Bitcoin: Nearly 10% of Supply Structurally Unsafe from Quantum Risk

On-chain analytics firm Glassnode released a map of Bitcoin’s quantum-exposed supply, finding that a measurable share of BTC already carries public-key exposure on-chain. The report states 6.04 million BTC (30.2% of issued supply) are exposed at-rest, while 1.92 million BTC (9.6%) are classified as structurally unsafe due to output types that reveal public keys by design.

Glassnode divides exposure into structural and operational categories. Structural exposure includes legacy Pay-to-Public-Key (P2PK) outputs, certain bare multisig (P2MS) structures and Taproot (P2TR) outputs where the key path is visible; these account for the 1.92M BTC figure. Operational exposure—driven by address reuse, partial spends and custody practices—accounts for roughly 4.12M BTC (20.6%) of the measured supply, with exchange-held balances representing a large labeled subset of that operational bucket.

The report emphasizes this is an inventory of where public keys are visible today rather than a prediction that quantum attacks are imminent. Nonetheless, the findings highlight that some exposure is persistent and may be difficult to migrate (for example, lost Satoshi-era coins), while other exposure is reducible through improved wallet hygiene, key rotation and custody management. Glassnode notes significant variation across custodians in how much labeled reserve is currently exposed.

At a protocol level, proposed mitigations such as BIP-360’s Pay-to-Merkle-Root (P2MR/P2TSH) output aim to retain Taproot-like functionality while removing the vulnerable key-path spend, creating a migration path toward quantum-resistant address types without requiring a hard fork. These proposals are presented as steps in a broader, multi-year mitigation strategy rather than an immediate panacea for all exposed outputs.

Market reaction to the report has been measured: technical security warnings of this kind typically drive conversation and governance work more than instant price shocks, though exchanges and custodians may accelerate migration and address-management changes. Going forward, the interplay between protocol proposals, custody practices and any advances in quantum hardware will determine how quickly visible exposure can be reduced and what policy or engineering trade-offs the community accepts.