Bitcoin and the Quantum Computer: Which Addresses Already Expose Their Keys

If you hold your own Bitcoin, the most important question in the quantum debate is not a question about the future. It is one you can answer today on a block explorer: has your address ever revealed its public key? That single fact decides whether a future quantum computer could attack your coins at all. Addresses that have never sent anything do not show their key. Addresses you have spent from show it permanently.

The occasion for this article is a paper that, at first glance, has nothing to do with cryptocurrencies. On September 3, 2026, the G7 Cybersecurity Working Group, chaired by France, published the joint statement "Preparing for the Post-Quantum Era: A Call to Action". The message: do not wait for the first capable quantum machine, but take stock of your own encryption now and start migrating. For you as a holder of Bitcoin, that is not an abstract matter for government agencies. The first European milestone for the switch expires at the end of this year, and the question of which of your addresses are exposed is a question of custody.

This article answers three things: what on a blockchain would actually be vulnerable, how you can check your own position in a few minutes, and which deadlines the regulators have set. No price forecast, no doomsday.

What the G7 statement of September 3, 2026 calls for

The G7 nations are urging public authorities and companies to begin the migration to post-quantum cryptography immediately. Post-quantum cryptography is the umbrella term for encryption and signature schemes that remain secure even once a sufficiently large quantum computer exists. The paper names five fields of action: raising awareness of quantum-related risks, developing national strategies, advancing research and practical adoption, strengthening cooperation between government and industry, and anchoring post-quantum methods in security requirements and procurement.

Not one of those points is addressed to retail investors. The direction they point in still concerns you: once banks, exchanges and wallet providers have to rebuild their signature schemes, the way your coins are secured will change over the medium term. What the statement explicitly does not say has a section of its own further down. That honesty belongs here, because several articles in recent days have read the paper as a warning aimed at the crypto industry.

Harvest now, decrypt later: why migration starts before the quantum computer

The technical term that explains the urgency appears verbatim in the G7 statement. Harvest now, decrypt later describes an attack in which data is captured and stored in encrypted form today, to be decrypted later with a quantum computer. The statement puts it this way: "In these attacks, threat actors collect encrypted data now, with the intention of decrypting it in the future using quantum computing capabilities."

For confidential communication, that is the core of the problem. For a public blockchain the case is different, and rather more uncomfortable: there, nobody needs to capture anything. Every transaction, every public key and every signature has been visible to everyone in the chain since the day it was created. An attacker does not need to collect the data, because it is already there in full. The only thing missing is the computing power.

How a quantum computer would get at a Bitcoin address

Bitcoin secures balances with a key pair. The private key is the secret number you use to sign spends; the public key is the counterpart derived from it, against which the network verifies the signature. Deriving the public key from the private one takes seconds. The reverse is considered practically impossible with classical computers, because it rests on the discrete logarithm problem over an elliptic curve.

It is exactly that reverse path a quantum computer would short-cut. Shor's algorithm is a quantum method that solves factorisation and discrete logarithms efficiently, and therefore makes today's common signature schemes RSA and ECDSA vulnerable. A cryptographically relevant quantum computer is a machine large enough and error-free enough to run that method against real key lengths. No such machine is publicly known to exist.

What matters is the second line of defence Bitcoin has had from the start: a classic Bitcoin address is not a public key, but its hash. A hash is a one-way function that turns an input into a fixed fingerprint from which the input cannot be recovered. As long as only the hash is known, even a quantum computer has nothing for Shor's algorithm to work on. The key becomes visible only when you spend from the address for the first time, because your transaction then supplies the public key for verification.

Which Bitcoin addresses already expose their public key

That leaves three groups, and only the first two are of interest for an attack on dormant balances.

First, P2PK. Pay-to-public-key is Bitcoin's oldest output format, in which the public key sits unwrapped in the script, with no hash in front of it. It was common in 2009 and 2010, above all for mining payouts, and is no longer used for new payments today. Anyone holding such coins has had the key exposed permanently without ever having spent anything.

