Glassnode: 7.12 Million BTC Now Exposed to Quantum Risk Debate

Bitcoin's publicly exposed supply has reached 7.12 million BTC, or 35.4% of all issued coins, according to on-chain analytics firm Glassnode. The Nov. 10 figures renew a long-running question for practitioners: which holdings a future quantum computer could actually target, and what changes if the exposure keeps compounding.

Glassnode published the data in a Nov. 10 post on X, with a chart separating exposure by address type and reuse behavior. The exchange-held portion — 11.6% of supply — sits inside the broader address-reuse figure of 25.8%, so the two percentages cannot simply be added without double-counting.

"Moving those coins to a fresh address ends this exposure," the firm wrote, referring to coins exposed through address reuse. That single operational step, applied across the ecosystem, would address the majority of the problem.

How the exposure breaks down

Glassnode's methodology distinguishes two categories:

• Structural exposure, where an output reveals a public key by design — early pay-to-public-key outputs and Taproot outputs.
• Operational exposure, caused by wallet behavior: reusing an address after spending leaves new or remaining coins tied to a public key already recorded on the blockchain.

The latest figures imply that reuse accounts for nearly 73% of the exposed supply. Exchange-related exposure makes up roughly 45% of the reuse category.

The trajectory matters as much as the level. A May 20 snapshot put exposed holdings at 6.04 million BTC, or 30.2% of issued supply. The new total is 1.08 million BTC higher, and the share has risen 5.2 percentage points — meaning exposure is growing faster than the remaining unexposed base is shrinking.

Glassnode's measure concerns public keys visible while coins remain unspent. It does not identify stolen private keys and does not predict when a quantum attack might become feasible.

What about Satoshi-era coins?

A separate X post by Foxy argued that Satoshi Nakamoto's estimated holdings could not be hacked because private keys have an enormous number of possible combinations and the coins are spread across thousands of addresses.

The authors of BIP 360 describe a different threat model. A sufficiently capable quantum computer running Shor's algorithm could derive a private key from its public key directly — no brute-force guessing required. Their proposal specifically identifies early pay-to-public-key outputs, including Satoshi-era coins, as vulnerable to prolonged exposure.

Two caveats apply. The exact holdings of Bitcoin's creator remain an estimate, and the Foxy screenshot does not establish ownership of every attributed address. For addresses that hide public keys behind hashes, BIP 360 notes that spending can reveal the key and create exposure if funds remain associated with it. Extended public keys and wallet descriptors can also leak vulnerable key material, meaning on-chain history alone does not capture every disclosure route.

In an October interview, Fireblocks Vice President of Research Michael Gutkin said exposure depends on address type and transaction history, not simply on whether the holder is an exchange or an individual. He recommended directing new deposits and transaction change to fresh addresses while tracking exposed unspent outputs. Fireblocks supplies custody infrastructure and is developing related exposure-management tools.

Where Bitcoin's proposals stand

BIP 360, authored by Hunter Beast, Ethan Heilman and Isabel Foxen Duke, proposes pay-to-Merkle-root outputs through a soft fork. It removes Taproot's key-path spending option while retaining script-tree functionality. The draft targets attacks against keys exposed for long periods; its authors say faster attacks — attempted after a spending transaction reveals a key but before confirmation — may require post-quantum signatures.

A separate draft, BIP 361, proposes migration away from legacy signatures after a post-quantum output type becomes available. Its timetable would restrict payments to vulnerable addresses around three years after activation and tighten legacy spending requirements two years later. Neither draft currently binds holders to a migration deadline. Blockstream CEO Adam Back has supported voluntary protections while opposing forcible freezing of old wallets.

The reference standards, meanwhile, already exist. The U.S. National Institute of Standards and Technology finalized its first three post-quantum standards in August 2024 after an eight-year effort: ML-KEM for establishing shared secrets, plus the digital-signature standards ML-DSA — NIST's primary — and SLH-DSA, a backup built on different mathematics. NIST urged administrators to begin integration early because the transition will take years.

What does this change for holders and custodians today? Not an emergency — but a widening gap between reversible operational exposure, which fresh-address hygiene can eliminate now, and structural exposure that waits on a soft fork with no binding deadline yet set.