About a third of all bitcoin has already revealed its public key.
A quantum computer running Shor's algorithm could derive a private key from an exposed public key. Roughly 6 million BTC sit in addresses that have already published theirs. No quantum computer can do this today, but the exposed keys are on-chain forever — harvestable now, breakable later. These are independent research estimates as of March 2026, not a live count.
Bitcoin supply by exposure
of ~19.9M BTC · March 2026Ancient pay-to-public-key outputs — including coins widely attributed to Satoshi — publish the public key directly. These can never be un-exposed; only a protocol upgrade can protect them.
Addresses that received again after their first spend. The spend revealed the public key, and every coin still sitting there is exposed. This is the part individual holders can act on.
Held in addresses that have never spent, so the public key is still hidden behind its hash. Safe today — and stays safe only if the address is never reused and is evacuated before it must spend on Q-Day.
What you can actually do
Bitcoin cannot be made quantum-safe at the app layer — that needs a protocol upgrade (BIP-360 / BIP-361, proposed but not activated). Until then, the honest moves are preparation, not a cure.
The second clock: BIP-361's signature sunset
Quantum exposure is a fact about your address today. BIP-361 is something else: a proposal to stop accepting ECDSA and Schnorr signatures on legacy outputs entirely, on a schedule. As drafted it turns on the signature type, not on whether a key ever leaked — so an untouched address with no quantum exposure would still be caught by it.
Legacy addresses can still be spent from, but can no longer receive.
ECDSA and Schnorr spends from legacy outputs are rejected. Unmoved coins are stuck.
A proposed zero-knowledge recovery path for frozen coins. Not specified, not built.
BIP-361 is Status: Draft and is not activated. It is contentious for the obvious reason — it makes coins unspendable, and that is the intent rather than a side effect. It may be amended or may never activate, and no activation has been scheduled. We surface it because the dates would matter if it does, not because we are predicting that it will.
The trigger might not be a date at all
BIP-361 runs on a calendar. Pieter Wuille proposed something different in July 2026: disabling elliptic-curve spending on evidencerather than schedule. Which model wins changes what “I'll migrate when it gets close” is worth.
A predetermined block height, fixed at activation. Fires whether or not a quantum computer exists.
Years. Phase A is 160,000 blocks after activation and Phase B two years after that, so the dates are known in advance.
Draft, published 2026-04-14. Contentious — it freezes coins by design.
A successful spend from a nothing-up-my-sleeve point, which is only possible if secp256k1 is actually broken. The chain observes the break and reacts to it.
Effectively none. The trigger is a demonstration of the break, and by then an attacker capable of that demonstration can also derive keys from exposed public keys.
Proposal, discussed 2026-07-03. Not written up as a BIP.
A hashrate majority signals to disable EC spending.
Depends entirely on how quickly miners coordinate; it could be fast, and it is not a published schedule.
Proposal, discussed 2026-07-03. Not written up as a BIP.
A scheduled sunset can be planned against. An evidence-triggered one cannot: it fires at the moment the break is demonstrated, which is also the moment exposed keys start being drained. Preparation has to be finished before the trigger, not started at it.
Sources
The macro figures above are independent published estimates. They differ because they draw the boundary differently (some count only P2PK, others add every reused address), but all agree the exposed share is measured in millions of coins.
- Glassnode — 6.04M BTC (30.2% of supply) exposed; ~1.92M structural, ~4.12M via reuse.
- Coinbase advisory board — ~7M BTC exposed, including cold-wallet coins.
- Google Quantum AI — Breaking secp256k1 estimated at <1,200 logical qubits, minutes of runtime.
- BIP-361 — Over 34% of all bitcoin had revealed a public key on-chain as of 1 March 2026.
Estimates as of March 2026. PQWeave does not endorse any single figure; the per-address result in our scanner is computed live and is verifiable.