30% of Bitcoin's supply has its public key showing

Roughly three in every ten bitcoin now sit in outputs whose public keys anyone can read on-chain. In mid-October 2026, a new industry group put a number on that exposure. The number is large, and so is the time before it could matter.

How much Bitcoin has its public key exposed, and does it put your coins at risk today?

The newly formed Quantum Alliance estimates that about 6.4 million BTC, or 30.2% of supply, sits in outputs with publicly visible public keys, according to CoinDesk . Decrypt reports the figure as 6.04 million BTC, about 30% . Your coins are not at risk today. No quantum computer that exists now can break Bitcoin's secp256k1 elliptic-curve signatures .

Quick Answer: The Quantum Alliance estimates that about 6.4 million BTC (30.2% of supply) sits in outputs with visible public keys. That includes about 1.1 million BTC attributed to Satoshi Nakamoto, per CoinDesk (October 16, 2026). No current quantum computer can break Bitcoin's signatures, so this measures future risk, not a present breach.

A public key is exposed when it appears on the blockchain instead of staying hidden behind a hash. That happens in three main ways, according to CoinReporter :

• Early pay-to-public-key (P2PK) outputs, which lock coins directly to a visible public key. Many of Bitcoin's earliest mined coins use this format.
• Reused addresses, where spending once from an address reveals its public key while coins remain at that address.
• Other output types that publish the public key on-chain by design.

The single most-cited figure inside the estimate is Satoshi Nakamoto's stash. CoinDesk reports that the 6.4 million BTC includes about 1.1 million BTC attributed to Bitcoin's pseudonymous creator . Those coins have never moved, so they cannot be migrated voluntarily. That is why the debate over what to do with exposed coins keeps coming back to them.

The dollar value is large. With BTC trading around $81,000–$81,500 on October 17, 2026, CoinReporter notes that the exposed coins are worth hundreds of billions of dollars on paper . Multiplying 6.04–6.4 million BTC by that price range gives roughly $490–520 billion.

For traders, exposure is a forward-looking risk metric. It is not evidence that anything has been compromised. It shows how much supply would be open to attack if a cryptographically relevant quantum computer (CRQC) arrived, meaning a machine powerful enough to derive private keys from public keys. That makes the open questions when such a machine could exist, and how fast Bitcoin can migrate before then. The real near-term risk is market sentiment: a credible quantum headline could move prices well before any wallet is actually threatened.

What is the Quantum Alliance and who are its nine members?

The Quantum Alliance is an industry group of nine crypto companies. It formed in mid-October 2026 to write shared post-quantum security standards, and it does not plan to build a blockchain of its own. Reports date the launch to between October 15 and 17, 2026. Some outlets place the announcement in Lisbon . Decrypt dates the launch to Thursday, October 17 . The coverage reviewed for this article did not point to an official alliance website. Until the group publishes its own materials, details about it come from press reports. Traders should treat the group as a coordination body that sets out standards and guidance. It cannot change how Bitcoin or any other network works.

The full member list comes from CoinReporter, which names all nine firms . CoinDesk and Decrypt name only some of them. Taken together, the members include base-layer protocols, privacy networks, rollups, hardware wallet makers and security auditors. Bitcoin Core contributors and the largest exchanges are not among them, which limits how much weight the group's standards will carry.

The alliance has a narrow mandate with three main outputs. According to KuCoin News and Decrypt, the group plans to publish:

• A "quantum-ready" definition: open standards for when a network, wallet or protocol can claim to be quantum-ready.
• Testing methods: compatible ways to check quantum-resistance claims, so projects cannot market "quantum-safe" without evidence.
• Migration guidance: practical steps for moving networks, wallets and infrastructure to post-quantum cryptography.

Its governance is modeled on the Internet Engineering Task Force (IETF), the open body that writes core internet protocols through rough consensus . Decrypt reports that the work is split into four working groups :

1. Blockchain migration: how chains move to post-quantum signatures.
2. Post-quantum zero-knowledge systems: proof systems that privacy networks and rollups depend on.
3. Wallet security: key generation, storage and signing on hot wallets and hardware wallets.
4. Cross-chain compatibility: keeping bridges and multi-chain tools working as each chain upgrades on its own schedule.

