# Understanding Bitcoin’s Quantum Exposure: Separating Cryptographic Risk from Practical Threat
## A New Perspective on Quantum Vulnerability at Block 950,000
A widely discussed analysis of Bitcoin’s quantum vulnerability at block 950,000 reveals a critical nuance that often gets lost in headline-driven coverage. While approximately 6.90 million Bitcoin — representing 34.45% of the circulating supply — are technically exposed at the cryptographic level, the real-world risk picture is far more nuanced than the raw number suggests.
Cryptographic exposure simply means a public key has appeared on-chain, making a corresponding private key theoretically targetable by a sufficiently powerful quantum computer. But exposure is not the same as vulnerability, and vulnerability is not the same as economic loss. Understanding this distinction is essential for anyone trying to evaluate what quantum computing actually means for Bitcoin’s future.
## Active vs. Dormant Exposure
When researchers break down the 6.90 million exposed BTC into meaningful categories, a clear pattern emerges. Approximately 3.33 million BTC belonging to active entities — wallets that have moved at least 1 BTC within a five-year window — represent nearly half of all exposed supply. These belong to exchanges, custodial services, multisig operators, and other operational entities that have strong incentives and established processes to respond to emerging threats.
The remaining roughly 3.41 million BTC in never-spent or inactive addresses paints a different picture. After filtering out known operational entities and retaining only dormant, self-custodied, or potentially lost coins, the number narrows to approximately 2.28 million BTC spread across about 73,658 groups. This is the segment where practical quantum risk is most persistent and least likely to be mitigated in time.
## How Economics Shape the Real Attack Surface
Even among dormant exposed coins, a quantum adversary would face real-world constraints. Operating costs, throughput limitations, transaction fees, and the sheer logistical difficulty of targeting millions of small balances mean that rational attackers would focus on the highest-value targets first.
When researchers apply progressively higher balance thresholds to the dormant, non-entity exposed set, the attack surface compresses dramatically:
– At **1 BTC or more**: roughly 2.19 million BTC across about 39,897 groups
– At **10 BTC or more**: roughly 351,654 BTC across just 675 groups
This steep compression reveals that the economically rational target set is remarkably small compared to the total cryptographic exposure. A quantum attacker would have little incentive to spend resources cracking low-value dormant keys when a handful of high-value targets offer far greater returns.
## Script Types and Their Exposure Profiles
Analyzing the exposed dormant supply by script type provides additional insight into where the greatest risks lie:
– **P2PK (Pay-to-Public-Key)**: Dominates the lower balance thresholds with roughly 1.71 million BTC, reflecting early Bitcoin practices where public keys were exposed directly on-chain. These outputs are especially vulnerable because they were never hashed, meaning the public key was always visible.
– **P2PKH (Pay-to-Public-Key-Hash)**: Becomes more prominent at higher thresholds as older, larger P2PK outputs drop out of scope. These were introduced later but still represent a meaningful exposure category for dormant holders.
– **P2SH, P2WPKH, P2WSH, P2TR**: These more modern script types represent smaller portions of the dormant non-entity exposure. P2TR (Taproot) outputs are always exposed at the key level, but their high-value dormant presence is limited, consistent with the more recent adoption of these address formats.
It is worth noting that the apparent shift from P2PK to P2PKH dominance at the highest thresholds is largely a filtering artifact — many of the largest P2PK outputs in the dataset belong to the Satoshi-era genesis rewards of 50 BTC each, which fall above the 100 BTC threshold and are excluded from that category.
## Why Active Entities Are Not the Primary Concern
The fact that active, known entities hold a large share of exposed BTC should not be dismissed, but it also should not be overstated as the central quantum risk. Exchange wallets, institutional multisig setups, and custodial infrastructure are among the most operationally sophisticated participants in the Bitcoin ecosystem. These entities monitor technological developments closely, maintain security response teams, and have established procedures for wallet rotation and key migration.
The real concern lies in the opposite direction: the millions of dormant coins held by individuals or entities that may no longer exist, may have lost their keys, or simply lack the awareness or ability to respond to a quantum threat in time. These coins represent what researchers call the “hard-to-mitigate exposure surface” — the portion of exposed Bitcoin that is most likely to remain vulnerable.
