Roughly 6.26 million BTC — equivalent to 31.2% of Bitcoin’s total supply — is currently held in addresses whose public keys are already visible on-chain, leaving those coins exposed to potential quantum computing attacks, according to new data published by Glassnode co-founder Rafael Schultze-Kraft.

The figure marks a notable increase from the 24.8% recorded in early 2021 and has returned to levels last observed in 2016, even as Bitcoin’s total supply grew by only 64,000 BTC over the same period. The exposure share thus climbed despite only marginal growth in the total supply. Of the exposed coins, approximately 4.33 million BTC became vulnerable through address reuse, meaning the public key was revealed in a previous spend, while another 1.94 million BTC are exposed structurally through script types such as Pay-to-Public-Key (P2PK) and Taproot. The visibility mechanic is central to the risk: hash-based address types conceal the public key until a first spend reveals it, and a sufficiently capable quantum computer running Shor’s algorithm could in principle derive a private key from any public key it can observe.

Within the structural category, 1.71 million BTC sits in P2PK outputs, of which 1.10 million is attributed to Bitcoin’s pseudonymous creator, Satoshi Nakamoto. P2PK is a legacy script type from Bitcoin’s earliest years that locks outputs directly to a public key rather than to a hash of one. A further 222,000 BTC is held in Taproot addresses, where the output key is visible by design. Glassnode stressed that the statistics measure on-chain key exposure only, do not indicate that any assets have been attacked, and do not constitute an assessment of the security of any exchange or custodian.

Schultze-Kraft, who co-founded the on-chain analytics firm Glassnode, shared the findings in a six-part thread posted on X on October 8, 2026:

6.26M #BTC , or 31.2% of supply, sits behind a public key that is already visible on-chain. At least that much would have to move in a migration to addresses whose keys are still hidden behind a hash. The share is up from 24.8% in early 2021 and back at 2016 levels. 1/6 pic.twitter.com/mpQw99i9ap

— Rafael (@n3ocortex) October 8, 2026
The full thread is available on X.

Exchanges and Institutions Show Sharply Divergent Exposure Profiles

The exposure is unevenly distributed across the industry. Among identified exchange holdings, approximately 1.79 million BTC — or 57% of the total — sits behind visible public keys, up from 55% in Glassnode’s May report.

The variation between individual platforms is considerable. Coinbase shows roughly 10% exposed balances, Binance 83%, and Bitfinex 100%, with seven of the fifteen largest exchange balances above 99%. Among other large holders, Fidelity reports only 2% exposure across its 375,000 BTC, while Grayscale stands at 49%, Revolut at 99%, and Robinhood at 100%. Government holdings in the United States, the United Kingdom, and El Salvador, by contrast, show effectively zero exposure.

The findings arrive amid heightened debate over the long-term durability of the Elliptic Curve Digital Signature Algorithm (ECDSA), the cryptographic scheme that secures both Bitcoin and Ethereum. Ethereum Foundation researcher Justin Drake recently urged the industry to begin planning for what he termed “bunker mode,” recommending a controlled migration of assets to fresh addresses whose public keys remain hidden behind hashes, while cautioning against panic and rushed transfers.

Ethereum co-founder Vitalik Buterin largely concurred, warning that AI-accelerated mathematical progress could undermine not only elliptic curves but also lattice-based schemes, and advocating hash-based cryptographic constructions where feasible. At the same time, Buterin advised holders against scrambling to move funds, noting that botched migrations have historically caused greater losses than hacks.

Glassnode’s data underscores that operational wallet hygiene, rather than protocol design alone, remains the most immediate lever available to the industry for reducing visible key exposure. Successive updates to the dataset — such as the May report referenced above — also provide a recurring benchmark for gauging whether exposed coins migrate behind hashes over time.

Source: Metaverse Post