Bitcoin’s publicly exposed supply has reached 7.12 million BTC, or 35.4% of issued coins, according to Glassnode, renewing discussion about which holdings a future quantum computer could target.
Summary
- Glassnode puts Bitcoin held behind visible public keys at 7.12 million BTC.
- Address reuse accounts for 25.8% of supply, including 11.6% held on exchanges.
- Bitcoin’s quantum proposals remain drafts, with separate plans for exposure reduction and signature migration.
Glassnode said in its Nov. 10 X post that more than a third of Bitcoin’s supply now has a visible public key, publishing a chart that separates exposure by address type and reuse. Its exchange figure sits within the address-reuse category, so adding the two percentages would double-count part of the total.
“Moving those coins to a fresh address ends this exposure,” the firm wrote, referring to coins exposed through reuse.
Address reuse accounts for most Bitcoin exposure
In its methodology, Glassnode separates structural exposure, where an output reveals a public key by design, from operational exposure caused by how wallets handle funds.
Reusing an address after spending can leave new or remaining coins tied to a public key already recorded on the blockchain. Early pay-to-public-key outputs and Taproot outputs expose keys through their design, the firm explains.
The latest figures imply that reuse accounts for nearly 73% of the exposed supply. Exchange-related exposure makes up roughly 45% of the reuse category, calculated from the percentages in the post.
An earlier May 20 snapshot put exposed holdings at 6.04 million BTC, or 30.2% of issued supply. Compared with that reading, the new total is 1.08 million BTC higher, with the share up 5.2 percentage points. As crypto.news previously reported, the May breakdown included 1.92 million structurally exposed coins.
Glassnode’s measure concerns public keys visible while coins remain unspent. It does not identify stolen private keys or predict when a quantum attack might become possible.
Satoshi’s holdings face a different question from brute force
A separate X post by Foxy argued that Satoshi Nakamoto’s estimated holdings could not be hacked because private keys have an enormous number of possible combinations and the coins are spread across thousands of addresses.
The authors of BIP 360 describe a different attack: a sufficiently capable quantum computer using Shor’s algorithm could derive a private key from its public key. Such an attacker would not need to guess every possible private key.
Their proposal specifically identifies early pay-to-public-key outputs, including Satoshi-era coins, as vulnerable to prolonged exposure. The exact holdings belonging to Bitcoin’s creator remain an estimate; the Foxy screenshot does not establish ownership of every attributed address.
For addresses that hide public keys behind hashes, BIP 360 notes that spending can reveal the key and create exposure if funds remain associated with it. Its authors caution that extended public keys and wallet descriptors can reveal vulnerable key information too, meaning on-chain address history does not describe every possible route to public-key disclosure.
In an October interview on wallet exposure and custody, Fireblocks Vice President of Research Michael Gutkin said exposure depends on address type and transaction history, not simply whether the holder is an exchange or individual.
He recommended directing new deposits and transaction change to fresh addresses while tracking exposed unspent outputs. Fireblocks supplies custody infrastructure and is developing related exposure-management tools.
Bitcoin proposals separate key hiding from signature replacement
BIP 360, authored by Hunter Beast, Ethan Heilman and Isabel Foxen Duke, proposes pay-to-Merkle-root outputs through a soft fork. It removes Taproot’s key-path spending option while retaining script-tree functionality.
The draft addresses attacks against keys exposed for long periods. Its authors say protection against faster attacks, attempted after a spending transaction reveals a key but before confirmation, may require post-quantum signatures.
A separate draft, BIP 361, proposes migration away from legacy signatures after a post-quantum output type becomes available. Its timetable would restrict payments to vulnerable addresses around three years after activation and tighten legacy spending requirements two years later.
Neither draft establishes a migration deadline currently binding on holders. Earlier debate over mandatory migration and freezing included Blockstream CEO Adam Back’s support for voluntary protections and opposition to forcibly freezing old wallets.
US standards already include post-quantum signatures
In the United States, the National Institute of Standards and Technology finalized its first three post-quantum standards in August 2024, following an eight-year effort.
The package includes ML-KEM for establishing shared secrets and two digital-signature standards, ML-DSA and SLH-DSA. NIST encouraged system administrators to begin integrating the standards because completing the transition would take time.
NIST described ML-DSA as its primary digital-signature standard and SLH-DSA as a backup based on different mathematics, offering an alternative if weaknesses emerge in the primary approach.
