Europol and an Ethereum researcher warned about key risk on the same day: what bunker mode is and whether you should move your coins

What Europol said

The report comes from Europol's European Cybercrime Centre. Two documents came out at once: one on crypto wallets and exposed keys, the other on “harvest now, decrypt later” attacks, where encrypted data is stockpiled so it can be cracked at some point in the future.

For crypto, the core argument goes like this. A wallet is protected by a key pair: you keep the private key, while the public key can be shown to anyone. An ordinary computer cannot work out the private key from the public one, but a powerful enough quantum computer, in theory, could. That is why Europol points to wallets as the main point of vulnerability rather than the blockchains themselves: the hash functions that addresses and blocks rely on hold up far better against quantum attacks.

Europol is careful not to scare anyone with deadlines, though. The report says plainly that no publicly known quantum computer can compute private keys today at the scale needed for theft, and that there are no clear signs of mass “harvest now” attacks either. The problem lies elsewhere:

• an address whose public key is already on the blockchain cannot be fixed after the fact, and the coins can only be moved while an attack is still impossible;
• the switch to post-quantum cryptography will take years, because it has to be agreed across an entire decentralized network;
• the new signatures standardized by NIST are 10 to 120 times larger than today's, which means heavier load on networks and higher fees.

According to Glassnode, public keys are already visible for addresses holding about 6.04 million BTC, roughly 30% of all bitcoin. By one estimate cited in the report, moving every unspent bitcoin output to new signatures would take about 76 days of network capacity. For the next few years, the report sees a more likely threat in an attack during the short window between sending a transaction and its confirmation, when the public key is already visible on the network.

The report recommends moving to post-quantum cryptography in stages, identifying assets that are already exposed, testing the switch well in advance and being honest with users about what will be asked of them.

Justin Drake's “bunker mode”

On the same day, Ethereum Foundation researcher Justin Drake called on the industry to “calmly begin planning for bunker mode.” In his words, that means “a controlled mass migration of assets to fresh addresses, i.e. addresses whose pubkeys remain hidden behind a hash.” After every signature, the remaining balance should also be moved to a new address.

Quantum computers are not Drake's only worry. He believes ECDSA, the signature algorithm behind bitcoin, ether and most other networks, could be broken sooner, through mathematics, with help from AI. In the worst case, he says, the timeline is “months not years.” As an example he pointed to a recent OpenAI release: 722 mathematical papers written by the company's internal model.

Drake added his own caveats. This is his personal recommendation, not a claim that the cryptography has already been broken. He advises against panicking and moving everything in a hurry, since a rush can do more damage than the risk itself. In his view, the largest holders should be the first to harden their cold storage: Binance, Bitbank, Robinhood, Bitfinex and Tether.

Individual holders have a small head start, which Drake calls the “Satoshi shield.” About 20,000 early addresses from the days of bitcoin's creator hold 50 BTC each with exposed public keys, and an attacker would most likely go after them first. That buys wallets with less than 50 BTC some time, but it is not protection.

In the long run, Ethereum plans to move to hash-based signatures. We covered this when we looked at Ethereum's plans to become a “world computer” by 2030: quantum resistance at every layer of the network is on the roadmap through 2029.

Which addresses are already exposed

A wallet address is usually not the public key itself but its hash. While you are only receiving coins, the blockchain shows the hash and the key stays hidden. The key shows up on the network the moment you sign a transfer from that address. It makes no difference where the coins came from, whether a trading platform, a friend or a no-sign-up crypto exchange: what matters is whether you have ever sent anything from that address.

Modern bitcoin wallets send change to a new address on their own, so after a spend the old address is usually left empty. What stays exposed are addresses you receive to again and again, plus Taproot. So whenever you swap USDT TRC20 for bitcoin or get coins from someone, give a new address every time: your wallet creates one when you tap “Receive.” Account-based networks such as Ethereum are stricter: the everyday address you pay from is always exposed, and it only counts as fresh until its first outgoing transaction.

What holders should do now

Nothing urgent. Neither Europol nor Drake says keys are already being cracked. Still, a few sensible steps can be taken calmly and without rushing:

• check whether a large amount sits on an address you have already sent from, on Taproot or on your everyday Ethereum account;
• for long-term storage, create a new address in your wallet and move the coins there in a single transfer, then avoid sending anything from it unless you have to;
• copy the new address from your wallet's “Receive” screen rather than from your transaction history, because address poisoning works by slipping look-alike addresses into that history;
• keep your seed phrase offline, since a new address is useless if the phrase leaks, as we explain in our guide on how to store a seed phrase.

Coins held on an exchange are out of your hands here: the exchange chooses the addresses and controls their keys. That is why Drake speaks to Binance and Tether first.

How to move coins to a fresh address and swap them along the way

If you were planning to move your coins or swap one for another anyway, you can combine the migration with the swap. An exchange service sends coins to whatever address you give it, so all you need to do is paste a new address from your own wallet that has never sent anything. VertEXchange asks for no account, email or phone number: you pick a pair, paste the fresh address and see the rate and the final amount before you send anything.

For example, ether holders whose everyday account has been exposed since their very first payment can exchange ETH to BTC and receive it at a new bc1q address, whose key stays hidden behind a hash until you send from it.

• The fixed rate holds for about 15 minutes, and the amount does not change while your transfer is being confirmed.
• VertEXchange does not hold your coins, they go straight to your address.
• If the exchange does not go through, the coins are returned to your refund address.
• Personal fields of the order are deleted 24 hours after it completes, and your exchange history stays only in your browser.
• Questions are handled by the support chat on every page, using your exchange code.

FAQ

Can quantum computers already steal bitcoin?

No. According to the Europol report, no publicly known quantum computer can compute private keys today at the scale needed for theft. The risk lies in the future, but it pays to prepare early, because the transition will take years.

What is “bunker mode”?

That is Justin Drake's name for a calm mass migration of coins to fresh addresses whose public keys have never appeared on the blockchain. It is his personal recommendation, not an official Ethereum plan.

How can I tell whether my address's public key is already visible?

If the address has ever sent a transfer, its key is on the blockchain. Bitcoin bc1p… (Taproot) addresses and the earliest addresses reveal the key right away, even if nothing was ever sent from them. You can check outgoing transfers in a block explorer for your network.

How much bitcoin sits on exposed addresses?

According to Glassnode, about 6.04 million BTC, roughly 30% of all bitcoin. That includes about 20,000 early addresses holding 50 BTC each.

Do I need to move my coins right now?

There is no urgency, and Drake himself warns against rushing. It makes sense not to keep a large amount on an exposed address and to know in advance how to move to a new one, so you never have to do it in a panic.