The membership explains the focus. Hardware wallet makers such as Keystone need common signing standards before they ship new firmware. Auditors such as Hacken need agreed test methods before they can certify any quantum-resistance claim. Quantus founder and CEO Christopher Smith described where the group thinks the industry is headed:

"In the future, 'post-quantum cryptography' will just be called 'cryptography' and everything else will be in a museum." — Christopher Smith, Founder and CEO at Quantus (source: Decrypt)

For traders, two caveats apply. First, several members sell quantum-resistant products, so they have a commercial interest in raising awareness of quantum risk. Second, the alliance has no authority over Bitcoin's own upgrade process. Any change to Bitcoin still has to go through the Bitcoin Improvement Proposal (BIP) process and win ecosystem-wide consensus. The group's standards could still shape how wallets and custodians label quantum readiness, and those labels may influence how institutional investors weigh the risk.

Why do outlets disagree on exposed BTC: 6.04M, 6.4M or 6.99M?

The three published figures for Bitcoin with visible public keys are close but not the same. Decrypt reports about 6.04 million BTC . CoinDesk reports the Quantum Alliance's estimate as 6.4 million BTC, or 30.2% of supply . Project Eleven has been cited at about 6.99 million BTC . All three put roughly 30% of supply in the exposed category. The gap between them comes from how each count was built, not from any disagreement about the underlying risk.

Each figure belongs to its own source:

• 6.04 million BTC (about 30% of supply): the figure in the headline and body of Decrypt's launch coverage .
• 6.4 million BTC (30.2% of supply): the alliance's own estimate as reported by CoinDesk. It includes about 1.1 million BTC attributed to Satoshi Nakamoto . KuCoin's news flash carries the same 6.4 million figure .
• About 6.99 million BTC: a Project Eleven estimate. We found it only in secondary reporting by Forbes, not in a Project Eleven dataset .

The coins in these totals all have one thing in common: their public key is already recorded on the blockchain. According to CoinReporter, they fall into three groups :

• Early pay-to-public-key (P2PK) outputs: outputs locked directly to a public key rather than to a hash of it. Most Satoshi-era mining rewards use this format.
• Reused addresses: once an address has spent coins, its public key is visible on-chain, so any coins still held there are exposed.
• Other outputs that reveal the key: any output type where the public key itself appears on-chain.

None of the outlets explains its method in detail, so the reasons below are likely explanations, not confirmed ones:

• What counts as "exposed": one count may include only P2PK and reused-address coins. A broader count may also include output types that reveal a key, which would push the total toward 7 million.
• How Satoshi-era coins are counted: the roughly 1.1 million BTC attributed to Satoshi is itself an estimate based on mining patterns. Small differences in which early coins are included shift the total.
• When the snapshot was taken: the exposed set changes every day as holders reuse addresses or move coins to new ones. The Forbes piece is from February 2026, while the alliance figures are from October 2026, so they measure different points in time.

One more number has been circulating that you should ignore for now. An aggregator summary claimed the alliance runs a "Quantum Doomsday Clock" with a projected date and a physical-qubit count. None of the cited coverage, including CoinDesk, Decrypt, CoinReporter and KuCoin, mentions the clock, and no official alliance website was found. Treat it as unconfirmed until the alliance publishes it. For trading purposes, the useful takeaway is the range: roughly 6 to 7 million BTC, or about 30% of supply, has its public key showing.

When could a quantum computer break Bitcoin, and what should be done about exposed coins?

No one knows when a quantum computer will be able to break Bitcoin, and the experts in the new Quantum Alliance do not agree on a date. Postquant Labs CTO Richard Carback thinks a cryptographically relevant quantum computer (CRQC) by 2028 is realistic . Bryn Bennett, CRO of The Vault, says the exact year matters less than being ready to migrate. The question of what to do with the roughly 30% of supply whose public keys are already visible is also unresolved. A CRQC is a quantum machine powerful enough to recover private keys from public keys, which would let it forge Bitcoin's secp256k1 signatures. No such machine exists today, according to CoinDesk (2026-10).

