migration is a governance war.
The historical precedent is unambiguous. Every change touching block space โ the block size wars, the SegWit activation, the Taproot upgrade โ triggered years of contentious debate. The ledger remembers what the hype forgets: these arguments were never purely technical. They were about who controls the network's economics.
An anti-quantum migration would be larger than all of them combined. It would require a new signature scheme, a new address format, a soft or hard fork to activate it, a decision on whether to deprecate ECDSA, and a social campaign to move millions of BTC from holders who in many cases are dormant, inactive, or dead.
The population most exposed to quantum attack โ long-dormant addresses, including Satoshi-era P2PK coins โ is precisely the population least likely to move. Low activity, uncertain technical capability, and in some cases lost keys make them the hardest group to mobilize in the entire ecosystem.
That is the migration trap. The coins most at risk are the coins least able to defend themselves.
The Wallet Layer Is a Single Point of Failure
The report places wallets at the center of the threat, and this is where its framing is genuinely useful. Even if the base layer completes a post-quantum upgrade, the user-facing layer can leave the ecosystem exposed.
A wallet manages private keys. If a wallet generates a key whose public counterpart is exposed, and the wallet software does not support post-quantum address types, then the user remains exposed regardless of what the protocol supports. The migration is only as complete as the slowest wallet.
This creates an asymmetric failure mode. Protocol developers can ship post-quantum support. Wallet vendors must independently implement it. Exchanges must independently upgrade their custody systems. Hardware wallet manufacturers must independently ship firmware. Each is a separate actor with separate incentives and separate release cycles.
The chain migrates when the protocol migrates. The ecosystem migrates only when the slowest custodian migrates. Logic gaps leave holes in the smart contract โ and the same is true of migration gaps between layers.
Exchange custody is the concentrated version of this risk. A large fraction of user assets sits with a small number of custodians. Their key management upgrade schedule, not the protocol's, will determine how quickly the bulk of exposed value can be secured. That is a centralized dependency embedded in a decentralized asset.
The Contrarian Reading: The Threat Is Being Priced Backward
The market's instinct is to treat quantum computing as a remote, science-fiction risk. I think that framing gets the timeline right and the mechanism wrong.
The quantum computer is not the near-term threat. Building a fault-tolerant machine capable of running Shor's algorithm against 256-bit elliptic curves is a multi-year, likely multi-decade engineering problem. The report itself provides no Q-Day date, and its measured language โ "cryptocurrency will not collapse" โ signals that its authors do not believe the threat is imminent. If they did, they would be recommending an emergency hard fork, not a phased migration.
What should worry holders is not the arrival of the machine. It is the possibility that the market starts to believe it is arriving.
The exposed set of coins โ the P2PK outputs, the reused addresses, the Taproot outputs โ constitutes a known, on-chain-visible inventory that a future quantum attacker could target. If the market begins to price a probability that these coins could be seized and sold, it introduces a persistent overhang on the asset, functionally similar to the Mt. Gox repayment overhang or the periodic government auction overhang. That is a valuation discount that accrues gradually and does not resolve quickly.
Trust is a variable, not a constant. The moment confidence in a chain's cryptographic integrity becomes a variable the market models, the discount begins to form โ well before any quantum computer exists.
The corollary is equally uncomfortable for the other side of the trade. The "quantum-resistant" narrative assets, the chains advertising hash-based or lattice signatures, tend to be small-cap and thinly traded. The report's official backing lends the narrative legitimacy. But an enforcement agency's warning is not an investment signal. It is a policy placeholder. Every previous quantum scare โ Google's quantum supremacy announcement, the recurring Q-Day predictions โ produced a brief sentiment pulse and no durable trend. The report gives the theme legitimacy without giving it a tradeable time anchor.
What Actually Moves This From Theory to Event
The report's technical content is sound. Its threat model is careful. Its recommendation is where it becomes naive, because it assumes a coordination capacity that Bitcoin does not have.
Here is what I will be watching, in order of importance.
First, quantum hardware milestones. The narrative does not become tradeable until a fault-tolerant machine crosses a threshold where credible cryptographers start revising their timelines downward. The number of logical qubits, not physical qubits, is the metric that matters. Physical qubit counts are marketing. Error-corrected logical qubits are signal.
Second, an authoritative Q-Day timeline. If NIST, the NSA, or a comparable body publishes a target date for cryptographic deprecation, that becomes the time anchor this narrative currently lacks. Until then, every activation of the quantum theme is a pulse, not a trend.
Third, the Bitcoin governance debate. When the community seriously proposes a post-quantum address format โ a BIP, a soft fork proposal, a signature scheme choice โ the argument over block space economics will resurface. The 10-to-120x signature expansion is not a detail. It is a block space tax, and someone will have to pay it. Clarity precedes capital; chaos precedes collapse. The way Bitcoin resolves that tax question will tell you more about its quantum readiness than any cryptography paper.
Takeaway
The bug was there before the launch. On Bitcoin, the exposed public keys were written to the ledger years ago, permanently, and no migration can retract them. Europol's warning is correct about the threat and optimistic about the remedy. The cryptography is solvable. The coordination is not. Data does not lie; people do โ and the people who most need to migrate are the least likely to move. Watch the logical qubit count, not the headlines.