Quantum risk puts 6.04 million BTC on the line

A new Glassnode report has revealed detailed insights into Bitcoin’s current vulnerability to quantum computing threats. The research shows that 6.04 million BTC, representing 30.2% of the total supply, are currently stored at addresses whose public keys are openly visible on the network. Meanwhile, 13.99 million BTC show no public key exposure, according to Glassnode’s extensive on-chain analysis.

Two main risk zones for Bitcoin

Glassnode separates exposed Bitcoin holdings into two categories: “structural” and “operational” vulnerabilities. Structural risk covers 1.92 million BTC, or 9.6% of supply, and is dominated by addresses from Bitcoin’s early “Satoshi era” with Pay-to-Public-Key (P2PK) outputs, outdated multisignature structures, and some modern Taproot addresses. Notably, these addresses reveal their public keys on the blockchain even if the coins remain untouched.

One significant risk associated with Satoshi-era BTC is that these old coins, which may be lost or abandoned, can no longer be transferred to newer, more secure address types—locking them into vulnerable states indefinitely.

Mini glossary: Pay-to-Public-Key (P2PK) refers to a Bitcoin output type from the earliest protocol versions, exposing the wallet’s public key directly on-chain. Taproot, a recent upgrade for privacy and flexibility, can also reveal public keys under certain conditions.

While Taproot addresses offer enhanced privacy and are not inherently insecure, they are counted under structural risk in this analysis because the underlying public key may still become visible on-chain in some instances.

Operational risk centers on user behaviors, such as reusing addresses or exposing keys during transactions. This practice, called address reuse, increases traceability and can leave funds more susceptible to future quantum attacks.

Exchanges and institutional holdings

Of the total 4.12 million BTC categorized as operationally at risk, approximately 1.66 million coins, or 8.3% of all BTC, are held in exchange wallets. This represents about 40% of the Bitcoin classified with operational vulnerabilities due to address management practices.

Glassnode’s data shows sharp differences among major exchanges. Coinbase exhibits only 5% of its Bitcoin holdings as at risk, while Binance’s figure jumps to 85%. At Bitfinex, all holdings are categorized as vulnerable to operational risk.

Government-held BTC tells a very different story. Bitcoin owned by the United States, United Kingdom, and El Salvador has no addresses exposed to quantum risk, and state reserves have consistently retained over 99% operational security in recent years.

Shifts in exchange address management

Data shows that in 2018, about 55% of exchange-held BTC was stored at operationally secure addresses. That proportion has since fallen to 45%. Glassnode notes that this trend can be reversed: regularly rotating addresses and effectively managing spending outputs can drastically reduce the risk landscape. Still, current numbers do not amount to an immediate threat assessment.

According to the Glassnode report: “Public keys exposed on the blockchain are a potential foundation for long-term quantum attack vulnerability. These risks can be greatly reduced with improved address management. However, there is currently no evidence of an urgent threat.”

Overall, the findings underscore the importance of diligent address management for Bitcoin holders. Avoiding address reuse and choosing newer security standards could help make crypto assets more resilient against future quantum attacks.