These two views lead to different plans. If 2028 is the working assumption, wallets, exchanges and custodians have about two years to build, test and adopt new output types. Bennett's view takes the date out of the question. The industry should prepare as if the deadline could come at any time, because a migration covering millions of addresses will take years whenever the hardware arrives.

Who would strike first

The biggest worry is not the date but who would control the first working machine. Quantus founder and CEO Christopher Smith told CoinDesk that the coins with exposed keys would probably be taken quietly, not attacked in public:

"The most likely scenario is that whoever gets the first CRQC will take them, probably with government blessing," — Christopher Smith, Founder and CEO at Quantus (source: CoinDesk)

For traders, the risk under this scenario is supply, not just security. About 1.1 million BTC attributed to Satoshi Nakamoto sits in exposed early outputs . If those coins moved suddenly, it could send a large amount of supply that has never moved into the market.

The options on the table

Four approaches have been floated publicly. Each one trades protection against a principle the community values:

• Freeze Satoshi's coins: Binance founder Changpeng Zhao has floated freezing Satoshi's holdings so an attacker could never spend them .
• Restrict vulnerable coins: Bitcoin developer Jameson Lopp has proposed restrictions on coins sitting in quantum-vulnerable outputs .
• Leave it to network governance: Bennett opposes freezing and says the decision belongs to the network's governance process, not to an industry group.
• Migrate rather than freeze: Carback prefers moving coins to quantum-safe outputs. He has suggested a trust structure with ownership-recovery provisions for coins whose owners cannot be found.

Source: CoinDesk, 2026-10.

The trade-offs any option faces

Every option runs into the same three limits. First, property rights: freezing or restricting coins means the network decides that some keys can no longer spend what they hold, which goes against Bitcoin's core promise. Second, neutrality: a protocol that singles out particular outputs, even for protection, stops treating every coin the same. Third, consensus: any of these changes would need agreement from developers, miners, exchanges and node operators, and Bitcoin rarely gets that quickly. There is also a cost. Post-quantum signatures are larger than today's signatures, which could raise fees or reduce throughput. As Decrypt notes, efforts outside the alliance are also active, including a $15 million consortium involving BlackRock, Strategy and Coinbase . That means more groups will need to agree on any plan, not fewer.

What is BIP-360 (P2MR, formerly P2QRH) and where does it stand in 2026?

BIP-360 is the main proposal for making new Bitcoin outputs harder for a future quantum computer to attack. As of October 2026, it is still a Draft and has not been activated on mainnet. It is now called "Pay-to-Merkle-Root" (P2MR). It defines a new SegWit v2 output type that works like Taproot but removes the key-path spend, which is the part a quantum computer could exploit . The proposal would protect coins that move into these outputs. It would not protect the roughly 30% of supply whose public keys are already on-chain.

Authors, history and naming

According to the BIP-360 specification in the bitcoin/bips repository, the authors are Hunter Beast, Ethan Heilman and Isabel Foxen Duke. The document is listed as created on December 18, 2024 . Its earlier name was P2QRH (Pay-to-Quantum-Resistant-Hash), and older coverage and forum threads still use that name. The new name says more precisely what the output commits to: a Merkle root of spending scripts, not a public key.

How the design works

To see what P2MR changes, start with Taproot. A Taproot output can be spent two ways:

• Key path: one signature from a tweaked public key. That key is embedded directly in the output, so anyone can see it on-chain.
• Script path: revealing one script from a Merkle tree of scripts, plus the data that script requires.

P2MR keeps the script path and drops the key path. Its addresses start with bc1z, and coins can only be spent through tapscript leaves . Because the output holds no public key, there is nothing for an attacker to work on while the coins sit unspent. The specification describes this as a defense against "long-exposure" attacks. In those attacks, an adversary has months or years to derive a private key from a key that is already visible. The design also leaves room for soft-fork opcodes that would check post-quantum signatures in the future. It does not mandate any of those schemes today.

