Glassnode estimates that 7.12 million BTC, or 35.4% of issued supply, are associated with publicly exposed keys. The figure deserves attention, but it measures key visibility, not stolen coins or an imminent quantum attack.
- Address reuse is the largest category: 25.8% of supply.
- Exchange-related exposure is included in that figure, not added to it.
- BIP 360 and BIP 361 remain drafts: neither currently requires holders to move their bitcoin.
What Glassnode’s estimate measures
In a Nov. 10 post on X, Glassnode estimated that 7.12 million BTC, or 35.4% of issued coins, are associated with public keys visible on-chain while the coins remain unspent. The denominator is issued supply. This measures exposure, not coins whose private keys have been compromised or that an attacker can spend.
A public key can be visible without giving anyone control of the funds it protects. The private key authorizes a transaction. The quantum concern is that a sufficiently capable quantum computer could potentially derive a private key from its public counterpart. That is a possible future threat, not a capability Glassnode says exists today.
Glassnode’s May 20 snapshot put exposed holdings at 6.04 million BTC, or 30.2% of issued supply. The newer estimate is 1.08 million BTC higher, and the exposed share has risen 5.2 percentage points. Those changes do not explain why the estimate rose or show that the additional coins are practically vulnerable today.
Address reuse accounts for most exposure
Glassnode attributes 25.8% of supply to address reuse. Reusing an address can leave remaining or newly received coins associated with a public key already revealed on-chain. Glassnode also identifies structural exposure, where an output type reveals a public key by design. Its examples include early pay-to-public-key outputs and Taproot outputs.
The 11.6% of supply Glassnode identifies as exchange-related exposure is part of the 25.8% address-reuse category. It is not a separate category to add to the total. Based on the rounded percentages in Glassnode’s figures, address reuse accounts for approximately 73% of exposed supply, while the exchange-related portion makes up approximately 45% of the reuse category.
Glassnode said of coins exposed through address reuse: “Moving those coins to a fresh address ends this exposure.” The practical effect depends on the destination output type. Moving funds to a fresh output that does not reveal its public key by design can reduce ongoing exposure from address reuse, but it cannot erase a key already recorded in transaction history. The advice also does not address every form of structural exposure.
Fireblocks Vice President of Research Michael Gutkin has said exposure depends on address type and transaction history, not simply on whether a holder is an exchange or an individual. That distinction matters: “exchange-held” and “individually held” are not, by themselves, technical measures of key exposure.
Why a visible key raises a quantum question
Bitcoin uses public-key cryptography to authorize spending. If run on a sufficiently capable quantum computer, Shor’s algorithm could undermine the mathematical problem that protects certain public-key systems by deriving a private key from its public counterpart. The risk depends partly on whether a public key is exposed and partly on the future capabilities of quantum hardware.
Exposure does not prove that such a computer exists or that an attack is near. The timing and practical capabilities needed to carry out the attack remain unknown. Glassnode’s estimate measures the first issue, public-key exposure, not the second.
There is also a narrower timing risk: a public key may be revealed when a transaction is broadcast, before it is confirmed. The authors of BIP 360 say protection against an attacker exploiting that window may require post-quantum signatures, which are designed to resist attacks from quantum computers.
What the draft Bitcoin proposals would change
BIP 360 and BIP 361 address different parts of the problem. Both are drafts, and their wording and status may change. Neither currently sets a migration deadline that binds Bitcoin holders.
BIP 360: a different kind of output
Authored by Hunter Beast, Ethan Heilman and Isabel Foxen Duke, BIP 360 proposes pay-to-Merkle-root outputs through a soft fork. A soft fork is a protocol change that tightens or adds rules while remaining compatible with older software under specified conditions. An output is the part of a transaction that sets the conditions for spending bitcoin.
The proposed output would remove Taproot’s key-path spending option while retaining script-tree functionality. The aim is to reduce certain long-duration public-key exposure risks. But BIP 360’s authors say it does not address every threat scenario, including an attacker exploiting a key revealed by a transaction before confirmation.
BIP 361: a proposed migration away from legacy signatures
BIP 361 is a separate draft that proposes a transition away from legacy signatures once a post-quantum output type is available. “Legacy signatures” refers to the existing signature mechanisms the proposal seeks to phase out in favor of post-quantum alternatives.
Under the draft’s proposed timetable, restrictions on payments to vulnerable addresses would begin around three years after activation. Two years later, the proposal would further tighten the requirements for spending from legacy addresses. These are proposed stages tied to activation, not a countdown already underway. The draft would also have to advance through Bitcoin’s development and adoption process before any rules could take effect.
Any eventual migration would require coordination among users, wallet developers, exchanges and other services. It would also raise difficult questions about coins that are not moved. These are major policy and implementation choices, and a draft cannot settle them on its own.
Post-quantum standards are taking shape
Work on post-quantum cryptography is moving forward outside Bitcoin, too. In August 2024, the US National Institute of Standards and Technology (NIST) finalized its first three post-quantum standards after an eight-year effort.
- ML-KEM is for establishing shared secrets.
- ML-DSA is NIST’s primary digital-signature standard.
- SLH-DSA is a backup digital-signature standard based on different mathematics.
These standards mark progress toward practical post-quantum cryptography, but they do not automatically give Bitcoin an answer. Integrating new signature schemes into a decentralized network takes technical work, requires trade-offs and depends on broad coordination.
Key questions and answers
-
Does public-key exposure mean bitcoin has been stolen?
No. It means a public key associated with unspent coins is visible on-chain. Glassnode’s estimate does not show that private keys have been compromised.
-
What accounts for most of the exposure?
Address reuse, which Glassnode estimates at 25.8% of supply. The 11.6% exchange-related figure is included in that category.
-
How do BIP 360 and BIP 361 differ?
BIP 360 proposes an output type intended to reduce certain key-exposure risks. BIP 361 proposes a later migration away from legacy signatures once a post-quantum output type is available.
-
Do holders need to migrate their bitcoin now?
No. Both proposals are drafts, and neither establishes a currently binding migration deadline.
-
Is a quantum attack on Bitcoin imminent?
The exposure estimate does not answer that. It measures visible public keys, not quantum-computer capability, and gives no attack timeline.
The practical response is neither panic nor complacency. Address reuse is avoidable, and Bitcoin’s developers can keep examining longer-term defenses while the threat remains uncertain. But a meaningful migration would take careful design and coordination, not a rushed reaction to a percentage that measures exposure rather than compromise.