Second, reused addresses. Every address that has sent at least once and holds a balance again afterwards has revealed its key. This group is the larger one, and the only one you can do something about directly. Address reuse means using the same receiving address several times instead of generating a new one for each incoming payment.

Third, Taproot. Pay-to-Taproot, recognisable by the bc1p prefix, puts the public key directly into the output by design, because the format is built on it. Taproot addresses therefore share the property of P2PK, but account for only a small share of all Bitcoin.

Not on that list are the common formats P2PKH (prefix 1), P2SH (prefix 3) and P2WPKH (prefix bc1q), as long as nothing has ever flowed out of them. With those, the chain sees only the hash. If your balance sits on a fresh address of that kind and you have never sent from it, you are in the group an attacker cannot reach with Shor's algorithm alone.

6.8 million Bitcoin on exposed keys: where the number comes from

The most frequently quoted estimate comes from the Bitcoin firm River and splits into two items: roughly 1.72 million BTC in P2PK outputs and a further 4.9 million BTC on reused addresses in other formats, together about 6.8 million BTC open to an attack with a long run-up. Other analyses arrive at slightly different figures, because they treat addresses without balances or dust amounts differently; the order of magnitude of roughly a third of the circulating supply is stable across the surveys.

A substantial part of that sits in the earliest mining payouts, untouched for a decade and a half, among them the holdings attributed to Satoshi Nakamoto. Nobody can move those coins, because nobody moves the keys. That is precisely what fuels the debate over whether the network should one day freeze such outputs to keep them out of the wrong hands. What that proposal looks like and why it is contested is set out in our analysis of the possibly frozen 6.7 million Bitcoin from August 12, 2026.

For your own position, though, the large number is secondary. It does not tell you whether your coins are among them. You check that yourself, and here is how.

Checked in five minutes: is your address's key exposed?

For the check you need nothing but your receiving addresses and a block explorer. A block explorer is a website that makes the contents of the blockchain searchable; mempool.space and blockstream.info are widely used. You enter nothing secret there: an address is public, while your seed phrase and your private key never belong in a web form.

1. Read the address format. Open the receive function in your wallet and look at the start of the address. If it begins with bc1p, it is Taproot, and the key is visible. If it begins with 1, 3 or bc1q, the next step decides.
2. Look for outgoing transactions. Enter the address in the explorer and go through the transaction list. If it shows incoming payments only, the public key has not been published. If you find even a single outgoing transaction, it has been published for good, and nothing can undo that retroactively.
3. Match the balance. What counts is not whether the address was ever used, but whether anything still sits on it today. An exposed but empty address is not a risk.
4. Do not forget old holdings. Paper wallets from the early days, a long-retired wallet program or an inherited storage medium often contain exactly the formats at issue here.

Anyone with many addresses works with the xpub, the extended public key from which all addresses of an account can be derived. Some explorers accept it and show the entire history at once. Be aware that you are handing your complete payment history to the operator of the site. They cannot spend anything from it, but they can see everything.

Moving to a fresh address: what it gains you and what it costs

The only lever you hold as an owner is mundane and effective: move the balance from an exposed address to one that has never sent, and use a new address for every incoming payment afterwards. Modern wallets do this automatically, because they work as an HD wallet, deriving all addresses deterministically from a single seed phrase and moving on to the next one after each payment.

Three points deserve a sober look. First: during the migration transaction, your public key sits exposed in the mempool until the block is confirmed. The mempool is the waiting area for transactions not yet in a block. Against an attacker able to break a key within that window of a few minutes, no change of address helps; then again, such a machine would be a problem for the entire network anyway. Changing addresses protects against the slow attack on dormant balances, and that is the realistic case.