Milestones so far, and what they do not mean

Two milestones from 2026 are often cited as signs of progress. Forbes reported that BIP-360 was merged into the bitcoin/bips repository in February 2026 . A month later, The Quantum Insider reported that BTQ Technologies had run a BIP-360 testnet with Dilithium signature opcodes .

Neither milestone changes how Bitcoin works. Being merged into the BIP repository means the document is accepted for tracking and discussion, not that Bitcoin Core supports it. A third-party testnet shows the design can be built, not that the network agrees to adopt it. Activation would require a soft fork, with adoption by miners, node operators and wallets. That process has not started.

The limits and the cost

P2MR only protects coins that move into it. Early pay-to-public-key outputs, including those attributed to Satoshi, would stay exposed unless their owners move them, which is why the fight over freezing versus migrating coins is a separate issue. Throughput is also a concern. Post-quantum signatures such as Dilithium are many times larger than today's Schnorr signatures. CoinDesk notes that this could raise fees or reduce the number of transactions per block once such opcodes are in use . In practice, BIP-360 is preparation. It would give Bitcoin a safe place to move coins to, but it does not defend coins that are already exposed.

How does Zakura's fix keep Zcash shielded swaps unlinkable against quantum attackers?

Zakura's fix gives every publicly posted Zcash shielded address its own one-time incoming viewing key. If a future quantum computer breaks one posted address, it can see only the payments sent to that address, not the rest of the user's history. Zakura announced the proposal on October 18, 2026 as "Post-quantum unlinkable swaps for Zcash, no network upgrades required" (source: Decrypt, 2026-10). Zcash and Bitcoin face different problems. Bitcoin's risk is stolen coins. Zcash's risk is that a privacy coin's transaction history gets exposed after the fact.

The problem is narrow but real. Zcash shielded transactions already hold up fairly well against future quantum attackers. The weak point is a shielded address that has been posted in public. That happens with intent-based swaps on NEAR, where the address is written to a public blockchain. Zakura's engineering write-up, by developer Adam Tucker, warns that a quantum attacker who recovers the key material behind a posted address could "link every payment that address's key has ever received" (source: Zakura Engineering, 2026-10). This is a "harvest now, decrypt later" risk: someone can record public data today and analyze it once quantum hardware is good enough.

The swap route already carries a lot of money. Decrypt reports that about $600–700 million had flowed through the NEAR Intents route as of May 2026 . Each of those swaps that used a reused, publicly posted address left a lasting public link back to the user's other activity.

The fix works at the wallet level. An incoming viewing key (ivk) is the key that lets a wallet detect and read payments sent to an address, and it cannot spend funds. Under Zakura's design, the wallet derives a separate, single-use ivk for each address it publishes, while the account's spending key stays the same. The user still has one account and one balance. The difference is that each posted address is cryptographically separate from the others, so breaking one exposes only the payments to that address.

"If a quantum computer ever breaks a posted swap address, it will not be able to link this to any other transaction," — Zakura, in the quantum-unlinkability write-up by developer Adam Tucker (source: Zakura)

More keys come with a cost: wallet recovery normally gets slower, because a restored wallet has to check for payments to every key it has ever derived. Zakura handles this with private information retrieval (PIR). PIR lets a wallet query a server for data without the server learning which addresses the wallet is asking about. It is the same technique already used in Zcash coinholder voting . Without it, wallets would have to choose between slow, full-scan recovery and showing a server exactly which addresses they own.

The rollout does not require a Zcash network upgrade, according to Decrypt, which also cites Josh Swihart, CEO of the Zcash Open Development Lab, in its coverage :

• Software wallets: the change ships through Zakura libraries such as Vizor "in the coming weeks."
• Hardware wallets: support follows after vendors release firmware updates.
• Protocol: no hard fork or consensus change is needed. Zakura presents this as a fix wallets can ship now, ahead of longer-term work such as Tachyon.

For traders, the point is that Zcash can reduce part of its quantum exposure through wallet updates alone, with no network-wide coordination. Bitcoin cannot do the same. Its exposed public keys sit in consensus-level outputs, so any fix depends on soft forks like BIP-360. The fix has limits. It protects addresses posted after a wallet adopts it, and it does nothing for addresses that have already been posted and reused. Swap users who care about long-term privacy should check that their wallet has added this feature before they publish new shielded addresses.

