Roughly 6.04 million Bitcoin (BTC), or 30.2% of issued supply, sit in addresses where public keys are already visible on-chain.
Glassnode Maps 30% Quantum Exposure
On-chain analytics firm Glassnode published the figures on May 20 in a report mapping which Bitcoin holdings could face future quantum computing risk.
The methodology hinges on a single test.
A coin is classified as exposed at rest when the public key needed to spend it has already appeared on the blockchain.
Glassnode split the 6.04 million coins into two buckets. Structural exposure, tied to script types that reveal the key by design, covers 1.92 million BTC.
Operational exposure, driven by address reuse and partial spending, accounts for 4.12 million BTC. That second figure is 2.1 times larger than the structural bucket, and points to behavior rather than protocol design.
The remaining 13.99 million BTC, around 69.8% of issued supply, shows no public-key exposure under the firm's framework.
Also Read: Twenty One Capital Becomes Tether's Bitcoin Arm As SoftBank Walks Away
Exchange Wallets Concentrate The Risk
Exchange-held coins represent the largest labeled subset inside the operational bucket, with about 1.66 million BTC, or 8.3% of total supply. That accounts for roughly 40% of all operationally exposed Bitcoin.
Glassnode noted that close to half of labeled exchange balances fall into the susceptible category, against less than 30% for non-exchange supply.
Entity-level differences are wide. Coinbase balances show only 5% exposure, while Binance sits at 85% and Bitfinex reaches 100% under the same methodology.
Among other holders, Fidelity and CashApp register near 2%, Grayscale around 50%, and both Robinhood and WisdomTree at 100%. Sovereign treasuries in the US, the UK, and El Salvador show 0% exposure.
Why Address Hygiene Now Matters
Researchers framed the report as a baseline measurement rather than a forecast. The firm took no position on when, or whether, a Cryptographically Relevant Quantum Computer capable of running Shor's algorithm will arrive.
The practical takeaway sits with custodians. Address rotation, reduced key reuse, and migration planning are the levers that can pull operational exposure lower without protocol-level changes.
Bitcoin's quantum debate has surfaced repeatedly through 2026. Google Quantum AI released a related paper on elliptic-curve cryptocurrency security in Mar., and BIP-360 has proposed a Pay-to-Merkle-Root output type as a voluntary migration path for affected holders.
Read Next: Security Experts Pour Cold Water On Claude Mythos Hacking Apocalypse