Bitcoin's Exposed Public Keys: How Much BTC Is Quantum-Vulnerable Right Now?
On April 14, 2026, Jameson Lopp and five co-researchers submitted BIP-361 to Bitcoin's official repository. The document contained a number that had been estimated before but never cited in a formal BIP: as of March 1, 2026, over 34% of all Bitcoin in circulation had exposed its public key on-chain. That is not a theoretical future risk. Those coins are sitting in addresses right now where, the moment a quantum computer powerful enough exists, an attacker could derive the private key from the public key and sweep them.
This post answers the specific data question: exactly how much Bitcoin has exposed public keys, how did each category become exposed, which coins can be protected and which cannot, and what the current proposals actually fix.
Why Public Key Exposure Is the Core Quantum Problem
Every Bitcoin address is derived from a public key. The public key is derived from a private key using elliptic curve mathematics over secp256k1. The security assumption is that you can derive a public key from a private key, but not the reverse. That one-way relationship is what makes Bitcoin wallets safe: even knowing your address and public key, no one can figure out your private key.
Shor's algorithm breaks that assumption on a quantum computer. Given a public key, a sufficiently powerful quantum computer running Shor's algorithm can derive the private key in minutes. The attack requires the public key, not just the address. Bitcoin addresses are actually hashed versions of public keys, and the hash is designed to be one-way, so a quantum attacker who only knows your address cannot immediately derive the key. The vulnerability activates the moment the public key becomes visible on-chain, which happens in several distinct ways depending on the address type.
The Four Categories of Quantum Exposure
Category 1: P2PK addresses (permanently structural). Pay-to-Public-Key is Bitcoin's original address format used in the network's first two years, before Satoshi and early developers switched to hashed addresses. In P2PK, the full public key is embedded directly in the output script on-chain. It never goes away. This includes every P2PK output from Bitcoin's first two years, including Satoshi's coins. There is no user action that can remove this exposure after the fact. The only protection would be spending those coins to a new, non-exposed address type before a quantum attacker acts, which requires access to the original private key.
Category 2: First-spend exposure on legacy and SegWit addresses. Standard P2PKH (Legacy) and P2WPKH (SegWit) addresses protect the public key until the first outbound transaction. When you spend from one of these addresses, your signature contains your public key, which becomes permanently visible on-chain. Any address that has ever sent Bitcoin has its public key exposed this way, creating a permanent quantum target. Address reuse amplifies this, since it means the same public key is associated with an address that may continue to hold funds.
Category 3: Taproot (P2TR) key-path spending. This is where 2026 analysis has added an uncomfortable new dimension. Taproot addresses expose a tweaked public key directly on-chain as elliptic curve points, permanently, by default, even while your coins just sit there doing nothing. Every wallet that has ever sent Bitcoin using a Taproot address has its public key permanently visible on-chain. In Google's data, P2TR outputs were associated with approximately 16.8 million BTC moved in 2025, representing 21.68% of all Bitcoin transactions that year. The Taproot upgrade was Bitcoin's most significant privacy and smart contract improvement. The unintended consequence is that it created a large new class of permanently exposed public keys.
Category 4: Mempool short-window exposure. Any address sending a transaction right now has its public key visible in the mempool for the duration of the block confirmation wait. For standard SegWit addresses that have never sent before, this is the only exposure window. Google's March 2026 analysis specifically modeled an attack against this mempool window, estimating a 41% success rate for a quantum attacker with a sub-9-minute key derivation capability against Bitcoin's 10-minute block confirmation. This category differs from the others because the window closes once the block confirms, but it is why the 9-minute runtime estimate matters practically.
The Numbers: A Full 2026 Breakdown
Glassnode's May 2026 report separates Bitcoin's quantum exposure into two layers. Structural exposure accounts for 1.92 million BTC, or 9.6% of issued supply. Operational exposure totals 4.12 million BTC, or 20.6%. Exchange-related balances make up 1.63 million BTC of that second bucket.
Project Eleven estimates that approximately 6.9 million BTC, roughly one-third of total supply, sit in addresses where the public key is already visible on-chain.
The BIP-361 document itself cites that as of March 1, 2026, over 34% of all bitcoins on the network have exposed their public keys on-chain.
Coinbase analyst David Duong estimated approximately 6.51 million BTC, or 32.7% of circulating supply, as the exposed figure.
Original Framework: Bitcoin Quantum Exposure Breakdown Matrix
| Address Type | Public Key Exposure | Exposure Timing | Can Be Self-Protected? | Estimated BTC Affected |
|---|---|---|---|---|
| P2PK (Genesis era, pre-2012) | Full public key in output script | Permanent from creation | Only by spending to new address type | ~1.7M BTC (inc. Satoshi's ~1.1M) |
| P2PKH / P2WPKH after first spend | Full public key in spending script | Permanent after first outbound tx | Only by moving remaining funds to unexposed address | ~2.5M to 3M BTC (estimate) |
| P2TR (Taproot) after key-path spend | Tweaked public key in output | Permanent after first spend | Only by moving to BIP-360 P2MR address (when live) | ~16.8M BTC moved via P2TR in 2025 (ongoing) |
| Mempool (any in-flight transaction) | Full public key in mempool | Window only; closes on block confirmation | Commit-reveal schemes (proposed, not deployed) | Transient, not quantifiable |
| Unexposed P2WPKH / P2SH (no spend) | None | Not yet exposed | Already safe; stay unexposed | Majority of "safe" BTC |
Satoshi's Coins: The Specific Problem No Proposal Fully Solves
Approximately 1.7 million BTC are locked in early P2PK addresses, including around 1.1 million BTC held by Satoshi Nakamoto, currently valued at roughly $74 billion. These are structurally exposed. Satoshi's public keys are permanently embedded in the block chain from 2009 and 2010. No upgrade to the Bitcoin protocol changes that. BIP-360 cannot protect them because no one can move them to a new address type without the original private keys.
