Bitcoin Quantum Risk: 7M BTC Exposed, BIP-360 [2026]
A little over one-third of all bitcoin in circulation now sits in addresses that a sufficiently powerful quantum computer could theoretically drain, according to wallet-scanning research that has moved from academic sidebar to boardroom agenda item in 2026. Project Eleven, a startup dedicated to tracking Bitcoin’s quantum exposure, put a number on the problem: roughly 6.99 million BTC live in addresses with exposed public keys, out of about 14 million addresses it scanned with non-zero balances. Coinbase’s internal quantum advisory work reached a similar figure, near 7 million BTC, and flagged that much of that exposure sits in active wallets and exchange cold storage, not just coins abandoned since the Satoshi era.
That’s the backdrop for a debate that has split the Bitcoin developer community this year: whether to force through a consensus change, BIP-360, that would give the network a quantum-resistant address format before a “Q-Day” ever arrives. The fight isn’t really about cryptography anymore. It’s about timing, coordination costs, and who moves first when 7 million BTC, worth hundreds of billions of dollars at current prices, is the collateral at stake.
The Numbers Behind Bitcoin’s Quantum Exposure Problem
Bitcoin’s public-key cryptography relies on the elliptic curve digital signature algorithm, or ECDSA, over the secp256k1 curve. That scheme is considered safe against classical computers for the foreseeable future. It is not considered safe against a large-scale, fault-tolerant quantum computer running Shor’s algorithm, which can derive a private key from a known public key in a fraction of the time classical hardware would need. The catch is narrower than headlines suggest: an attacker needs the actual public key, not just the wallet address, which is a hashed version of it.
That distinction is why the exposure breakdown matters so much. Project Eleven’s data shows address reuse is the single biggest culprit, accounting for close to 4.99 million BTC, or about 72% of the exposed total. Every time a bitcoin address is used more than once, the public key that gets revealed on the first outgoing transaction stays visible on the blockchain forever after. Legacy P2PK (pay-to-public-key) outputs, a format barely used today but common in Bitcoin’s earliest years, add another 1.72 million BTC, about 25% of the exposed figure, because those outputs show the raw public key from the moment they’re created. Even newer Taproot (P2TR) addresses aren’t fully immune: researchers flagged around 198,000 BTC, close to 3% of the exposed total, because Taproot’s x-only public key format still becomes visible on-chain under certain spending conditions.
Coinbase’s quantum work reached a comparable split, estimating close to 1.7 million BTC sit across roughly 20,000 legacy P2PK addresses where the key has been exposed since inception, and about 5 million BTC more where the key was revealed at some point through a spend. The overlap between these datasets, produced independently by a startup and an exchange, is part of why the estimate has held up as the reference figure cited across the industry this year.
| Exposure category | Estimated BTC at risk | Share of exposed total | Why it’s exposed |
|---|---|---|---|
| Address reuse (any type) | ~4.99 million BTC | ~72.3% | Public key revealed on first spend, stays visible forever |
| Legacy P2PK outputs | ~1.72 million BTC | ~24.8% | Raw public key visible from address creation |
| Taproot (P2TR) outputs | ~198,000 BTC | ~2.9% | X-only public key exposed under certain spend paths |
| Total flagged exposure | ~6.99 million BTC | ~100% | Combined dataset, Project Eleven scan of 14M+ addresses |
Put in dollar terms at current bitcoin prices, that exposed pool represents a meaningful fraction of the network’s total value, and it includes coins that are actively traded, not just relics. That’s the detail that turned this from an academic curiosity into an item on exchange risk committees’ agendas this year.
BIP-360 and the P2QRH Proposal: What’s Actually on the Table
The main technical response under discussion is BIP-360, authored by developer Hunter Beast, which proposes a new address type called P2QRH, short for pay-to-quantum-resistant-hash. The design borrows a page from Taproot’s playbook: instead of putting a raw public key on-chain, it commits to a hash of quantum-resistant signature data, keeping the actual key material hidden until the owner is ready to spend, and only briefly exposed at that point. Galaxy’s research team, which has published some of the more detailed technical breakdowns this year, describes the approach as a soft fork, meaning it could theoretically be adopted without splitting the network the way a hard fork would.
The mechanics matter because Bitcoin has no central authority to flip a switch. A quantum-resistant address format only protects funds once users actually move their coins into it. Coins sitting in old-format addresses stay exposed no matter what gets merged into Bitcoin Core, unless the network also implements some kind of forced migration, freeze, or clawback mechanism for unmoved legacy funds, an idea that is far more contentious than the signature scheme itself, since it touches Bitcoin’s core promise that nobody can be forced to move funds they control.