## Migration Estimates: Useful for Scale, Not Forecasts
The analysis includes migration time estimates — how long it would take to move exposed funds based on UTXO counts and transaction throughput assumptions. These figures range from roughly 2.5 days for the most concentrated exposures to about 141 days for the full raw exposure set. However, these estimates serve primarily to illustrate the relative scale of different exposure categories. They are not predictions of real-world coordination speed, and they do not account for fee markets, network congestion, or the practical realities of mass wallet migration.
## The Bottom Line
The block 950,000 snapshot tells a story of contrasts. Bitcoin possesses a genuinely large cryptographic exposure surface — over 6.9 million BTC — but the practical exposure surface is concentrated, dormant, and much smaller. Active entities hold significant exposed supply but are also the most likely to migrate first. The persistent risk resides in old, inactive, and potentially lost coins that may never be moved.
Quantum exposure is best understood not as a uniform threat spread across all exposed Bitcoin, but as a concentrated problem of dormant, non-responsive coins — particularly early P2PK outputs and forgotten self-custody wallets. Recognizing this distinction is essential for forming realistic expectations about quantum risk and for prioritizing mitigation efforts where they matter most.
—
## Frequently Asked Questions
**What does it mean for Bitcoin to be “cryptographically exposed”?**
It means that a public key associated with a Bitcoin address has been broadcast on-chain, typically when funds were spent from that address. A public key alone does not grant access to funds, but it does provide the target a quantum computer would need to attack in order to derive the corresponding private key.
**Is 34.45% of circulating supply actually at risk of being stolen?**
Not necessarily. The raw exposure figure includes every instance where a public key has appeared on-chain, regardless of the owner’s ability or intent to respond. Active exchanges and custodians are likely among the first to migrate funds if a credible quantum threat emerges. The practical risk is concentrated in dormant and non-responsive holdings, which represent a much smaller portion of the total supply.
**What happens to Satoshi Nakamoto’s coins in a quantum scenario?**
Satoshi’s coins remain a subject of speculation. Some analyses retain them in exposure calculations because their public keys are visible. Whether these coins would be vulnerable depends on whether Satoshi still holds the corresponding private keys and whether they have been lost, forgotten, or secured with modern migration practices.
**Are P2PK addresses the biggest quantum risk?**
Yes, particularly for dormant holdings. P2PK addresses expose public keys by design and were common in Bitcoin’s earliest years. Many of these early outputs are inactive and belong to holders who may not be aware of the exposure. This makes them a persistent source of quantum risk.
**Can Bitcoin be upgraded to resist quantum attacks?**
The Bitcoin protocol supports the introduction of new address formats and script types with post-quantum cryptographic resistance. However, any such upgrade would require broad consensus among miners, nodes, and users. Migration would also be a massive logistical undertaking. Quantum resistance is more likely to be adopted through new address types rather than fundamental protocol changes.
**How soon could quantum computers threaten Bitcoin?**
There is no consensus on a timeline. Current quantum computers are far from possessing the qubit count, error correction, and stability needed to break Bitcoin’s elliptic curve cryptography. Estimates range from a decade to several decades, but the exact timeline depends on breakthroughs in quantum hardware development.
**What should individual Bitcoin holders do now?**
The most practical step is to avoid reusing addresses, especially for P2PK and P2PKH outputs. Using modern address formats like P2TR or P2WSH that keep public keys hidden until spending occurs reduces exposure. For large long-term holdings, considering a migration to a quantum-resistant address format — if and when such options become widely available — is prudent planning.
—
## Conclusion
The conversation around Bitcoin and quantum computing is often framed in alarming terms, with raw exposure numbers used to suggest imminent catastrophe. A closer examination of the data reveals a much more measured reality. While over 6.9 million BTC are technically exposed, the subset of coins that actually face meaningful economic risk — dormant, non-responsive, and high-value — is significantly smaller and highly concentrated.
The most vulnerable bitcoins are early outputs from a time when P2PK was the default, held by entities or individuals who may no longer be active participants in the network. Meanwhile, operational entities with large exposed balances are well-positioned to migrate their funds before any attack vector becomes practical.
Understanding this distinction — between cryptographic exposure and practical vulnerability — is the foundation of any serious discussion about quantum risk. It allows investors, developers, and users to focus on the real problem: a concentrated set of dormant, hard-to-reach coins that may never be protected if the quantum threat materializes before those coins are moved.
Proactive planning, modern address hygiene, and continued research into post-quantum cryptographic solutions remain the most sensible paths forward. The quantum threat to Bitcoin is real, but it is not uniform, and it is not imminent — it is a problem best addressed with clarity and precision, not panic.
Thank you for reading
