Bitcoin and quantum computers: Which addresses have exposed their keys

The most important question for Bitcoin holders in the quantum computing debate

If you own your own Bitcoin, the most important question in the quantum computing debate is not about the future. It's the question you can answer today on the blockchain browser: Has your address ever exposed the public key? This single fact determines whether future quantum computers are likely to attack your assets. An address that has never sent a transaction does not display its public key; once you spend money from an address, the public key is permanently exposed.

The opportunity for this article is a paper that at first glance has nothing to do with cryptocurrencies. On September 3, 2026, the G7 Cybersecurity Working Group chaired by France issued a joint statement "Preparing for the Post-Quantum Era: A Call to Action." The core message is: Don't wait for the first capable quantum machine to appear, but immediately take stock of your own encryption status and start migrating. For you as a Bitcoin holder, this is not an abstract issue that only concerns government agencies. Europe's first milestone in switching to anti-quantum encryption will expire at the end of this year, and the issue of "which addresses have been exposed" is directly related to the security of asset custody.

This article will answer three questions: what is at risk on blockchain, how can you check your situation in minutes, and what deadlines are set by regulators. No price forecasts are provided or doomsday fears are spread.

G7 Requirements declared on September 3, 2026

G7 countries are urging public authorities and companies to immediately start moving towards anti-quantum cryptography. Post-quantum cryptography is a collective term for encryption and signature schemes that remain secure even in the presence of sufficiently powerful quantum computers. The document identifies five areas for action: raising awareness of quantum-related risks, developing national strategies, advancing research and practical adoption, strengthening cooperation between government and industry, and establishing quantum-resistant approaches in security requirements and procurement.

None of these points are directly aimed at retail investors. But the direction they guide remains relevant to you: Once banks, exchanges and wallet providers must rebuild their signature schemes, the way you protect your assets will change in the medium term. What is explicitly not mentioned in the statement will be discussed separately below. This honesty deserves recognition, as several recent articles have interpreted the document as a warning to the encryption industry.

Steal first, decryption later: Why migration starts before quantum computers emerge

The terms that appear in the original G7 statement explain the urgency: Harvest now, decrypt later describes an attack in which threat actors now capture and store encrypted data with the intention of using quantum computing capabilities to decrypt it in the future. "In these attacks, threat actors now collect encrypted data and intend to use quantum computing capabilities to decrypt it in the future," the statement stated.

For confidential communications, this is the core of the problem. But for public blockchains, the situation is different and trickier: There, no one needs to capture anything. From the date of creation, every transaction, every public key, and every signature are visible to everyone on the chain. Attackers do not need to collect data because the data already exists completely and all they lack is computing power.

How a quantum computer obtains a Bitcoin address

Bitcoin uses a key pair to secure the balance. The private key is the secret number you use to sign expenditures; the public key is the derived counterpart, which the network verifies the signature. It takes only a few seconds to derive the public key from the private key. In turn, due to the discrete logarithm problem based on elliptic curves, classical computers believe this is impossible in practice.

And this is the reverse path that quantum computers will take shortcuts. Shor algorithm is a quantum method that efficiently solves factorization and discrete logarithm problems, making today's common RSA and ECDSA signature schemes fragile. A cryptographically relevant quantum computer refers to a machine that is large enough and has a low enough error rate to run the method on the true key length. It is currently publicly known that no such machine exists.

The key lies in the second line of defense Bitcoin has had from the beginning: the classic Bitcoin address is not a public key, but its hash value. hash Is a one-way function that converts input into a fixed fingerprint from which the input cannot be recovered. As long as you only know the hash value, even a quantum computer has no object for Shor's algorithm to work. The public key will only become visible when you first spend money from that address, because your transaction will then provide the public key for verification.

Which Bitcoin addresses have exposed the public key

This leaves three categories, of which only the first two are interested in attacking dormant balances.