Satoshi's 1.1 million BTC, spread across thousands of separate addresses, each with its own private key, represent 5.7% of Bitcoin's entire 21 million maximum supply, more than Strategy's 780,000+ BTC, more than BlackRock IBIT's 773,000+ BTC, more than the US government strategic reserve of 200,000+ BTC. The governance implications of those coins becoming quantum-vulnerable, or being frozen to prevent that outcome, are significant well beyond any one holder.
What BIP-360 Solves and What It Does Not
BIP-360, published February 11, 2026, introduces Pay-to-Merkle-Root (P2MR), a new Bitcoin output type. Its purpose is narrow and specific: it removes the public key from the on-chain output entirely. Where Taproot's key-path spend embeds a tweaked public key on-chain by default, P2MR commits only to the Merkle root of the script tree. There is nothing for a quantum attacker to target.
BIP-360 protects future coins moved to a P2MR address. It does nothing for coins currently sitting in exposed addresses. The holder must initiate a transaction from the exposed address to the new P2MR address, which is itself a moment of exposure, though a brief mempool window rather than a permanent one. Satoshi's coins cannot be moved without the original private keys. BIP-360 is not a solution to the exposed public key problem. It is a prevention tool for new coins and an opt-in migration path for holders who still have access to their private keys and choose to act.
What BIP-361 Proposes and Why It Is Controversial
BIP-361 is designed with three progressive stages. Phase A takes effect approximately three years after activation, at which point the network will prohibit new BTC from being sent to legacy addresses. Phase B takes effect five years after activation, at which point legacy ECDSA and Schnorr signatures will be fully deprecated, and any Bitcoin remaining in vulnerable addresses will be effectively frozen.
The proposal was immediately met with fierce backlash from the community, with critics labeling it as authoritarian confiscation, but co-author Jameson Lopp responded that he would rather freeze 5.6 million dormant BTC than let them fall into the hands of quantum hackers. Bitcoin has no formal on-chain governance mechanism. BIP-361 cannot be enacted by its authors. It requires node operators, miners, and wallet developers to adopt it voluntarily across a decentralized network, a coordination challenge that has no clean precedent in Bitcoin's history.
The Structural Problem That No BIP Addresses
Both BIP-360 and BIP-361 are responses to a vulnerability that was always present in Bitcoin's design and that became significantly more urgent when Google's March 2026 paper cut the qubit requirement by 20x. Neither proposal addresses the fact that Bitcoin was built without quantum resistance as a design goal, which means every layer of its cryptographic architecture, key generation, signatures, and address derivation, relies on assumptions a quantum computer invalidates.
A blockchain built natively around post-quantum cryptography, using ML-DSA (FIPS 204) for all signatures and quantum random number generation for all key material, does not have this category of legacy exposure problem. There are no P2PK outputs from a genesis era of pre-quantum assumptions. There is no Taproot-equivalent optimization decision that traded quantum safety for functionality. Every key ever generated on the network starts from a quantum-resistant foundation. That is the architectural difference between a retrofit and a native build, and the BIP-360/BIP-361 debate is making that difference concrete and urgent in real time. See how QubitChain.io's architecture eliminates this exposure class.
Frequently Asked Questions
Q: How much Bitcoin has exposed public keys?
A: Project Eleven estimates 6.9 million BTC (33% of supply). The BIP-361 document cites over 34% as of March 1, 2026. Glassnode breaks this into 1.92 million BTC structurally exposed and 4.12 million BTC operationally exposed.
Q: Why does an exposed public key make Bitcoin vulnerable?
A: Bitcoin's security relies on the difficulty of deriving a private key from a public key. A quantum computer running Shor's algorithm can do this in minutes, given the public key. Addresses that have never exposed their public key on-chain have no starting point for the attack.
Q: Can Satoshi's Bitcoin be protected?
A: Not without Satoshi's private keys. The coins sit in P2PK addresses with the full public key permanently on-chain since 2009 and 2010. BIP-360 cannot help without a transaction initiated from those addresses.
Q: What is the difference between structural and operational quantum exposure?
A: Structural exposure is built into the address type: P2PK outputs always expose the public key regardless of user behavior. Operational exposure happens through user actions like address reuse or Taproot spending.
Q: Does Taproot make Bitcoin more quantum vulnerable?
A: Yes, in a specific way. Taproot's key-path spend embeds a tweaked public key permanently on-chain after the first spend, creating a permanent quantum attack target rather than a brief mempool window. BIP-360 directly addresses this by removing the key-path spend from its new P2MR address type.
Q: What does BIP-361 propose?
A: It proposes three phases ending in the effective freezing of Bitcoin that has not migrated to quantum-resistant addresses by a deadline, including Satoshi's estimated 1.1 million coins. It has generated significant community controversy over whether this constitutes confiscation.
Reference Links