BIP-360 isn’t the only proposal that has circulated, but it has become the reference point in 2026 discussions precisely because it tries to solve the exposure problem without touching custody assumptions. Other approaches floated in developer forums include lattice-based signature schemes similar to the NIST-standardized ML-DSA (formerly CRYSTALS-Dilithium) and hash-based schemes like SLH-DSA, both of which trade smaller, faster ECDSA signatures for larger, slower quantum-resistant ones. That tradeoff is a real cost: quantum-resistant signatures generally run several times larger than ECDSA’s roughly 64-72 bytes, which has direct implications for block space and transaction fees if Bitcoin ever migrates its default signature scheme network-wide.
NIST’s Post-Quantum Standards: Where the Reference Framework Stands
Bitcoin’s debate doesn’t happen in isolation. The National Institute of Standards and Technology finalized its first set of post-quantum cryptography standards in 2024, covering key encapsulation (ML-KEM, formerly Kyber) and digital signatures (ML-DSA and SLH-DSA). Those standards are already being adopted across the broader internet: Cloudflare has rolled post-quantum key exchange into a large share of its TLS traffic, and browser vendors have shipped hybrid post-quantum key agreement by default in recent releases.
Bitcoin’s challenge is different from a TLS handshake, though. A web session’s cryptography can be swapped out server-side overnight. Bitcoin’s consensus rules require broad agreement among miners, node operators, exchanges, and wallet vendors before any change takes effect, and even after a soft fork activates, individual users still have to take action to protect coins sitting in old-format wallets. That coordination gap, more than the math itself, is what security researchers flag as the real risk multiplier: a cryptographic transition that might take a browser vendor a single release cycle could take Bitcoin years.
Q-Day Timelines: Optimists, Pessimists, and the Middle Ground
“Q-Day,” the informal shorthand for the moment a quantum computer becomes capable of breaking widely deployed public-key cryptography, doesn’t have an agreed date, and that uncertainty is itself part of the story. Estimates tied to Project Eleven’s 2026 research frame a baseline scenario around 2033, with an optimistic (meaning quantum computing advances faster) case of 2030 and a pessimistic case stretching to 2042. That’s an eleven-year spread between the most and least aggressive published estimates, which tells you how immature the forecasting still is.
Progress from quantum hardware makers keeps the debate alive. Google’s Willow chip, along with continued milestones from IBM’s superconducting roadmap, has been cited repeatedly in 2026 coverage as evidence that error-corrected, fault-tolerant quantum computing is advancing, even though none of the current generation of quantum processors comes close to the qubit count and error rates needed to actually run Shor’s algorithm against a 256-bit elliptic curve key. Skeptics inside the Bitcoin community make exactly that point: the threat is real in principle but not remotely imminent in practice, and treating it as an emergency risks pushing through consensus changes, and possibly divisive ones around forced migration, before there’s any hardware urgency to justify the risk.
| Scenario | Estimated Q-Day | Basis |
|---|---|---|
| Optimistic (fast quantum progress) | ~2030 | Aggressive hardware scaling assumptions |
| Baseline | ~2033 | Current published research consensus |
| Pessimistic (slow quantum progress) | ~2042 | Conservative error-correction and scaling assumptions |
| Skeptic position | No fixed date | Argues current hardware isn’t close enough to justify urgency |
Why Exchanges and Wallet Vendors Are Moving Now, Not Later
Even with a wide range on Q-Day, exchanges have practical reasons to move early. Coinbase’s advisory work on this topic wasn’t published as an alarmist warning, it was framed as inventory and planning, the kind of exercise a large custodian runs on any long-tail risk with a multi-year fuse. Cold storage operators face a specific structural problem: institutional custody wallets often reuse deposit addresses for operational convenience, and consolidating UTXOs (unspent transaction outputs) into fewer addresses, a common treasury practice, can inadvertently expose more public keys rather than fewer.
Hardware wallet makers face a parallel migration question. A quantum-resistant signature scheme with a larger key and signature footprint changes firmware requirements, secure element capacity, and potentially the physical design of devices built around today’s ECDSA-sized operations. None of the major hardware wallet vendors has announced a shipped quantum-resistant signing mode as of this year; the work so far is concentrated on research, standards tracking, and roadmap statements rather than production firmware.