First, P2PK (Pay-to-public-key, payment to public key). This is the oldest output format of Bitcoin, with the public key placed directly in the script without a hash value in front of it. It was common in 2009 and 2010 and was mainly used for mining rewards, but is no longer used for new payments today. Anyone holding such coins has their keys permanently exposed, even though they have never spent anything.

Secondly, duplicate addresses. Every address that was sent at least once and still held a balance later exposed its key. This group is larger and the only group you can take direct action on. Address reuse refers to using the same receiving address multiple times, rather than generating a new address for each incoming payment.

Third, Taproot (paid to Taproot). The Taproot address, recognizable with the bc1p prefix, is directly put into the output because it is designed to be built on top of the public key. Taproot addresses therefore have the same attributes as P2PK, but account for a small proportion of all Bitcoin.

Not in the above list are the common formats P2PKH (prefix 1), P2SH (prefix 3), and P2WPKH (prefix bc1q), provided they have never had an outgoing transaction. For these formats, all you see on the chain is a hash value. If your balance is on such a brand new address and you have never sent funds from it, you are part of a group that cannot be reached by the Shor algorithm alone.

The first European milestone towards quantum security approaches will expire at the end of 2026

The 6.8 million bitcoins exposed on the key: Where the data came from

The most frequently cited estimate comes from Bitcoin company River, which is divided into two categories: About 1.72 million BTC are in P2PK output, and another 4.9 million BTC are in reused addresses in other formats. A total of about 6.8 million BTC are at risk of long-term front-end attacks. Other analyses yield slightly different numbers because of the way they treat no balances or trace amounts differently; but the order of magnitude, which accounts for about one-third of the supply in circulation, is stable across surveys.

A considerable portion of this was among the earliest mining rewards that had not been touched for 15 years, including positions attributed to Satoshi Nakamoto. No one can move these coins because no one moves the key. This is the fuel for the debate on whether the Internet should one day freeze such exports to prevent falling into the wrong hands. For the appearance of the proposal and the reasons for its controversy, see our August 12, 2026 analysis of the 6.7 million bitcoins that may freeze.

However, this number is secondary to your own situation. It doesn't tell you whether your coin is in it. You can check yourself, as follows.

Five-minute check: Is your address key exposed?

To check you only need to receive the address and a block browser. Block Explorer is a website that makes blockchain content searchable;mempool.space and blockstream.info are widely used. You don't enter any secret information there: the address is public, and your mnemonic words and private keys should never appear on a web form.

• Read the address format. Turn on the receive function of your wallet and check the beginning of the address. If it starts with bc1p, it is Taproot and the key is visible. If it starts with 1, 3, or bc1q, proceed to the next step.
• Find outbound transactions. Enter the address in your browser and browse the transaction list. If only incoming payments are displayed, the public key is not published. If even an outgoing transaction is discovered, it is permanently released and cannot be revoked.
• Match balance. What matters is whether the address has a balance today, not whether the address has been used. Exposed but empty addresses are not at risk.
• Don't forget old positions. Early paper wallets, long-retired wallet programs, or inherited storage media often contain the formats involved here.

People with many addresses usually use xpub (extended public key), from which they can derive all addresses of the account. Some browsers accept it and display the entire history at once. Please note that you have given your complete payment history to the website operator. They can't spend any money on it, but they can see everything.

Migrating to a fresh address: benefits and costs

As an owner, your only leverage is trivial and effective: move balances from exposed addresses to addresses that were never sent, and then use the new address for each incoming payment. Modern wallets do this automatically because they work as HD wallets, deterministically deriving all addresses from a single mnemonic and switching to the next after each payment.

There are three points worth looking at calmly. First: During the migration transaction, your public key is exposed in the mempool until the block is confirmed. Mempool is a transaction waiting area that has not yet entered a block. Changing addresses will not help an attacker who can crack a key within a window of several minutes; but even so, such machines are a problem for the entire network. Changing addresses is designed to prevent slow attacks on dormant balances, which is the reality.

