Glassnode Finds 35.4% of Bitcoin Supply Has Publicly Exposed Keys

What Glassnode’s exposure figure measures

Glassnode’s latest measurement identifies 7.12 million BTC, or 35.4% of all Bitcoin in existence, as potentially exposed to a future quantum attack because the coins’ public keys are already visible on the ledger. That figure describes a cryptographic condition, not coins already stolen or a flaw that ordinary computers can exploit. The source says a sufficiently capable quantum machine could, in theory, use a visible public key to derive control of the corresponding funds.

Bitcoin’s public ledger can reveal a public key in circumstances such as address reuse, according to Glassnode’s framing. The key is not itself a password that current computers can simply use to spend funds; the concern is a future machine capable of solving the cryptographic problem from that exposed information. Glassnode’s 7.12 million estimate therefore marks coins with a potential quantum vulnerability, not a measure of immediate access, confirmed theft or current losses.

Glassnode attributes 25.8% of supply to exposure from address reuse and says another 11.6% is held by exchanges in exposed addresses. The report also gives 35.4% as the overall exposed share. Because the two category figures add to more than that total, and the supplied account does not explain how the categories relate, they should not be treated as separate, non-overlapping portions or added to produce a new total.

Exchange custody and possible mitigation

Glassnode’s entity data reports exposed-address shares of 100% for Robinhood, 85% for Binance and about 5% for Coinbase. It reports no exposure for US government holdings. These figures concern the addresses associated with the entities in Glassnode’s data; the firm cautions that they are not security ratings. They do not, on their own, establish that funds have been compromised or provide a full assessment of each organization’s custody practices.

Coinbase’s position has added attention because it holds Bitcoin for most US spot ETFs, according to the supplied report. A Coinbase analyst has warned about quantum threats, and on October 29 the company’s CEO said work was underway to upgrade custody for a post-quantum environment. The statement signals that the issue is being addressed at the custody level, but the report does not give a completion date, describe the technical changes or say how much of Coinbase’s holdings they cover.

For coins exposed through address reuse, Glassnode says moving funds to a fresh address ends that exposure. The report says most owners can make this change in minutes, making address migration a practical distinction between many active holdings and coins that remain in old addresses. That mitigation does not resolve every case: the source separately highlights long-dormant coins and does not say that all holders will move or explain how exchanges will handle the process for customers.

Satoshi-linked coins and the upgrade debate

About 1 million BTC sits in early addresses linked to Satoshi Nakamoto, Ethereum Foundation researcher Justin Drake estimates. The coins have not moved in more than 15 years, according to the report. Their long inactivity matters to the upgrade debate because a move to a fresh address is the stated mitigation for reused addresses, while the report gives no indication that these holdings are about to move. The estimate is attributed to Drake and describes coins linked to Satoshi.

Casa’s Jameson Lopp has drafted a proposal that would freeze coins that never upgrade, including the Satoshi-linked holdings. Such a measure would address the risk of vulnerable coins being spent if the feared capability emerged, but it would also determine what happens to funds that do not migrate. The supplied account does not say the proposal has been adopted or provide an activation date. Its consequences for dormant owners remain a central unresolved question.

Blockstream CEO Adam Back takes a different position, preferring optional upgrades rather than a freeze, according to the report. The disagreement sets out a policy choice: whether Bitcoin should leave migration to holders or impose a consequence on coins that remain exposed. BIP-360 is cited as a separate draft, also without an activation date. Neither proposal is presented as an implemented network change, so their eventual form and community response remain uncertain.

Quantum timelines and competing estimates

The timeline for a capable quantum computer remains unsettled. Google said in March that a machine with fewer than 500,000 qubits could break this kind of encryption in minutes, but the report stresses that no such machine exists. Back has said one may still be 20 to 40 years away. These are contrasting assessments, not a confirmed schedule: the source does not establish when the technology might arrive or whether the cited capability will be achieved.

At Bitcoin’s market price at the time of the report, the exposed supply was valued at more than $500 billion; an earlier ARK Invest estimate put the figure above $480 billion. CoinShares, by contrast, counted only about 10,200 BTC as worth targeting for meaningful market impact. The estimates address different measures of exposure, and the supplied account does not give enough methodology to reconcile them. The headline supply value should not be read as a forecast of recoverable coins or losses.

On October 30, Nasdaq-listed Next Technology Holding approved selling or pledging about 5,833 BTC, citing quantum computing among other risks. The report does not say that the decision was caused solely by quantum concerns. Together with the unactivated drafts and the absence of a quantum machine, this example shows that the issue is already being discussed in corporate risk decisions while its technical deadline remains unknown. How Bitcoin handles dormant funds is still an open question.

Source: BeInCrypto