Quantum computing exposes some bitcoin addresses, not all

What does "exposed to quantum computing" actually mean?

It means a stranger could work out your private key from something the blockchain already shows. A bitcoin wallet rests on a pair of numbers. The private key is a secret that authorises spending. The public key is derived from it and can be shared.

The Bitcoin Wiki's page on quantum computing puts the work of going backwards on an ordinary computer at about 2^128 operations. That number is far beyond any ordinary machine.

The same page says a sufficiently large quantum computer, running Shor's algorithm, could break a Bitcoin key in a practical number of steps. The word "sufficiently" carries the whole argument. Nothing in the sources read for this piece describes such a machine as working.

So exposure is a conditional. If a machine that large is ever built, a visible public key becomes a door. A hidden one stays a wall. Which coins sit behind which is the whole question.

Why are some addresses exposed and others not?

Most bitcoin sits under an address, and an address is a fingerprint of the public key, not the key itself. The key only appears on the blockchain when coins are spent from that address.

The Bitcoin Wiki states the consequence plainly. If an address is used once, the public key is revealed only at the moment of spending. An attacker would then have to break the key in the short window before the transaction confirms.

An address that has received coins and never sent any shows only its fingerprint. Breaking a fingerprint is a different problem. The wiki notes that quantum attacks on hashing are weaker, cutting the work from 2^256 to 2^128 operations, which is still impractical.

Two situations leave a key on show. Address reuse is one: spend part of the balance, leave the rest in the same address, and the public key is public while coins still sit there. Older output types are the other. The Cointelegraph report on the Google paper names a large cluster of early-era wallets holding 50 BTC each, the block reward of that period, with their public keys already exposed.

A worked example shows the scale difference. Take a ₹50 lakh bitcoin position split evenly across ten fresh addresses, each holding ₹5,00,000. Spending from one address reveals that address's key for the minutes until the transaction confirms. That is ₹5,00,000 of ₹50,00,000, or 10 percent, briefly in view. The other nine stay behind their fingerprints. The same ₹50 lakh in one address that has already spent and been reused has all 100 percent behind a visible key. The coin is the same in both cases, and only the storage habit differs.

What does the 6.7 million figure count, and what does it leave out?

It counts coins held behind public keys that are already visible. A paper from Google, Caltech and the quantum company Oratomic estimated that roughly 6.7 million BTC sits in wallets that could become easier to target. That was worth more than $450 billion on the report's date. Cointelegraph reported it on 31 March 2026.

Three things sit outside that number.

• It does not say when, or whether, a machine capable of the attack will exist. The figure measures exposure if one does.
• It does not count coins that can still be moved. An owner who spends from an exposed address into a fresh one removes that coin from the group.
• Its authors are not neutral. Cointelegraph notes that some of them hold stakes in Oratomic and six are employees, so the conclusions may also serve the company's commercial interests.

Cointelegraph also reports that more than 85,000 BTC from early-era or decade-old wallets moved in the twelve months before its report, though the true total may be higher. That is publicly reported movement, and its reasons are unknown. It shows that coins behind exposed keys are not frozen in place.

Read it as a count of how many coins would need to move before the door matters.

What would the network need to change?

The signature scheme itself. The Bitcoin Wiki says all commonly used public-key algorithms are broken by quantum computers, including RSA and all forms of elliptic-curve cryptography, and that quantum-resistant public-key cryptography does exist.

The wiki names Lamport signatures as the option Bitcoin experts tended to favour, with two costs. Signatures would be at least several kilobytes, 40 to 170 times larger than today's. And each key can safely sign only a fixed number of times.

On the standards side, the US National Institute of Standards and Technology finalised its first three post-quantum encryption standards on 13 August 2024. NIST encouraged system administrators to start moving to them, because full integration takes time.

Bitcoin has no administrator. A new signature scheme would be a software change the people who run the network must agree on. Then every holder would need to move coins to the new address type. Nothing in the sources read for this piece describes such a change as adopted.

One consequence of that last step comes from logic rather than from a source. Coins whose owners no longer hold the keys cannot move. If exposed coins of that kind exist, they stay exposed whatever the network decides.

Where does this leave an allocator?

Quantum risk to bitcoin is a migration-schedule question, and an allocator should size for it instead of trying to forecast it. The useful figure to follow is how much supply sits behind hidden keys over time, and it tells you more than qubit counts or conference headlines do.

Sizing is the control that works whatever the answer turns out to be. Take a written cap of 4 percent for crypto on a ₹1 crore portfolio. The whole sleeve is ₹1,00,00,000 × 0.04 = ₹4,00,000. No single technical risk can cost more than the sleeve, and the cap was set before the headline arrived.

Three checks are within a holder's reach.

1. Ask any custodian in writing whether it uses each address once and how it would move holdings to a new address type if the network changed.
2. In your own wallet, send each payment to a fresh address and leave no change behind in an address that has already spent.
3. Read how a basket holds its assets. An index holder owns exposure to every asset in it, and the custody arrangement decides which addresses those assets sit behind.

Qatobit's QSI indexes hold proportional exposure to every asset in the index, in institutional custody. How a custodian manages its addresses is a question for the custodian, and this page does not claim an answer on its behalf.

Related reading

The cap in the example above comes from how much of a portfolio should sit in crypto. For what a wallet type protects and what it cannot, read what a cold wallet protects. For how a single holding can dominate an outcome, see concentration risk. And for what a published reserve statement does and does not prove, see what proof of reserves proves.

Frequently asked questions

Can a quantum computer steal bitcoin today?

No source read for this piece describes a quantum computer able to break a Bitcoin key as working. The attack needs a sufficiently large machine, and the exposure figures measure what would be reachable if one is built.

Which bitcoin addresses are most exposed to quantum computing?

Addresses whose public key is already visible on the blockchain. That happens when coins have been spent from them and a balance remains, or when the address type shows the key directly. Addresses that have only received coins show a fingerprint of the key.

How many bitcoin are exposed to quantum computing?

One estimate, from a Google, Caltech and Oratomic paper reported by Cointelegraph on 31 March 2026, is roughly 6.7 million BTC. The figure depends on how exposure is defined, and the report notes some of the authors hold stakes in Oratomic.

Does moving coins to a new address fix the exposure?

Moving coins from an address whose key is visible into a fresh, never-spent address puts the coins back behind a fingerprint. The key is shown again at the next spend, so each address is best used once.

Is there a quantum-resistant way to sign bitcoin transactions?

Quantum-resistant signature schemes exist, and NIST finalised its first three post-quantum standards on 13 August 2024. The Bitcoin Wiki describes the trade-offs, such as signatures 40 to 170 times larger. Nothing in the sources read describes Bitcoin as having adopted one.

Crypto investments are subject to market risk. Not financial advice.