A recent industry study looked at a specific Bitcoin security question: which coins are exposed to quantum risk while they are simply being held. The key test is whether the public key tied to spent outputs has already been revealed on-chain.
By that measure, the report estimates that 6.04 million BTC are exposed to quantum risk, equal to 30.2% of total issued supply. The remaining 13.99 million BTC, or 69.8%, have not revealed their public keys during the holding phase and are not exposed under this model. The study says those figures broadly line up with other recent research.
The report divides the exposed supply into two categories. One is structural exposure, where the script type itself reveals the public key. The other is operational exposure, where coins may have started out protected but later lost that protection because of address reuse, partial spends, or custody behavior, while BTC remained at the same address.
How the exposed supply breaks down
The study puts structurally exposed Bitcoin at 1.92 million BTC, or 9.6% of total issued supply. Operationally exposed Bitcoin totals 4.12 million BTC, or 20.6%.
It also says exchange custody alone accounts for 1.63 million BTC in the exposed pool, which it presents as evidence that wallet discipline and custody design matter in reducing public-key exposure.
The authors add that the paper does not take a position on when practical quantum attacks may become real, and it does not judge the security or solvency of any custodian. Its aim is narrower: quantify the current state of public-key exposure across the network and distinguish between permanently high-risk assets and assets whose risk could be reduced through better wallet management and custody rules.
Why public-key exposure matters
Bitcoin is controlled by private keys, while public keys let the network verify whether a signature is valid. Under conventional cryptographic assumptions, a public key alone is not enough to derive the private key, so the funds remain secure.
The study frames the quantum threat around a different assumption. If a sufficiently capable practical quantum computer becomes available, Shor’s algorithm could be used to derive a private key from a known public key. Under that logic, once the public key is already visible, the asset is exposed. An attacker would not need to wait for the owner to move the coins because the public key is already available. If the public key is not visible on-chain, then under this static storage model the asset is not currently exposed.
The paper focuses on holdings that are sitting still while their associated public keys have already been revealed. It separates that from exposure during a transfer, where the public key becomes visible only when a transaction is broadcast and confirmed. In the report’s framework, the former is a measurable stock of exposed assets. It also notes that "safe" in this context only means the public key has not been revealed during the holding phase; it does not mean the asset is absolutely resistant to every future quantum attack model.
Structural exposure: built into the script type
These assets are exposed because of the address script format itself, not because users handled wallets poorly. The study includes early P2PK addresses from the Satoshi era, legacy P2MS multisig addresses, and modern Taproot addresses. They come from different periods and use cases, but share one trait: the public key, or equivalent public-key information, is disclosed on-chain by default. As long as the coins remain unspent, they may be targeted.
The report classifies 1.92 million BTC, or 9.6% of issued supply, as structurally exposed. It then breaks that group into three parts.
Coins from Satoshi and early blocks are described as permanently structurally exposed. If those assets are lost or their holders remain inactive, the paper says they are almost impossible to move to safer addresses unless the network reaches consensus on a protocol-level fix.
Taproot is treated separately. The study says Taproot brings strong privacy properties, efficient transfers, and flexible smart-contract functionality, so this is not framed as a design flaw. Still, from the standpoint of public-key exposure, Taproot reveals the key directly and therefore carries holding-phase quantum risk.
The paper also mentions the proposed BIP-360 P2MR approach. It says the idea is to preserve Taproot’s functionality while removing high-risk key paths, which could reduce this form of exposure. At the same time, it says P2MR would not automatically migrate existing Taproot balances and is not a final quantum-proof solution.
In short, part of the 1.92 million BTC in the structural bucket would be very hard to migrate, while another part could gradually be made safer through new standards and protocol work.
Operational exposure: caused by how addresses are used
Operational exposure is different. These address types can protect privacy at the start and do not reveal public keys by default. The problem appears when user behavior reveals the public key during spending, leaving any remaining balance at the same public-key-linked address without that protection.
That is the address reuse problem described in the report. Output types such as P2PKH, P2SH, P2WPKH, and P2WSH can hide public keys behind hashes while coins are idle. But once the public key is revealed during spending, any balance tied to that key, including future balances, loses that shield.
The study says operational exposure is now the main source of Bitcoin’s quantum risk. At 4.12 million BTC, it is 2.1 times the size of the structural bucket. The paper argues that most current Bitcoin quantum exposure is no longer mainly a legacy issue from early script design, but a result of weak key management and poor address practices.
Within the operational bucket, exchange custody makes up a large share. The report puts exchange-held exposed BTC at 1.66 million, equal to 40% of all operationally exposed balances. It also says the gap between exchanges and non-exchange holders is wide: roughly half of the Bitcoin tagged as exchange-held is vulnerable under this framework, versus less than 30% for non-exchange holdings.
Exposure differs sharply across institutions
The study says major institutions show very different exposure profiles. Some custodians have relatively low exposure, while others keep a much larger share of balances at addresses with known public keys.
- Low exposure: Coinbase has only 5% of custody assets with public-key exposure. Sovereign treasuries in the United States, the United Kingdom, and El Salvador are all listed at 0% quantum-risk exposure.
- Medium exposure: Fidelity and CashApp are listed at about 2%, while Grayscale is listed at about 50%.
- High exposure: Binance is listed at 85%, Bitfinex at 100%, and Robinhood and WisdomTree are described as having all custody assets exposed through public-key disclosure.
The paper adds a caution here. These figures reflect on-chain custody traces only and should not be treated as institutional risk ratings or as evidence about solvency.
Long-term trend and the paper’s conclusion
Over a longer period, the study says governments have kept more than 99% of holdings in the safe category. Exchanges, by contrast, have seen their share of safe assets fall from 55% in 2018 to 45% now, which the report links to frequent fund movements and more complex wallet structures.
Even so, the authors say this kind of risk can be reduced. Avoiding address reuse and moving change outputs promptly would cut the exposed balance relatively quickly.
The paper closes by restating the two categories. Structural exposure includes early legacy coins that are difficult to migrate, while newer proposals such as P2MR may gradually improve the risk profile of modern Taproot addresses. Operational exposure is larger in size but also more manageable, especially for exchanges that hold large balances and have the ability to carry out broad migration plans.
On that basis, the report argues that Bitcoin’s quantum-safety posture does not depend only on base-layer protocol upgrades. A large amount of exposed supply could be made safer through day-to-day operational changes. For exchanges and professional custodians, that means stricter address practices, better reserve layout, less key reuse, and concrete migration plans.