I still remember the first time someone casually mentioned that a quantum computer could one day crack open Bitcoin wallets. It sounded like science fiction back then. Yet here we are, looking at fresh on-chain numbers that show more than a third of the entire supply now sits behind publicly visible keys. That figure alone is enough to make any long-term holder pause.
Why Visible Public Keys Suddenly Matter More Than Ever
According to the latest on-chain analysis, roughly 7.12 million Bitcoin, or about 35.4 percent of all coins ever issued, currently have their public keys sitting out in the open. That is a noticeable jump from earlier readings this year. The rise is not dramatic overnight, but the direction is clear and the reasons behind it are worth unpacking carefully.
Most of this exposure does not come from some exotic technical flaw. It comes from ordinary habits. Address reuse remains the biggest single contributor. When someone spends from an address and then continues using the same one, or leaves change sitting there, the public key that was revealed during the first spend stays linked to whatever remains. Over time those habits add up across millions of wallets.
How Address Reuse Creates the Bulk of the Risk
Address reuse accounts for roughly 25.8 percent of the total supply. Inside that group, coins held on exchanges make up a sizable slice, around 11.6 percent of overall supply. Those exchange balances are not inherently more vulnerable than individual ones, but they do concentrate large amounts of Bitcoin behind keys that have already been revealed at some point.
I have watched this pattern for years. People treat Bitcoin addresses the way they treat email addresses or bank account numbers. Once they have one that works, they keep using it. It feels convenient. The problem is that every spend reveals the public key. After that moment the coins associated with that key sit in a different risk category than coins that have never been spent from a hashed address.
Moving the remaining balance to a completely fresh address ends that particular exposure. It is a simple action, yet surprisingly few holders treat it as urgent. The numbers show that clearly. The exposed total has climbed by more than a million coins since the spring snapshot, when the figure sat closer to 30 percent.
Structural Exposure Versus Everyday Habits
Not every visible key comes from reuse. Some outputs reveal the public key by design. Early pay-to-public-key outputs fall into this category. So do certain Taproot outputs that expose the key through their construction. These form what analysts call structural exposure. They are smaller in absolute terms than the reuse category, yet they include some of the oldest and most famous coins in existence.
That distinction matters. Structural exposure is baked into how the coins were created or received. Operational exposure comes from choices made after the fact. The current data suggests that reuse is responsible for the large majority of the total, nearly three-quarters of the exposed supply. That means most of the risk can still be reduced by deliberate wallet behavior rather than waiting for a protocol change.
Moving those coins to a fresh address ends this exposure.
That simple statement from the analysts captures the practical reality for the majority of affected coins. It does not solve every problem, but it solves the biggest one that users actually control.
What a Quantum Computer Would Actually Target
There is still a common misunderstanding about how a sufficiently powerful quantum machine would attack Bitcoin. Many people picture a computer trying every possible private key until it finds the right one. That approach remains computationally unrealistic even with quantum speedups for pure brute force. The real concern is different.
Once a public key is known, a quantum computer running Shor’s algorithm could derive the corresponding private key far more efficiently than classical machines. The attack does not need to search the entire key space. It works from the public information that is already sitting on the blockchain. Coins whose public keys have never been revealed remain protected by the hash that hides them. Coins whose keys are visible do not enjoy that protection.
This is why the 35.4 percent figure carries weight. It measures the portion of the supply that would be directly attackable the moment a machine powerful enough to run the algorithm at scale becomes available. No one knows the exact timeline for that machine. Estimates range from a decade to several decades. The uncertainty itself is part of the problem. Preparation takes time, and migration across a decentralized network takes even longer.
The Special Case of Early Coins and Legendary Holdings
Some of the oldest coins in existence fall into the structural category. Early outputs that paid directly to public keys rather than hashes have been visible for years. Discussions often turn toward the estimated holdings associated with Bitcoin’s creator. Those coins sit across many addresses, and the exact ownership remains an estimate rather than a confirmed fact.
The technical point is straightforward. Any coin whose public key is known is theoretically vulnerable once the quantum threshold is crossed. Coins that have never revealed a key through spending retain the protection of the hash. Spending from a hashed address does reveal the key, so the window between broadcast and confirmation becomes relevant for future faster attacks. That is a separate problem from the long-term exposure of keys that have already been public for years.
In my view the distinction between long-term exposed keys and keys revealed only at the moment of spending is one of the more important nuances in the whole discussion. The first group is the one that current data tracks so carefully. The second group would require different defenses, most likely post-quantum signature schemes that can be activated quickly enough to protect the broadcast window.
Current Proposals and Why They Remain Drafts
Two draft proposals currently sit on the table. One focuses on reducing the amount of long-term key exposure by changing how outputs are constructed. It introduces pay-to-Merkle-root outputs that remove certain key-path options while keeping script-tree functionality. The goal is to limit the surface area available to an attacker who has years to work on a known public key.
The second proposal looks further ahead. It sketches a migration path once a post-quantum output type exists. The outline includes a period after activation during which payments to older vulnerable address types would be restricted, followed later by tighter rules around spending from legacy outputs. Neither draft currently sets a hard deadline that forces every holder to move. The conversation around mandatory migration versus voluntary protection continues, and strong opinions exist on both sides.