Historical Context: This Isn’t Bitcoin’s First Cryptographic Scare
Bitcoin has weathered cryptographic anxiety before. The 2017 SegWit and 2021 Taproot activation debates both included side discussions about future-proofing signature schemes, and the broader cryptocurrency industry has already lived through smaller-scale quantum scares, including periodic claims, later walked back or left unsubstantiated, that a breakthrough was imminent. What’s different in 2026 is the quality of the exposure data. Earlier discussions were largely theoretical, arguing about what could happen to an idealized wallet. Project Eleven and Coinbase’s work instead scanned the actual, current state of the blockchain and produced concrete address-level numbers, which is what pushed the conversation from cypherpunk mailing lists into exchange risk assessments and, this year, into mainstream financial press coverage.
It’s also worth remembering that Bitcoin has successfully executed soft forks before, including Segregated Witness in 2017 and Taproot in 2021, both of which required broad miner and node signaling before locking in. Those precedents give BIP-360 supporters a template to point to. They also show how slow the process can be: Taproot took roughly four years from proposal to activation, and quantum-resistant address adoption, once live, would still need years more for users to actually move funds.
Market Impact: How Traders and Institutions Are Pricing the Risk
So far, the quantum exposure story hasn’t shown up as a measurable discount in bitcoin’s price, and that’s arguably rational given the Q-Day uncertainty range discussed above. What it has done is shape institutional due diligence. Custody providers evaluating new institutional clients increasingly ask about address reuse policy and UTXO management practices, treating quantum exposure as one input in a broader operational risk score alongside more immediate concerns like key management and multisig configuration.
Insurance underwriters covering digital asset custody have also started factoring long-tail cryptographic risk into policy language, generally as an exclusion or a rider rather than a primary rated risk, according to industry discussion of custody insurance terms this year. That’s a meaningfully different posture than five years ago, when quantum risk barely appeared in custody risk questionnaires at all.
The more immediate market effect has been on developer mindshare and grant funding. Bitcoin-adjacent research organizations have increased funding for post-quantum cryptography work aimed specifically at Bitcoin’s constraints, namely signature size and verification speed, both of which affect block capacity and fee markets if a new scheme becomes the default rather than an optional address type.
Competitive Comparison: How Other Chains Are Handling Post-Quantum Risk
Bitcoin isn’t the only network with this problem, and comparing approaches is useful context. Ethereum’s roadmap includes post-quantum signature research as part of its longer-term “The Verge” and account abstraction work, with some proposals aiming to let users opt into quantum-resistant signature schemes at the account level rather than forcing a single network-wide switch. That account-abstraction path is arguably more flexible than Bitcoin’s address-type model, since Ethereum’s smart contract accounts can already support pluggable signature verification logic without a base-layer consensus change.
Outside of crypto entirely, the broader internet infrastructure world has moved faster mechanically, if not more completely. TLS 1.3 implementations at companies like Cloudflare and Google have already deployed hybrid post-quantum key exchange in production traffic, something feasible because a web server upgrade doesn’t require the kind of dispersed, adversarial-proof consensus that a public blockchain does. That contrast is the clearest illustration of why “post-quantum migration” means something very different depending on whether the system in question has a single operator or thousands of independent, mutually distrustful participants.
| System | Post-quantum approach | Migration mechanism | Status as of 2026 |
|---|---|---|---|
| Bitcoin | BIP-360 / P2QRH proposed address type | Soft fork + voluntary user migration | Proposal stage, not activated |
| Ethereum | Account abstraction + pluggable signatures | Opt-in at smart-contract account level | Research / roadmap stage |
| TLS / web infrastructure | Hybrid ML-KEM key exchange (NIST standard) | Server-side rollout, no user action needed | Live in production at major providers |
| DNSSEC (Cloudflare) | Post-quantum signature algorithms | Provider-side rollout | Live, signature volume scaled up significantly in 2026 |
The Address-Reuse Problem Is Bigger Than Quantum Computing
One point that tends to get lost in quantum coverage: address reuse is bad wallet hygiene regardless of quantum computers. It has always leaked information, linking transactions together for chain analysis firms like Chainalysis and reducing the privacy Bitcoin’s pseudonymous design is supposed to provide. The quantum threat adds a new, more severe consequence to an old best-practice violation, which is part of why some security researchers frame quantum-resistant address adoption less as a novel emergency and more as an opportunity to fix a wallet hygiene problem the ecosystem should have solved already.
Practically, that means the near-term advice for individual holders doesn’t require waiting on BIP-360 at all: stop reusing addresses, avoid unnecessary UTXO consolidation that exposes dormant public keys, and treat any address that has ever sent a transaction as public-key-exposed going forward, because it is.
