30% of Bitcoin faces quantum risks, where do they come from?

Author | Rafael Schultze-Kraft

Compiled by | Chopper, Foresight News

Recent industry research has focused on a new type of security risk for Bitcoin: under the current holding status, which Bitcoins are currently facing quantum risks? The core criterion for determination is whether the public key for transferring out tokens has been publicly disclosed on the blockchain. According to statistics, there are currently 6.04 million Bitcoins at risk of quantum threats, accounting for 30.2% of the total issuance; the remaining 13.99 million Bitcoins (69.8%) have not disclosed their public keys during the holding phase and currently pose no related risks. These data are generally consistent with some recent research conclusions.

We categorize this risk into two types. The first type is structural risk: the script type itself leaks the public key output. The second type is operational risk: certain cryptocurrencies may initially be protected, but due to reasons such as address reuse, partial spending, or custodial actions, the public key has been leaked while Bitcoins remain in that address.

Distribution map of Bitcoins at risk of quantum threats provided by Quantum Safety

There are 1.92 million Bitcoins classified as structural risk, accounting for 9.6% of the total issuance; there are 4.12 million Bitcoins at operational risk, accounting for 20.6%, of which 1.63 million are held by exchanges, indicating that proper wallet usage and asset custody methods are crucial for reducing public key leakage risks.

This article does not make any stance judgments, nor does it predict when practical quantum attacks will occur, or evaluate the security and solvency of any custodial institutions. It merely quantifies the current state of public key leakage across the network from a data perspective, distinguishing between permanently high-risk assets and those that can reduce risks through optimized wallet management and custody rules.

Understanding Public Key Leakage Risks

Bitcoin assets are controlled by private keys, while public keys are used for network verification of the legitimacy of private key signatures. Under traditional cryptographic systems, it is impossible to reverse-engineer the private key solely from the public key, making the assets sufficiently secure.

The core threat of quantum computers lies in their ability to utilize Shor's algorithm to derive the corresponding private key from a known public key. Thus, the relevant on-chain issues become straightforward:

If the public key is disclosed, then that cryptocurrency is exposed. Attackers do not need to wait for the owner to transfer the cryptocurrency because the public key is already available. If the public key is not visible on-chain, then according to this specific static storage model, that cryptocurrency is currently not exposed.

This article focuses on the asset risks under the holding status, that is, tokens that are idle but have associated public keys that have been leaked. This is different from exposure during transfers: the latter only publicly discloses the public key during transaction broadcasting and confirmation, which is a time-sensitive risk at the transaction settlement level; the former is a quantifiable stock risk asset. The term "secure assets" referred to in this article only represents those that have not leaked their public keys during the holding phase and does not imply absolute quantum resistance against all future quantum attack models.

Distribution map of quantum-safe Bitcoins provided by Quantum Safety

Structural Exposure: Inherent Security Risks

The risk of these assets is determined by the address script format and is unrelated to whether users use wallets correctly; they are destined to expose public keys on-chain. This includes early P2PK addresses from the Satoshi Nakamoto era, traditional multi-signature P2MS addresses, and the currently mainstream Taproot addresses. These addresses were created in different eras and usage scenarios, but they share a commonality: they default to publicly disclosing public keys or equivalent public key information on-chain. As long as the tokens are not spent, they may become targets for attacks.

We currently classify 1.92 million Bitcoins (accounting for 9.6% of the total issued amount) as belonging to the structural risk category. This portion of Bitcoins can be further divided into three different parts:

Distribution of structural risks in Bitcoin

Satoshi Nakamoto and early block tokens: These are permanently structural risk assets; if the assets are lost or the holders become inactive, they can hardly be migrated to a secure address unless there is a consensus across the network to initiate protocol-level rectification, otherwise they will remain permanently exposed to quantum risks.

Taproot addresses: This script itself has advantages such as strong privacy, efficient transfers, and flexible smart contracts, and is not a design flaw. However, from the perspective of public key leakage, Taproot addresses will directly disclose keys, posing holding quantum risks.

The BIP-360 protocol P2MR proposal put forward in the industry can retain Taproot functionality while eliminating high-risk key paths to mitigate such hazards, but it cannot automatically migrate existing Taproot assets and is not a complete ultimate quantum-resistant solution.

In short, among the 1.92 million structural risk assets, some are difficult to migrate, while others can gradually optimize risk avoidance through new protocols and standards.

Operational Exposure: Usage Habits Leading to Security Vulnerabilities

These addresses inherently possess privacy protection capabilities and do not initially disclose public keys. However, due to improper user operations, the public key is exposed during the transfer process, causing the remaining assets to lose their protection.

This is the issue of address reuse. Output types such as 2PKH, P2SH, P2WPKH, and P2WSH can hide public keys through hash values while the tokens are in a static state. However, once the public key is leaked during consumption, any balance or future balance associated with that public key will lose this protection.

Operational exposure is the main source of current Bitcoin quantum risks, totaling 4.12 million, which is 2.1 times the scale of structural risk assets. This also confirms that the vast majority of current Bitcoin quantum risks are not due to early script design legacy issues, but rather due to improper user key management and address usage.

Among operational risk assets, Bitcoins held by exchanges account for a very high proportion, totaling 1.66 million, which occupies 40% of all operational risk Bitcoin balances. Data shows that the risk of exchange assets varies greatly: among the Bitcoins held by marked exchanges, about half are vulnerable, while for Bitcoins not held by exchanges, this proportion is less than 30%.

Distribution of operational risk Bitcoin supply

The exposure situation of major mainstream institutions varies significantly. Some custodial institutions have relatively low risks, while others hold a larger proportion of balances in addresses where public keys are known.

Low risk: Coinbase has only 5% of custodial assets exposed to public key leakage; the quantum risk exposure ratio for national treasuries (United States, United Kingdom, El Salvador) is 0%.

Medium risk: Fidelity and CashApp are about 2%, while Grayscale is about 50%.

High risk: Binance 85%, Bitfinex 100%, and Robinhood and WisdomTree have all custodial assets exposed to public key leakage risks.

Note: This data only reflects on-chain asset custody retention traces and does not constitute an institutional risk rating or solvency assessment basis.

From a long-term trend perspective, governments maintain a security holding ratio of over 99% year-round; however, exchanges, due to frequent capital flows and complex wallet structures, have seen their proportion of secure assets decline from 55% in 2018 to 45% today. However, these risks can be completely improved; simply adhering to basic norms such as not reusing addresses and timely transferring change assets can quickly reduce the scale of exposure.

Distribution of operationally secure Bitcoin supply classified by entity type

Conclusion

Bitcoin's quantum risks can be categorized into different types, each with varying impacts.

Structural risk: The difficulty of migrating early legacy tokens is extremely high, and new protocols like P2MR can gradually optimize the risks of modern Taproot addresses;

Operational risk: This is larger in scale and more controllable, with massive stock assets held by exchanges that have the conditions for large-scale risk migration.

Thus, it is evident that the quantum security layout of Bitcoin does not solely rely on upgrades to underlying network protocols; a large number of existing risk assets in the market can effectively reduce risks through current operational adjustments. For exchanges and professional custodial institutions, standardizing address usage, optimizing reserve asset layouts, reducing key reuse, and formulating asset migration plans are not distant fantasies but practical measures that can be implemented now to effectively reduce quantum risks.