Key Takeaways
- • Glassnode identified 1.92 million BTC (9.6% of total supply) as structurally exposed to quantum computing risk due to output types that inherently reveal public keys, with Satoshi Nakamoto's holdings representing approximately 1.1 million BTC of this exposure.
- • An additional 4.12 million BTC (20.6% of supply) faces operational exposure through address reuse and poor key management practices, more than twice the structurally unsafe supply and concentrated heavily on centralized exchanges.
- • Exchange-held Bitcoin represents a disproportionate quantum risk concentration, with 1.66 million BTC (8.3% of total supply) exposed on platforms; Binance exhibits 85% exposed balances while Coinbase maintains only 5% exposure in labeled holdings.
- • Structural vulnerability stems from three output types: Satoshi-era Pay-to-Public-Key outputs, legacy multisig structures, and Pay-to-Taproot outputs, all of which reveal public keys regardless of address management practices.
- • Mitigation pathways exist through improved address standards and voluntary migration to quantum-resistant protocols, with BIP-360 proposing a Pay-to-Merkle-Root output type offering holders a technical upgrade path.
Summary
Blockchain analytics firm Glassnode published a comprehensive quantum risk assessment on May 20, 2026, classifying 1.92 million BTC—representing 9.6% of Bitcoin's total supply—as structurally exposed to potential quantum computing breakthroughs. This structural exposure category encompasses outputs whose design inherently reveals public keys regardless of address management practices, distinguishing it from operational exposure driven by user behavior and key management failures.
The structural risk breakdown reveals significant concentration in legacy Bitcoin holdings. Satoshi Nakamoto's coins account for approximately 1.1 million BTC of the structural exposure, with an additional 620,000 BTC in other early Satoshi-era outputs contributing to the vulnerability. Three specific output types drive this structural exposure: Satoshi-era Pay-to-Public-Key outputs, legacy multisig structures, and Pay-to-Taproot outputs—all of which expose public keys by design, creating a fixed vulnerability independent of user precautions.
Beyond structural exposure, Glassnode identified a substantially larger operational risk category affecting 4.12 million BTC (20.6% of supply), driven by address reuse and inadequate key management practices. This operational exposure exceeds structural risk by more than a factor of two, highlighting that user behavior and exchange security protocols represent a greater immediate threat than inherent protocol architecture. Exchange-held Bitcoin demonstrates particular vulnerability concentration, with 1.66 million BTC (8.3% of total supply) classified as exposed across centralized platforms. The exposure distribution reveals stark differences in exchange security practices, with Binance showing 85% exposed balances compared to Coinbase's 5% exposure in labeled holdings.
Glassnode noted that quantum exposure mitigation is achievable through improved address standards and voluntary user migration to quantum-resistant protocols. BIP-360 proposes a Pay-to-Merkle-Root output type offering a technical migration pathway for affected holders to transition away from vulnerable output structures. The combined structural and operational exposure (approximately 6.04 million BTC, or 30.2% of total supply) underscores the quantum threat's scope, though roughly 14 million BTC (69.8% of supply) remains unexposed under current classifications.
The structural risk breakdown reveals significant concentration in legacy Bitcoin holdings. Satoshi Nakamoto's coins account for approximately 1.1 million BTC of the structural exposure, with an additional 620,000 BTC in other early Satoshi-era outputs contributing to the vulnerability. Three specific output types drive this structural exposure: Satoshi-era Pay-to-Public-Key outputs, legacy multisig structures, and Pay-to-Taproot outputs—all of which expose public keys by design, creating a fixed vulnerability independent of user precautions.
Beyond structural exposure, Glassnode identified a substantially larger operational risk category affecting 4.12 million BTC (20.6% of supply), driven by address reuse and inadequate key management practices. This operational exposure exceeds structural risk by more than a factor of two, highlighting that user behavior and exchange security protocols represent a greater immediate threat than inherent protocol architecture. Exchange-held Bitcoin demonstrates particular vulnerability concentration, with 1.66 million BTC (8.3% of total supply) classified as exposed across centralized platforms. The exposure distribution reveals stark differences in exchange security practices, with Binance showing 85% exposed balances compared to Coinbase's 5% exposure in labeled holdings.
Glassnode noted that quantum exposure mitigation is achievable through improved address standards and voluntary user migration to quantum-resistant protocols. BIP-360 proposes a Pay-to-Merkle-Root output type offering a technical migration pathway for affected holders to transition away from vulnerable output structures. The combined structural and operational exposure (approximately 6.04 million BTC, or 30.2% of total supply) underscores the quantum threat's scope, though roughly 14 million BTC (69.8% of supply) remains unexposed under current classifications.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.