As of March 1, 2026, more than 34% of all bitcoin in circulation had published a public key on the blockchain. That line sits inside a draft improvement proposal that most holders have never opened, and it defines bitcoin quantum risk more precisely than any headline about codebreaking machines. Age does not decide which coins are exposed. Neither does wallet brand, nor exchange, nor whether the owner still holds the seed phrase. What decides it is whether the key has ever appeared on chain.
Nine of the largest firms in the industry put money behind bitcoin quantum research last week. The sum was $15 million, spread over three years. Set against the value sitting in exposed outputs, the arithmetic is worth doing slowly.
The public key is the part that leaks
Bitcoin signs transactions with ECDSA over the secp256k1 curve. A private key produces a public key, and a modern bitcoin address is a hash of that public key rather than the key itself. While coins sit untouched in such an address, the network sees only the hash. The key stays hidden.
Spending changes that permanently. To prove ownership, a wallet reveals the public key in the transaction data, and it stays in the chain forever. Anyone can read it. Today that costs an attacker nothing, because deriving a private key from a public key with classical hardware would take longer than the age of the universe.
Shor's algorithm collapses that gap. Run on a sufficiently large fault-tolerant quantum computer, it factors the elliptic curve relationship and returns the private key. No wallet breach. No phishing. The signature scheme simply stops being one-way.
So exposure tracks behaviour. A wallet that received coins once and never spent them keeps its key hidden. A wallet used repeatedly, sending change back to the same address, published its key the first time it moved anything and every time since. Coinbase's independent Quantum Advisory Council, whose report landed on June 17, put address reuse at the centre of the bitcoin quantum problem for exactly that reason.
Where the 34% actually sits
Three separate measurements land in the same place. BIP-361 states over 34% of supply had revealed a key by March 1. Coin Metrics, writing on May 5, sized bitcoin quantum exposure at roughly 6.9 million BTC, and the Coinbase council report reached up to 7 million, or about a third of eventual supply. Independent methods, one answer. At the $63,400 bitcoin traded near on Tuesday, 6.9 million coins carry a market value around $437 billion.
The composition matters more than the total, because the tiers behave differently.
| Exposure tier | Approximate BTC | Addresses | Can it migrate |
|---|---|---|---|
| Satoshi-era P2PK coinbase outputs | 1.7 million | ~34,000 | Only if keys still exist |
| Of which attributed to Satoshi | ~1.1 million | ~22,000 | Unlikely |
| Dormant wallets holding over 100 BTC | 0.41 million | ~550 | Owner dependent |
| Dormant wallets under 100 BTC | 0.11 million | ~20,000 | Owner dependent |
| Reused modern addresses, post-2017 blocks | ~4.6 million | Not published | Yes, by moving coins |
That last row carries the good news. Around 4.6 million of the exposed coins sit with owners who are alive, active and capable of moving funds to a fresh address once a safe format exists. The 1.7 million in pay-to-public-key outputs from the earliest blocks are a different matter. Those outputs published their keys by design, in 2009 and 2010, before address hashing became standard.
BIP-360 builds the exit door
Any bitcoin quantum migration needs somewhere to migrate to, and mainnet does not offer one yet. BIP-360 proposes Pay-to-Merkle-Root, a new output type that commits to the Merkle root of a script tree instead of exposing a key. Taproot reveals a public key on the keypath spend; P2MR keeps every key hidden until a specific branch executes. Addresses would carry a bc1z prefix under SegWit version 2.
The proposal went public on February 11, 2026 and has since merged into the official BIP repository. BTQ Technologies shipped the first testnet implementation in March, version 0.3.0 of its Bitcoin Quantum testnet, enabling five Dilithium signature opcodes. Dilithium is the lattice-based scheme NIST standardised as ML-DSA, and no known quantum algorithm breaks it.
Mainnet activation has not started. Soft forks in bitcoin take years and require miners to signal support, a threshold that recent proposals have failed to reach anywhere close to. BIP 110 needed 55% of blocks and never cleared 1%, which is the realistic template for how long a contested consensus change sits idle.