Bitcoin vs Zcash: how do the two quantum approaches compare?

Bitcoin and Zcash face different quantum problems, so their fixes take different paths. Bitcoin's risk is that public keys are already visible on-chain, and fixing that means changing consensus through a soft fork such as BIP-360. Zcash's risk is narrower: a published shielded address could be used to link that address's past payments. Zakura's design fixes this inside the wallet. No network upgrade is needed . In practice, a Zcash user may get protection within weeks, while a Bitcoin holder depends on a consensus process with no fixed end date.

The table below compares the two approaches on the points traders care about most: what is at risk, who has to act and how far each fix has progressed.

Sources for the table: the BIP-360 specification , the Zakura engineering write-up , and Decrypt .

The main point is that the two timelines differ sharply. Zakura's change is local. A wallet team can ship it, and a user can turn it on by updating software, without anyone else agreeing. Bitcoin's change works the other way. Even after BIP-360 is finalized, it has to win broad support and be activated. After that, holders still have to move their coins into the new outputs themselves. The roughly 1.1 million BTC attributed to Satoshi Nakamoto is unlikely to move, so it would stay exposed whatever is decided .

The Quantum Alliance's structure covers both problems. Its four working groups are blockchain migration, post-quantum zero-knowledge systems, wallet security and cross-chain compatibility . Here is how each one relates to the two cases (source: Decrypt, 2026-10):

• Blockchain migration covers Bitcoin's problem: how to move exposed coins into quantum-resistant outputs.
• Post-quantum ZK systems and wallet security fit Zcash-style privacy fixes that are delivered through wallet software.
• Cross-chain compatibility applies to intent-based swaps such as the NEAR route, where Zcash addresses are posted on another public chain.

The alliance does not include Bitcoin Core or Zcash protocol developers, so its standards are guidance, not binding rules for either network .

What should traders watch next on quantum risk through 2027?

Through 2027, traders should watch three things: the Quantum Alliance's first published standards, any progress on BIP-360 beyond Draft status, and Zakura's wallet releases. None of them is likely to move prices soon. Exposed public keys are a long-dated governance and migration risk, not an immediate catalyst. CoinDesk reports that the alliance puts the exposed amount at 6.4 million BTC, or 30.2% of supply . Every source agrees that no current quantum computer can break secp256k1 signatures. What matters for traders is how fast the migration work progresses, not how many headlines it gets.

The most useful signals to track are these:

• Alliance deliverables: The group has promised open "quantum-ready" standards, compatible ways to test quantum-resistance claims, and migration guidance from four working groups (Decrypt). No official alliance website appeared in launch coverage, so a published specification or site would be the first concrete sign of progress. The "Quantum Doomsday Clock" pointing to March 2028 that circulated in one aggregator summary has no primary source and should not be treated as a forecast.
• BIP-360 status: The proposal, now titled Pay-to-Merkle-Root (P2MR), is still marked Draft in the bitcoin/bips repository . Steps worth watching are a status change, reference code proposed to Bitcoin Core, and testnet work extending the March 2026 Dilithium-opcode trial reported by The Quantum Insider . None of these would mean mainnet activation.
• Zakura rollout: Software wallets using Zakura libraries such as Vizor are expected to get one-time incoming viewing keys "in the coming weeks", and hardware wallets will follow after firmware updates . Release notes from wallets that support the NEAR Intents route are the item to check.
• Institutional efforts: Decrypt also mentions a $15M consortium involving BlackRock, Strategy and Coinbase, and Coinbase's push for a Bitcoin quantum migration . Funding announcements or migration proposals from these firms could speed up the governance debate faster than any standards document.
• Governance flashpoints: Proposals to freeze or restrict vulnerable coins, including the roughly 1.1 million BTC attributed to Satoshi, would be the event most likely to affect market sentiment . Any such change would need ecosystem-wide consensus, which takes years, not weeks.

