Bitcoin (BTC) Public-Key Exposure Hits 35.4% of Issued Supply

7.12 Million BTC Behind Visible Keys

No quantum attack on Bitcoin (BTC) has been recorded, yet the share of coins a future one could reach keeps widening. On-chain data published on Nov. 10 puts the supply behind visible public keys at 7.12 million coins, or 35.4% of the circulating supply. The metric counts coins whose public keys are visible while they remain unspent, the precondition for the attack scenario laid out in draft proposals for the Bitcoin network. The reading arrived with no directional move in the Bitcoin price noted alongside it.

Reuse of a previously used address drives most of the exposure. Coins held on such addresses account for 25.8% of issued supply, and 11.6% of all coins sit on reused addresses controlled by exchanges, a subset of the reuse figure rather than an addition to it. Part of this supply belongs to long-term holders who HODL on addresses they have spent from before, and the dataset's own commentary notes that moving coins to a fresh wallet address ends that exposure. The methodology behind the figures separates structural exposure, where an output reveals a public key by design, from operational exposure caused by wallet behavior, with early pay-to-public-key outputs and Taproot outputs in the first group. The latest breakdown implies reuse makes up nearly 73% of the exposed total, with exchange-related exposure at roughly 45% of that reuse category. An earlier May 20 snapshot put exposed holdings at 6.04 million coins, 30.2% of issued supply; the new reading is 1.08 million coins higher, with the share up 5.2 percentage points. The May breakdown counted 1.92 million structurally exposed coins.

BIP 360 and BIP 361 Sketch the Defense

A debate over Satoshi Nakamoto's coins ran alongside the data release. One argument circulating on X held that the creator's estimated holdings could not be hacked because private keys have an enormous number of possible combinations and the coins sit across thousands of addresses. The authors of BIP 360 describe a different route: a sufficiently capable quantum computer running Shor's algorithm could derive a private key from its public key, so no brute-force search is needed. Their draft names early pay-to-public-key outputs, including Satoshi-era coins, as vulnerable to prolonged exposure, and cautions that spending can reveal a hidden key too, as can extended public keys and wallet descriptors. Satoshi's exact holdings remain an estimate, and the post making the argument does not establish ownership of every attributed address.

BIP 360, authored by Hunter Beast, Ethan Heilman and Isabel Foxen Duke, proposes pay-to-Merkle-root outputs through a soft fork, removing Taproot's key-path spending option while keeping script-tree functionality. It targets attacks against keys exposed for long periods; faster attacks, attempted after a spending transaction reveals a key but before confirmation, may require post-quantum signatures. A separate draft, BIP 361, proposes migration away from legacy signatures once a post-quantum output type exists, and its timetable would restrict payments to vulnerable addresses about three years after activation, a step that would reach a strategic Bitcoin reserve as much as an individual wallet, then tighten legacy spending rules two years later. Neither draft sets a deadline binding on holders; earlier debate included Blockstream CEO Adam Back's support for voluntary protections and his opposition to forcibly freezing old wallets. The cryptographic tooling exists outside Bitcoin's own process: the US National Institute of Standards and Technology finalized its first three post-quantum standards in August 2024 after an eight-year effort, covering ML-KEM for shared secrets, ML-DSA as the primary signature scheme and SLH-DSA as a backup built on different mathematics. Fireblocks vice president of research Michael Gutkin has said exposure depends on address type and transaction history rather than on whether the holder is an exchange or an individual, and recommends directing new deposits and change to fresh addresses.

What Would Turn This Into an Event

Operational key-management risk is not hypothetical, as the $49 million Mercado Bitcoin hack showed, but this metric tracks a different thing: visible keys, not stolen ones. Nothing in the data identifies compromised private keys or dates the arrival of a machine able to run Shor's algorithm at scale. What would turn the statistic into an event is a binding migration deadline: a proposal that activates and then forces holders off legacy output types on a fixed timetable. No such text exists today. Both drafts remain unactivated, and until one is merged and scheduled the exposed share moves with wallet habits, address reuse and exchange custody practice, not with any quantum milestone.