What Happens to Coins Whose Owners Never Move Them
The hardest open question in this entire debate has nothing to do with cryptography. It’s about the estimated 1 million-plus BTC widely attributed to Bitcoin’s pseudonymous creator, Satoshi Nakamoto, sitting untouched since the network’s earliest days, entirely in exposed, unmoved, legacy-format addresses. Those coins can’t opt into a new address format because nobody controls them anymore in any active sense. If a fault-tolerant quantum computer ever arrives, that Satoshi-era supply becomes the single largest and most symbolically loaded pool of at-risk bitcoin on the network, and there’s no proposal on the table today that resolves what should happen to it: freeze it permanently, let it be considered fair game, or something in between. That question alone is likely to generate more community conflict than the underlying signature math.
Predictions: Where This Goes From Here
- BIP-360 or a close variant is likely to see continued technical review and testnet experimentation over the next 12 to 18 months, but full mainnet activation before 2028 looks unlikely given Bitcoin’s historical soft-fork timelines.
- Expect large custodians and exchanges to publish or update address-reuse policies well ahead of any consensus change, treating it as low-cost risk hygiene rather than waiting for a protocol mandate.
- The debate over what happens to unmoved, quantum-exposed legacy coins, including suspected Satoshi-era wallets, will become more politically charged than the cryptographic design itself, and may end up as the primary blocker to consensus.
- Hardware wallet vendors will likely announce research roadmaps or firmware previews for larger post-quantum signature support before any of them ship a production quantum-resistant signing mode.
- Watch for Ethereum’s account-abstraction-based approach to post-quantum signatures to move faster in practice than Bitcoin’s base-layer address migration, simply because it doesn’t require the same network-wide coordination.
How Individual Holders Can Reduce Exposure Today
None of this requires waiting for a BIP to activate. Holders who want to cut their personal exposure now can start by generating a fresh receiving address for every transaction instead of reusing one, a setting most modern wallets, including hardware wallets, already support by default with hierarchical deterministic (HD) key derivation. Anyone holding funds in an old wallet created before HD derivation was standard should consider migrating balances to a modern wallet and a fresh seed, moving funds only once and consolidating carefully to avoid triggering unnecessary public-key exposure in the process.
For larger holdings, splitting funds across a multisig setup adds a practical layer of defense, since an attacker would need to compromise multiple keys, not just derive one private key from one exposed public key. None of these steps make a Bitcoin wallet quantum-proof. They do meaningfully shrink the pool of exposed, spendable value that any future attack, quantum or otherwise, could target.
Frequently Asked Questions
Is Bitcoin currently vulnerable to a quantum computer attack?
No. No existing quantum computer has the qubit count, error correction, or stability needed to run Shor’s algorithm against a 256-bit elliptic curve key in any practical timeframe. The risk being discussed is a future one, tied to hardware that doesn’t exist yet.
How much bitcoin is actually at risk from quantum computing?
Research from Project Eleven puts the figure at roughly 6.99 million BTC in addresses with exposed public keys, while separate analysis linked to Coinbase’s quantum advisory work estimated a similar figure near 7 million BTC. Both estimates represent close to one-third of circulating supply.
What is BIP-360 and how would it help?
BIP-360 is a Bitcoin Improvement Proposal authored by developer Hunter Beast that introduces a new address format, P2QRH (pay-to-quantum-resistant-hash), which keeps quantum-resistant public key material hidden behind a hash until spend time, reducing long-term on-chain exposure.
When will Bitcoin actually be at risk, according to experts?
Estimates vary widely. Published 2026 research frames a baseline “Q-Day” scenario around 2033, with an optimistic case of 2030 and a pessimistic case as far out as 2042. Some researchers argue no reliable date can be set given how early quantum hardware still is.
Can I protect my bitcoin from this risk right now?
Yes, mostly by avoiding address reuse, which is responsible for roughly 72% of currently exposed BTC. Using a fresh address for every transaction, migrating old pre-HD wallets, and using multisig for large holdings all reduce exposure well ahead of any protocol-level fix.
Does Taproot protect against quantum attacks?
Not fully. Taproot addresses are more resistant than legacy formats in some scenarios, but research has flagged around 198,000 BTC in Taproot outputs as exposed, because Taproot’s key-spend path reveals an x-only public key under certain conditions.
What happens to Satoshi Nakamoto’s bitcoin if quantum computers become viable?
That’s the ecosystem’s most unresolved question. Satoshi-era coins sit in old, exposed address formats with no active owner to migrate them, meaning they would become the largest single pool of at-risk, unmoved bitcoin, and there’s currently no consensus proposal for what should happen to that supply.
Are other cryptocurrencies handling this differently than Bitcoin?
Yes. Ethereum’s long-term roadmap leans on account abstraction to let individual accounts opt into post-quantum signature schemes without a network-wide base-layer change, a more flexible model than Bitcoin’s address-type approach, though it’s still at the research stage rather than shipped.
Related Coverage