I tend to lean toward solutions that give users clear options without freezing coins that people may have lost access to years ago. Forcing migration on dormant or inaccessible wallets raises difficult questions about ownership and fairness. At the same time, leaving a large percentage of the supply permanently exposed creates its own systemic risk. Finding the balance will not be simple.
Practical Steps Holders Can Take Right Now
While protocol changes move at the pace of consensus, individual behavior can change today. The most direct action remains generating fresh addresses for new receipts and for any remaining balances that sit on previously spent addresses. Wallet software already makes this straightforward for most users. The larger the balance, the more sense it makes to treat address hygiene as routine rather than optional.
Custody providers have begun building tools that track which unspent outputs still carry visible keys. Some of those tools flag exposed coins and help route change and new deposits to clean addresses. For institutions holding significant amounts, that kind of visibility is becoming a practical risk-management feature rather than a theoretical concern.
- Review every address that has ever sent a transaction
- Move remaining balances to brand-new addresses that have never been used
- Direct all future change and deposits to fresh addresses
- Keep a record of which outputs still carry structural exposure that cannot be cleaned by simple movement
- Monitor developments around post-quantum signature standards
None of these steps eliminate quantum risk entirely. They do reduce the portion of personal holdings that would sit in the most vulnerable category if a capable machine appeared tomorrow. For many holders that reduction is meaningful.
Broader Context From National Standards Bodies
Outside the Bitcoin world, government standards agencies have already published their first post-quantum cryptographic standards. The package includes algorithms for key establishment and for digital signatures. One signature scheme is positioned as the primary recommendation, while another based on different mathematics serves as a backup. The explicit message is that organizations should begin planning the transition because full migration across large systems takes years.
Bitcoin does not operate under the same centralized upgrade process, yet the existence of finalized standards removes one excuse for delay. The mathematical building blocks now exist in forms that have undergone extensive review. The remaining work is engineering those tools into a form that fits Bitcoin’s consensus rules and incentive structure.
Why the Percentage Keeps Climbing
The increase from roughly 30 percent earlier in the year to 35.4 percent today is not primarily driven by new structural outputs. Most of the growth comes from continued address reuse across the network. Every day more coins move through the same addresses, revealing keys that then remain associated with whatever is left behind. Exchange platforms, payment processors, and individual users all contribute to the trend in different proportions.
There is also a quiet psychological element. Quantum risk still feels distant to many people. The machines that could execute the attack do not yet exist at the required scale. When a threat sits years or decades away, the urgency to change daily habits drops. That is human nature. The data simply records the cumulative result of those individual decisions.
Perhaps the most interesting aspect is how uneven the exposure is. A relatively small number of addresses hold a large share of the visible keys. Cleaning those large balances would move the overall percentage more than thousands of small wallets could achieve on their own. That concentration creates both a risk and an opportunity for rapid improvement if major holders decide to act.
Looking Ahead Without Panic
I do not believe the current numbers mean Bitcoin is doomed. They do mean the network is carrying a measurable amount of technical debt that will eventually need attention. The good news is that most of that debt can still be reduced through ordinary wallet practices. The harder problems, the ones that require soft forks and new signature schemes, are already under discussion and have draft specifications on the table.
The real test will come when the first credible demonstrations of quantum capability against elliptic-curve cryptography appear in laboratory settings. At that point the conversation will shift from abstract percentages to concrete timelines. Holders who have already cleaned their address exposure will face a simpler decision set than those who have left large balances sitting on reused keys for years.
In the meantime the 35.4 percent figure serves as a useful benchmark. It is high enough to keep the topic alive in technical circles. It is also still low enough that deliberate action by a relatively small group of large holders could push the number meaningfully lower. Whether that action materializes remains an open question, but the data itself is now public and hard to ignore.
The next few years will show whether the community treats this as a slow-burning maintenance issue or continues to treat it as something that can wait indefinitely. My own sense is that the cost of early preparation is modest compared with the potential cost of a rushed migration under pressure. Clean addresses, careful change management, and attention to the evolving draft proposals form a reasonable baseline for anyone who intends to hold Bitcoin across multiple market cycles.
Quantum computing will arrive on its own schedule. The percentage of Bitcoin sitting behind visible public keys is something the network can still influence. That difference is worth remembering every time a new address is generated or an old balance is left sitting where it has already revealed its key.
The story does not end with a single data point. The 7.12 million coins now carrying visible public keys represent both a snapshot of past behavior and a signal about future priorities. How the community responds will shape the security posture of the network for decades. For individual holders the most practical response remains the simplest one: stop reusing addresses and move exposed balances while the option is still entirely under personal control.
That advice has been repeated for years. The latest numbers simply show how many people have not yet taken it. The gap between knowledge and action is still wide, and the quantum clock, whatever its true speed, continues to tick in the background.
I will keep watching the on-chain metrics. If the exposed percentage starts to decline, that will be a quiet but meaningful sign that more holders are treating key visibility as a real operational risk rather than a distant theoretical concern. Until then the 35.4 percent figure stands as the clearest available measure of how much of the supply currently sits in the category a future quantum computer could target first.
The conversation has moved beyond pure speculation. Concrete percentages, clear methodology, and draft technical proposals now exist side by side. The remaining question is whether the combination of data and draft code will be enough to change behavior before the underlying cryptographic assumptions face their first serious laboratory challenge. Time will tell, but the numbers already on the board leave little room for complacency.
