Europe's supervisors put quantum computing on the operational-risk ledger

The Joint Committee of the European Supervisory Authorities, which convenes the EBA, ESMA and EIOPA, warns that an advanced quantum computer could undermine the cryptography now used to secure communications, transactions, databases and blockchains, and that the threat could materialize before the technology has any viable commercial use. The Autumn 2026 Risk and Vulnerabilities report does not issue a technology forecast; it writes cryptography into the operational-risk ledger its regulated firms are examined against.

The report sets no timeline, and the authorities do not claim a machine capable of breaking bitcoin's cryptography exists today; a recent IBM report referenced in the coverage puts commercial deployment at four years or less. What Europe can bind is its own calendar: the European Commission's post-quantum roadmap asks member states to begin transitioning by the end of 2026, with high-risk uses protected by 2030.

The bitcoin exposure is narrower and harder to move. Roughly 6.9 million bitcoin, worth about $586 billion, sits in addresses whose public keys are already visible onchain, according to Cryptoquant figures cited in the coverage. Those are older pay-to-public-key outputs and reused addresses where a sufficiently powerful quantum computer could work from the exposed key to derive the private key and take control of the coins. Much of the dormant supply is less exposed for now, because many unspent outputs keep the public key behind a cryptographic hash.

That difference matters because bitcoin cannot retire a cipher suite the way a bank retires one: quantum-resistant signatures would require network-wide consensus, and holders of exposed coins would need to move them before an attack became possible. The long-running argument over whether to freeze the coins in legacy wallets picks up fresh urgency from this warning, and the freeze runs through the same consensus the migration does.

The ESAs also flag a slower problem for the firms they supervise: information gathered today can be decrypted later, the pattern the report labels harvest now, decrypt later. For a bank or an insurer, that converts retention policy into a security question with a deferred answer date; for a public chain, it implies a fixed inventory of keys already written into early blocks, legible for as long as the ledger is, with no counterparty on the other side of the exposure.

The warning mainly buys the supervisors leverage, and leverage is most of what they have. No regulator can move a coin, and an address with no controlling institution has nobody whose job it is to move it—the same gap this publication has flagged in federation designs where control points go unnamed. The response available to institutions today is procedural: document key management, produce a migration plan against the Commission's 2026 and 2030 markers, and favor counterparties who can be asked for both. The concrete question is migration: whether any of the exposed coins move while quantum-resistant signatures remain a consensus question, and who signs the transaction.