Second, the move costs network fees, and anyone consolidating many small amounts pays for every single input. When the network is busy, it can pay to wait for a quiet phase. Third, it remains an operation you should document cleanly: moving between your own addresses changes no owner, but a new transaction shows up in your records. Note down which address belongs to you, so the trail can be followed later and the attribution in your tax return does not fall apart; which tools take over that bookkeeping is shown in our comparison of crypto tax tools and portfolio trackers.

If you are thinking about custody anyway: a device that never hands the private key to an internet-connected computer changes nothing about the quantum risk, but it lowers the risk that actually affects you today. How the various models perform is set out in our hardware wallet comparison.

What your seed phrase has to do with the quantum risk

A misunderstanding persists here. The seed phrase is the sequence of words from which your wallet derives all keys. That sequence of words is not itself a signature scheme, and is therefore not directly affected by Shor's algorithm. What would be vulnerable are the public keys derived from it, once they are in the chain.

For hash functions there is a second quantum method, Grover's algorithm, which speeds up searching a data set quadratically. It halves the effective security level of symmetric schemes, turning 256 bits into 128 bits on paper. That remains beyond anything searchable in the foreseeable future. The same applies to mining: SHA-256 does not lose its value to quantum computers; at best it becomes somewhat faster to attack, and the effort stays astronomical.

So you do not need to replace your 24 words. The only thing you can change is which addresses hold your balance.

Coins on an exchange: the question you can put to your provider

If your holdings sit with a trading venue, you have no access to the addresses. The exchange manages its own wallets, usually with a few large pooled addresses that have long been exposed by their very nature. In return, it has staff who can carry out the rebuild as soon as quantum-safe methods are available in the protocol.

Two questions are worth putting to support: is there a published roadmap for post-quantum migration, and are customer holdings kept on addresses whose keys are not already exposed? Answers are rare at present, and the question itself is a usable selection criterion: a provider that can say nothing about its own custody technology says something about itself too. If you are putting the provider to the test anyway, the regulatory key data is in our overview of crypto exchanges.

For most investors the point still stands: the quantum risk is not a reason to switch exchanges today. Access and insolvency risks are the more immediate reasons to look into self-custody.

The deadlines in plain terms: end of 2026, 2030 and 2035

Behind the G7 appeal are dates that have long been set. In its roadmap for the transition to post-quantum cryptography, the European Commission has stated that all member states should begin the switch by the end of 2026. For critical infrastructure the rule is: as early as possible, and by the end of 2030 at the latest. By 2035, the transition should be completed as far as is practically feasible.

Technical standardisation is running in parallel. The US standards body NIST published the first three standards on August 13, 2024: FIPS 203 for key exchange, FIPS 204 as the primary signature scheme and FIPS 205 as a hash-based fallback. In its transition paper, RSA and today's common curve cryptography are deemed deprecated from 2030 and disallowed from 2035. That puts a date on the table from which the schemes underpinning Bitcoin signatures may no longer be used in government systems.

For Germany, the Federal Office for Information Security frames the rebuild. The BSI notes that "the question of whether or when quantum computers will exist is no longer the central one", and recommends a gradual switch: "Post-quantum methods should where possible be used only in combination with classical methods, in other words hybrid." A hybrid scheme combines an established method with a new one, so that security is preserved if one of the two turns out to be weak.

None of these deadlines obliges you to do anything. But the dates set the pace at which banks, payment service providers and custodians will work, and they show that the authorities consider the window to be limited.

What the G7 statement explicitly does not say

A caveat belongs here, because it gets lost in the coverage: the G7 statement does not mention cryptocurrencies, blockchain or the financial sector at all. The paper is addressed to state bodies and companies in general. Anyone turning it into a call to action for the crypto industry is putting words in the source's mouth.

The connection between the two is nevertheless substantive, just indirect: both sides rest on the same mathematics. If curve cryptography falls, it falls for government certificates as much as for Bitcoin signatures. The difference lies in how easily each can be changed. A public authority swaps out its software; an open network with millions of participants first has to agree on what it wants to swap out at all.