Second, mobile requires network fees, and anyone who combines many small amounts of money has to pay for each input. When the network is busy, you can pay to wait for the calm period. Third, this is always an action you should document clearly: Moving between your own addresses does not change the owner, but new transactions will appear in your records. Write down which address belongs to you so you can track your trajectory later and ensure that attribution in tax filings does not break down; which tools take over this bookkeeping, see our comparison of cryptocurrency tax tools and the combination tracker .

If you're thinking about escrow: A device that never hands over a private key to a connected device, while not eliminating quantum risk, it reduces the risk you actually face today. See our Hardware Wallet Comparison for the performance of various models.

How does your mnemonic relate to quantum risk?

There is a misunderstanding here. Seed phrase is a sequence of words from which all keys are derived from your wallet. The sequence of words itself is not a signature scheme and is therefore not directly affected by the Shor algorithm. What is really at risk is the derived public keys once they are in the chain.

There is a second quantum method for hash functions,Grover algorithm , which accelerates data set searches at a quadratic speed. It halves the equivalent security level of the symmetric scheme, changing the 256 bits on paper to 128 bits. This will still be beyond any searchable scope for the foreseeable future. The same goes for mining: SHA-256 has not lost its value because of quantum computers; at best the attack has become a little faster, but the effort is still astronomical.

Therefore, you don't need to replace your 24 words. All you can change is which addresses hold your balance.

A corrupt signature scheme does not replace the positions of coins on the chain, but it does deprive them of protection

Coins on exchanges: Questions you can ask providers

If your position is located at a trading venue, you do not have access to the address. Exchanges manage their own wallets, usually with several large pooled addresses, long exposed due to their nature. In return, they have employees who can perform reconstruction immediately when the protocol provides quantum-resistant methods.

Two questions worth asking support are: Are there a published anti-quantum migration roadmap, and whether customer positions remain at addresses where keys have not yet been exposed? There are few answers at the moment, and the question itself is a usable selection criterion: a provider who knows nothing about its hosting technology is also explaining its own situation. If you are testing providers, see our overview of cryptocurrency exchanges for key regulatory data for major trading venues.

For most investors, this still holds true: Quantum risk is not the reason to change exchanges today. Access risks and bankruptcy risks are more immediate reasons that drive people to focus on self-custody.

Deadlines for popular interpretation: 2026, 2030 and 2035

Behind the G7 call are long-established dates. In the European Commission's road map for its transition to anti-quantum cryptography, it is stipulated that all member states should start switching before the end of 2026 . For critical infrastructure, the rule is: as early as possible, and at the latest before the end of 2030 . By 2035 , the transition should be completed as much as possible.

Technical standards run in parallel. The U.S. standards body NIST released the first three standards on August 13, 2024: FIPS 203 for key exchange, FIPS 204 as the main signature scheme, and FIPS 205 as a hash-based fallback scheme. In his transition paper, RSA and today's common curve cryptography are considered obsolete from 2030 and disabled from 2035. This sets a date when schemes that support Bitcoin signatures will no longer be allowed in government systems.

For Germany, The Federal Office for Information Security frames the reconstruction effort. BSI pointed out that "whether or when quantum computers exist is no longer the core issue" and recommended a gradual switch: "Quantum resistant methods should be used only in combination with classical methods as much as possible, i.e., hybrid models." Hybrid scheme Combine an existing method with a new method to remain safe even if one becomes weak.

These deadlines do not force you to do anything. But they set the pace at which banks, payment service providers and custodians work, and showed that authorities believe the window period is limited.

What the G7 statement explicitly does not mention

Here's one note because it is easily lost in reports: the G7 statement makes no mention of cryptocurrencies, blockchain or the financial sector at all. This document is addressed to general national agencies and companies. Anyone who translates this into a call to action by the crypto industry is imposing rhetoric.

The connection between the two is essentially indirect: both parties are based on the same mathematical foundation. If curve cryptography breaks down, it works equally for government certificates and Bitcoin signatures. The difference is how easy it is to change each solution. Public authorities can replace their software; open networks with millions of participants must first agree on what to replace.