BIP-361 would lock whatever does not move
The companion proposal is where the bitcoin quantum debate turns unpleasant. BIP-361, titled Post Quantum Migration and Legacy Signature Sunset, carries six authors including Casa co-founder Jameson Lopp. Status: draft. It defines two phases, both activating by soft fork.
Phase A begins 160,000 blocks after activation, roughly three years, and blocks any transaction sending funds to a quantum-vulnerable address type. Phase B follows two years later and encumbers ECDSA and Schnorr spends with a quantum-safe rescue protocol. In practical terms, coins that nobody migrated within five years stop moving.
Opinion has split along property lines rather than technical ones. Michael Terpin of Transform Ventures calls a forced freeze permission inside a permissionless system, and argues a quantum theft would be a one-time episode the network survives. Alex Thorn, who runs research at Galaxy, opposes forced locks on the same principle, which is notable given Galaxy signed the consortium cheque. Changpeng Zhao floated a six to twelve month migration window, then clarified he was asking rather than proposing. Nic Carter suggested a salvage-law model with a government-appointed custodian taking a 10% to 15% finder's fee. Matt Hougan of Bitwise made the flattest observation of the lot: markets already price Satoshi's coins as permanently unavailable, so freezing them changes very little.
Protocol-level seizure is not hypothetical elsewhere. Arbitrum froze $71 million in a hacker's wallet through governance, an intervention bitcoin has no mechanism for and, for most of its holders, wants none.
Nine firms, $15 million, and $437 billion
On July 23, Strategy, BlackRock, Coinbase, Galaxy, Fidelity Digital Assets, Anchorage Digital, ARK Invest, Block and Blockstream announced the Bitcoin Security Consortium. The pledge: $15 million over three years, each member directing its own capital to organisations of its choosing. Mike Schmidt of Brink coordinates day to day in a volunteer capacity. The group states plainly that it does not develop or govern the protocol.
Divide it out. Five million dollars a year, across nine balance sheets, works out near $556,000 each annually. Measured against the $437 billion of exposed supply, the industry has committed roughly 3 cents of bitcoin quantum funding per $1,000 at risk. Phong Le of Strategy framed the incentive honestly enough: long-term holders want the network secure for generations.
The timelines under all of this do not agree with each other, and nobody involved pretends otherwise. Coinbase's council puts a workable attack 10 to 20 years out. BIP-361 cites McKinsey and academic roadmaps placing a cryptographically relevant quantum computer between 2027 and 2030. An April 2026 demonstration cracked a 15-bit elliptic curve key; bitcoin uses 256-bit keys, so the distance remains enormous, and the direction of travel is the only thing anyone agrees on.
FAQ
Which of my coins are exposed right now? Any address you have spent from has published its public key. Coins received at an address you have never spent from are still hidden behind a hash, whatever the address format.
Does moving my coins to a new address fix it? Partly, and only for now. Moving funds publishes the old key permanently but empties that output, so nothing remains to steal there. The new address stays hidden until you spend from it, which is why a genuine fix waits on a post-quantum output type.
Would BIP-361 confiscate Satoshi's bitcoin? It would render the coins unspendable rather than transfer them to anyone. That distinction carries no weight with the proposal's critics, who read any consensus rule that stops a valid signature as seizure by another name.
Is the bitcoin quantum timeline scheduled anywhere? No. BIP-360 sits in draft with a testnet implementation, BIP-361 sits in draft with no activation parameters, and neither has miner support behind it.
The number to watch over the next year is not the quantum hardware roadmap, which moves slowly and publicly. It is whether BIP-360 gains a release-ready implementation in Bitcoin Core, because everything in BIP-361 depends on an exit existing first. Custodians have their own version of the same question. The WEMIX attacker minted $5.2 million and could only move $724,000 off chain, a reminder that the gap between breaking a system and extracting value from it is usually where the defence actually lives.