BIP-360 and BIP-361: Bitcoin's own way out of the signature problem

That agreement is already under way, in the form of improvement proposals. A BIP is a Bitcoin Improvement Proposal, a formalised proposed change to the protocol that is discussed in public and implemented only with broad support.

BIP-360 describes a new, quantum-resistant output format into which holders could voluntarily move their coins in future. The proposal was added to the official repository in early 2026. BIP-361 builds on it, going further and providing for an orderly exit from the old signature types. The consequence would be that coins on exposed keys could no longer be spent after a transition period, effectively freezing them to keep them away from an attacker.

That is exactly what ignites the sharpest dispute in the Bitcoin world: on one side stands the argument that a theft running into the millions would destroy trust in the scarcity of the money. On the other stands the objection that a network able to freeze balances breaks its central promise. How the camps argue is set out in our assessment of the security debate from March 2026. Neither proposal has been adopted to date.

Ethereum and other chains: why migration works differently there

On Ethereum the same question arises with a different sign. Account addresses are likewise derived from a public key that becomes visible on the first send. Unlike Bitcoin, however, rules can be changed through scheduled network upgrades at shorter intervals, and the Ethereum Foundation's research agenda has listed quantum-safe signatures as a separate item for some time.

For you as a holder, nothing follows from that beyond what applies to Bitcoin: a balance on an address that has never sent is better off. Anyone working through smart contracts does not have that choice anyway, because every interaction exposes keys. What matters is the perspective that no major chain currently signs in a quantum-safe way. That is not a distinguishing feature of Bitcoin and not an argument for switching between chains.

When will the cryptographically relevant quantum computer arrive?

Estimates diverge widely here, and the only serious approach is to show both sides. In its recommendations, the BSI works on the assumption that such machines may be available in the 2030s, and concludes that systems with a long service life have to be migrated today. NIST's standardisation planning points in the same direction with its reference years of 2030 and 2035.

Against that stand experts who point to the gap between laboratory records and the number of error-corrected computing units required: today's systems work with a few hundred to a few thousand physical qubits, while estimates for an attack on real key lengths run into the hundreds of thousands. On that view, the danger is a matter of decades, not years. What is striking is that both camps give the same practical recommendation: start early, because a rebuild of that size takes years and because data captured today can be decrypted later.

What you take away from this dispute is modest and robust: changing addresses costs you a transaction fee and makes sense regardless, because it also improves your privacy. Everything else is reading the future.

The "quantum upgrade" scam: how to spot the fraud

Every major security debate attracts fraudsters, and this one in particular, because it combines fear with technology. The pattern is always the same: an email, a direct message or a fake wallet alert tells you to "migrate your balance to quantum safety", and leads to a page that asks for the seed phrase or requests an approval for your tokens.

Three features expose that reliably. There is no quantum-safe Bitcoin address you could move into today, because the format has not been agreed. No genuine protocol upgrade ever asks you to enter your word list. And no wallet you own sends you deadlines by message. If you want to be sure, type in the address of your wallet's website yourself and, in case of doubt, check with the manufacturer. The clipboard scam works along similar lines, and we described it in our guide to the unnoticed address swap.

Bitcoin and the quantum computer: what to take away

1. Check your addresses before you do anything else. Read the address format, look for outgoing transactions in the block explorer, match the balance. Only where a balance sits on an exposed address today is there anything to do at all. How best to store your keys while doing so is shown in our hardware wallet comparison.
2. Stop reusing addresses. Move affected holdings to fresh addresses during a quiet fee phase, and let your wallet generate a new one for every incoming payment from now on. That lowers the quantum risk and improves your privacy along the way.
3. Ask your custodian for its roadmap. Anyone holding funds on an exchange cannot choose the addresses and should know how the provider is handling the switch. The key data for the major trading venues is in our overview of crypto exchanges.

(As of September 5, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)