Bitcoin quantum exposure

The breakdown

Six buckets, ordered by BTC at risk. Where the BTC lives on the left (each wedge is that script type's share of the at-risk BTC). Where the addresses are on the right (each wedge is that script type's share of the at-risk address count). When the same script type makes a big slice in one wheel but a sliver in the other, concentration is at work.

Same numbers, as horizontal stacked bars:

Raw figures by script type

Balance distribution

At-risk addresses grouped by current balance. BTC share runs leftward from the bucket label; address-count share runs rightward; both at the same 0-100% scale. The crossover row (highlighted) is where the two are balanced: above it addresses dominate, below it BTC dominates.

Of the 12,749,047 at-risk addresses, 277,394 currently hold exactly 1 satoshi, 2,694,209 hold under 1,000 sats, and 11,484,229 hold under 1M sats. Dust dominates by count; whales dominate by value.

Concentration curve

How concentrated the at-risk pool is, plotted as a Lorenz curve. X-axis is the cumulative share of addresses (sorted smallest balance to largest); Y-axis is the cumulative share of at-risk BTC. The dashed diagonal is perfect equality (every address holds the same). The further the curve bows toward the bottom-right corner, the more concentrated the holdings. The Gini coefficient summarises the bow in one number, from 0 (equal) to 1 (one address holds everything).

Aged exposure

Of the currently at-risk supply, how long has each address been exposed? Age = base block height minus first-reveal block height (the moment the address's pubkey first hit the chain). The 5+ year bucket is dominated by Satoshi-era P2PK and ancient address-reuse stragglers: coins that have been forensically reachable for the entire modern history of the network.

Weekly change since 2026-05-31

Week-over-week change, updated every Sunday.

Quantum exposure over time

Stacked weekly snapshots. Always-exposed is the floor (largely Satoshi-era P2PK that hasn't moved + the growing taproot supply); reuse-exposed sits on top and tracks address reuse across active addresses. The full series accumulates as Sunday walks complete.

What's actually at risk

A quantum computer with enough qubit-stability to run Shor's algorithm against secp256k1 could derive a private key from any publicly-visible pubkey. Bitcoin's hash-based address types (P2PKH, P2WPKH, P2SH, P2WSH) protect the pubkey behind a SHA256 + RIPEMD160 hash until you spend. Once you do, the pubkey is permanently in the witness data for anyone to harvest, and every subsequent UTXO at the same address is just as exposed as the moment of first spend.

P2PK and bare-multisig outputs (mostly pre-2013 coinbase and ancient fund-flows) carry the pubkey directly in the output script; they were always exposed. P2TR (taproot) outputs use the x-only pubkey as the address by design, also always exposed. Address reuse on hashed types is the largest single contributor; the Satoshi-era P2PK supply is the most symbolically significant.

Why our number is honest

Three measurements triangulate Bitcoin's quantum-exposed supply. BIP-361 (Lopp et al.) reports over 34% as of March 2026 from an analytic count. Wicked Smart Bitcoin independently confirms this empirically at 34.55% (block 951,000, conservative on-chain parsing). We come in at 25.3% because we apply STRICT redeem-script parsing on P2SH and P2WSH spends: an address gets marked exposed only when the actually-revealed redeem script contains a pubkey push followed by OP_CHECKSIG/OP_CHECKSIGVERIFY, or contains OP_CHECKMULTISIG/OP_CHECKMULTISIGVERIFY. Timelock-only redeem scripts (OP_CHECKLOCKTIMEVERIFY OP_DROP OP_TRUE), hash-preimage scripts, and OP_RETURN-shaped wrappers don't leak pubkeys on spend and are correctly excluded.

The two on-chain measurements bound the truth. Wicked's conservative figure traces BIP-361's analytic upper bound: every P2SH/P2WSH address whose redeem script was ever revealed counts as exposed. Our strict figure is the rigorous lower bound: only redeems containing a pubkey-bearing opcode count. The ~9.2-point gap is the universe of P2SH/P2WSH spends whose revealed scripts do not contain a pubkey-bearing opcode: timelock-only redeems, hash-preimage shapes, OP_RETURN-style wrappers, and other puzzle scripts. Real exposure sits between the two values; both numbers are true under their respective parsing rules.

Methodology

• Source: our own bitcoind full node, queried via getblock verbosity 3 (returns each input's prevout, scriptPubKey, and witness inline).
• Registry: a chronological chain walk builds a master revealed_addresses set keyed on address. Every input and every output in every block is inspected.
• Exposure rules (mirrors BIP-361 threat enumeration):
  • P2PK / bare multisig / P2TR: always exposed at output-create time.
  • P2PKH / P2WPKH: reuse-exposed on first spend (witness contains <sig> <pubkey>).
  • P2SH / P2WSH: reuse-exposed on first spend iff the revealed redeem script contains a pubkey + CHECKSIG-family opcode.
• Aggregate: weekly UTXO-set walk via dumptxoutset; each UTXO's value is summed into its exposure slice if the address appears in revealed_addresses.
• Companion measurement: Wicked Smart Bitcoin publishes an independent on-chain dashboard using BIP-361's conservative parsing rules; their figure tracks the upper bound, ours tracks the rigorous lower bound. The gap is the universe of P2SH/P2WSH spends whose revealed redeem scripts do not contain a pubkey-bearing opcode.
• References: BIP-361 (Lopp et al.), P2PKH on bitcoin.it, our top exposed addresses by current balance.
• Further reading: Quantum and Bitcoin, the rabbit hole on LearnBitcoin.com.