BIP-360 and BIP-361: Bitcoin's own approach to signature problems

This protocol is already in progress in the form of improvement proposals. BIP (Bitcoin Improvement Proposal) is a formalized proposed change to the protocol, discussed in the public domain, and implemented only if it has broad support.

BIP-360 describes a new, self-defeating output format into which holders can voluntarily move coins in the future. The proposal will be added to the official warehouse in early 2026. BIP-361 takes this one step further and stipulates the orderly exit of old signature types. The consequence will be that after the transition period, coins exposed on the key will not be spent, effectively freezing them away from attackers.

This is what has sparked the most heated controversy in the Bitcoin world: on the one hand, theft involving millions of dollars undermines trust in the scarcity of money; on the other hand, the opposition is that networks capable of freezing balances violate their core commitments. The arguments of the two factions are detailed in our March 2026 Security Debate Assessment . As of now, neither proposal has been adopted.

Ethereum and other chains: Why migration methods are different

On Ethereum, the same problem appears in different forms. The account address is also derived from the public key, which is visible when first sent. However, unlike Bitcoin, where the rules can be changed through planned network upgrades at shorter intervals, the Ethereum Foundation's agenda has included anti-quantum signatures as a separate item for some time.

For you as a holder, there is no subsequent impact other than the principles that apply to Bitcoin: the balance at an address that has never been sent is safer. Anyone using a smart contract has no option, because every interaction exposes the key. Importantly, there are currently no major chains signed in a quantum-resistant manner. This is not a unique feature of Bitcoin or a reason to switch between different chains.

When will cryptography-related quantum computers come?

Estimates here are widely divided, and the only serious way is to present both sides 'views. In BSI's recommendations, it assumed that such machines might be available in the 2030s and concluded that long-life systems must be migrated today. NIST's standards plan points in the same direction with its reference years of 2030 and 2035.

In contrast, experts who pointed out the gap between laboratory records and the number of error-correcting computing units required: Today's systems use hundreds to thousands of physical qubits, while attacks on true key lengths are estimated to require hundreds of thousands. In this view, the danger is a matter of decades, not years. Remarkably, both sides gave the same practical advice: start as early as possible, because a rebuild of this scale takes years, and the data captured today can be decrypted in the future.

Moderate and sound lessons learned from this controversy

Changing your address requires you to pay a transaction fee, which makes sense for whatever reason because it also improves your privacy. The rest is an over-interpretation of the future.

"Quantum upgrade" scam: How to detect fraud

Every major security debate attracts scammers, and this time is no exception because of its combination of fear and technology. The pattern is always the same: an email, private message, or a fake wallet alert tells you to "migrate your balance to quantum security" and leads to a page that asks for mnemonics or requests approval of your token.

There are three characteristics that can reliably reveal this. There are no quantum-resistant Bitcoin addresses you can move into today because the format has not yet been agreed upon. Any real protocol upgrade will never require you to enter a list of words. And no wallet you own will pass the message delivery deadline. If you want to be sure, please manually enter the address of the wallet website, and if you have any questions, please check with the manufacturer. The clipboard scam works in a similar way, and we describe it in the silent address swap guide.

Bitcoin and quantum computers: takeaway

• Check your address before doing anything else. Read the address format, look for outgoing transactions in the block browser, and match the balance. There is only something to do if there is a balance at the exposed address today. See our Hardware Wallet Comparison for how to best store keys during this process.
• Stop reusing addresses. Move affected positions to fresh addresses during the period when fees calm down and have your wallet generate a new address for each incoming payment from now on. This reduces quantum risk while also improving your privacy.
• Ask your custodian for the roadmap. Anyone holding funds on an exchange cannot choose an address and should understand how the provider handles switching. Key data for major trading venues can be found in our overview of Cryptocurrency Exchange .

(As of September 5, 2026. This article does not constitute investment advice. Price and fee structures are subject to change; please check terms with your provider before purchasing.)