Your own exposure is something you can reduce now. A public key appears on-chain when you spend from an address, when you reuse an address after spending from it, or when you hold coins in early pay-to-public-key outputs . Three habits help:

• Use a fresh receive address for every incoming payment, which most modern wallets do by default.
• After spending, send the change to a new address rather than one you have already used.
• Check your long-term holdings for addresses that have already spent funds and still hold a balance, since their public keys are already public.

Moving coins to a never-spent address does not make them quantum-proof. It does take them out of the long-exposure group that BIP-360 is designed to protect.

The practical takeaway: treat quantum risk as something to monitor every quarter, not a reason to trade. Check alliance publications, BIP-360 status and wallet releases on that schedule. Avoid address reuse now. Save stronger reactions for concrete events such as a scheduled activation or a formal freeze proposal.

Frequently Asked Questions

How many bitcoin have exposed public keys?

Roughly 30% of Bitcoin's supply has a public key visible on-chain, but the exact count depends on the source. CoinDesk reports the Quantum Alliance's estimate as 6.4 million BTC, or 30.2% of supply. That figure includes about 1.1 million BTC attributed to Satoshi Nakamoto . Decrypt gives 6.04 million BTC, about 30% . Forbes has cited Project Eleven at about 6.99 million BTC . The figures likely differ for three reasons: different snapshot dates, different rules for which outputs count (early pay-to-public-key outputs, reused addresses and other outputs that reveal a key), and possible rounding or transcription gaps between outlets.

Can a quantum computer break Bitcoin today?

No. Every source covering the October 2026 news says no existing quantum computer can break the secp256k1 elliptic-curve signatures that secure Bitcoin . The concern is a future cryptographically relevant quantum computer (CRQC), meaning a machine powerful enough to recover private keys from exposed public keys. Experts disagree on timing. Postquant Labs CTO Richard Carback thinks a CRQC by 2028 is realistic. Bryn Bennett, CRO of The Vault, says being ready to migrate matters more than the exact date .

What is BIP-360?

BIP-360 is a Bitcoin Improvement Proposal, now titled "Pay-to-Merkle-Root (P2MR)" and formerly called P2QRH. It is still in Draft status . Its authors are Hunter Beast, Ethan Heilman and Isabel Foxen Duke, and it was created on December 18, 2024 . It defines a SegWit v2 output with addresses starting "bc1z". These outputs work like Taproot but without the quantum-vulnerable key-path spend, so coins can only be spent through tapscript script paths. The design also leaves room to add post-quantum signature opcodes later, according to the BIP-360 specification. BTQ Technologies ran a BIP-360 testnet with Dilithium opcodes in March 2026 , as reported by The Quantum Insider. BIP-360 has not been activated on Bitcoin mainnet.

What is the Quantum Alliance?

The Quantum Alliance is a group of nine crypto companies formed in mid-October 2026 to write shared post-quantum security standards. CoinReporter lists the members as Hacken, the Midnight Foundation, Quantus, Postquant Labs, Keystone, American Fortress, Intmax, Abelian and The Vault . The group will not launch its own blockchain. It plans to publish:

• open "quantum-ready" standards
• compatible methods for testing quantum-resistance claims
• migration guidance for networks, wallets and infrastructure

Its governance is modeled on the Internet Engineering Task Force (IETF), and the work is split into four working groups . Reports date the launch to between October 15 and 17, 2026.

Does Zakura's Zcash fix require a network upgrade?

No. Zakura announced the proposal on October 18, 2026 as "Post-quantum unlinkable swaps for Zcash, no network upgrades required" . Under the design, wallets derive a separate one-time incoming viewing key for each shielded address a user publishes, such as an address posted for a NEAR Intents swap. The spending key stays the same. If a quantum attacker breaks one posted address, it can see only the payments to that address, not the user's other activity. Wallet recovery uses private information retrieval (PIR), which lets a wallet query servers without revealing which addresses it is checking, according to Zakura's engineering write-up. Software wallets are expected to get the fix through Zakura libraries such as Vizor in the coming weeks. Hardware wallets will follow after firmware updates .

Enjoyed this article? Subscribe to get new stories by email whenever they're published.

Subscribe