Bitcoin Public Key Exposure and Risks

Key Takeaways:

• Bitcoin uses ECDSA over secp256k1, and the public key stays hidden only until the coin is spent. Address reuse and legacy pay-to-public-key outputs expose it permanently.
• Glassnode’s May 2026 analysis put 6.04 million BTC, or 30.2% of supply, in addresses whose public keys are visible at rest, split into 1.92 million BTC structural and 4.12 million BTC operational exposure.
• Google Quantum AI’s March 2026 whitepaper cut the ECDLP-256 estimate to under 1,200 logical qubits and 90 million Toffoli gates, runnable on fewer than 500,000 physical qubits.
• AI coding agents cut the resource score for the secp256k1 point-addition subroutine by 86.1% in the ECDSA.Fail challenge, a software optimization that shortens the migration window without breaking anything today.
• No quantum computer can derive a Bitcoin private key in 2026. The actionable risk is exposure: generate fresh addresses, avoid reuse, and track BIP-360 and SHRINCS.

Bitcoin Uses ECDSA over secp256k1

Bitcoin uses ECDSA over secp256k1 to authorize every transaction: whoever knows the private scalar can sign. Deriving that scalar from the public point is the elliptic curve discrete logarithm problem (ECDLP), and every asset secured this way inherits the same assumption. As of September 2026, no quantum computer can solve it. The cost of trying keeps falling.

Exposure is not uniform across address types. Bitcoin is a hash-first design: funds sit at an address that is a hash of the public key, and the key stays hidden until the coin is spent. A fresh, unspent pay-to-witness-public-key-hash address shows only a HASH160 output, keeping the elliptic curve point off-chain. The address is derived by hashing the public key with SHA-256 then RIPEMD-160, so an observer sees a 20-byte commitment, not the key.

That protection ends the moment the coin moves. Spending reveals the public key so the network can verify the signature, and the key stays on the ledger permanently. This is the structural difference between Bitcoin and enterprise systems, where a public key sits behind a certificate or handshake and can be retired. On a blockchain, a key that has authorized one transaction is public forever.

Where On-Chain Public Key Exposure Comes From

Three patterns produce on-chain public key exposure, with very different fixes. Legacy pay-to-public-key outputs embedded the key directly in the output script at creation, so it was never hidden. Taproot key-path spends reveal a tweaked public key at spend time. Address reuse is the largest bucket by value and the one most under user control.

Glassnode’s May 2026 analysis put 6.04 million BTC, or 30.2% of issued supply, in addresses whose public keys are visible at rest. Structural exposure from older script types accounted for 1.92 million BTC; operational exposure tied to address reuse and custody practices was larger at 4.12 million BTC. Crypto exchanges were the biggest single cohort in the operational bucket, and Binance held 85% of its labeled Bitcoin balances in addresses where the public key was already visible.

The distinction matters for remediation. Funds in reused addresses are recoverable if the owner still holds the private key: they can move the coins to a fresh, unused address and remove the exposure. Funds in legacy pay-to-public-key outputs carry the same option. What cannot be fixed by user action is the on-spend race window, where a key becomes public only when the transaction is broadcast and a sufficiently fast attacker could theoretically derive the private key before confirmation. (Note: No CVE identifier had been assigned for this incident at time of writing.)

Exchange users do not control the largest exposure cohort, which complicates the usual advice. A withdrawal to a reused deposit address repeats the same leak on someone else’s architecture, and the custodian decides whether that address is fresh. Address hygiene is therefore partly a counterparty question rather than a purely personal one.

Shor’s Algorithm and the Falling Cost of ECDLP-256

Shor’s algorithm is the quantum method that solves ECDLP efficiently. The practical question is how many qubits and gates the full 256-bit attack needs, and every 2026 estimate revised that number downward.

Google Quantum AI’s March 2026 whitepaper compiled two circuits implementing Shor’s algorithm for ECDLP-256: one using fewer than 1,200 logical qubits and 90 million Toffoli gates, another using fewer than 1,450 logical qubits and 70 million Toffoli gates. On a superconducting machine, Google estimated these run in minutes on fewer than 500,000 physical qubits, a roughly 20-fold reduction from earlier estimates. The company disclosed the result through a zero-knowledge proof so the underlying circuits could be verified without handing attackers a roadmap.

Hardware vendors converge on similar counts. IonQ published an end-to-end blueprint at roughly 1,457 logical qubits and 39 million Toffoli gates, about 19,397 physical trapped-ion qubits, with an execution time near 25.7 days. Other work pushed lower: Caltech and Oratomic estimated a viable attack could need as few as 10,000 physical qubits in a neutral-atom architecture. Physical numbers get quoted more than they deserve, because logical qubits, gate counts, and physical qubits are not interchangeable and depend on error rates that vary by hardware.

Practical demonstrations are still tiny. Project Eleven awarded its one-Bitcoin Q-Day Prize to Giancarlo Lelli, an independent researcher who derived a private key from its public counterpart across a 32,767-element search space using a variant of Shor’s algorithm, a 512-fold increase over the six-bit demonstration from September 2025. Fifteen bits is not close to 256, but it was done on cloud-accessible hardware by someone with no national lab behind them. The distance from 15 bits to 256 bits is large and increasingly treated as an engineering problem rather than a physics problem.

AI-Optimized Circuits and Harvest Now, Decrypt Later

The AI-helped classical factoring story from Part 1 of this series concerned RSA. The Bitcoin equivalent is circuit optimization. In a challenge called ECDSA.Fail, more than 100 researchers using AI coding agents cut the resource score for the secp256k1 point-addition subroutine by 86.1%, from 10.75 billion to 1.496 billion. The winning design used 1,151 logical qubits and about 1.3 million Toffoli gates, and one later design needed only 813 qubits.

This was a software optimization only. It did not recover a private key, and it does not by itself bring Q-Day closer. The effect is on the migration window: cheaper circuits mean the eventual hardware is less expensive to use, giving Bitcoin and other blockchains less time to move to post-quantum cryptography.

Harvest now, decrypt later is the quieter risk, and it applies differently to Bitcoin than to session traffic. A fault-tolerant machine could derive a private key from a public key that has been sitting on-chain for years, so any coin with an exposed key is already vulnerable in the sense that matters: the attacker needs only to wait for the hardware. The same logic applies to keys that become public at spend time, where a fast enough machine could compute the private key from the mempool before confirmation. That on-spend race is the gap BIP-360 does not close.

Generating Fresh Addresses and Post-Quantum Proposals

The mitigation that works today is generating a new address for each transaction, which keeps the public key hidden until the coin moves and limits how long any exposed key sits in the open. Wallet software has supported this for years, and the discipline is the cheapest available defense. For long-term holdings, minimizing address reuse is the difference between a key that stays hash-locked and one that is visible to a future attacker.

Protocol-level fixes are moving but not finished. BIP-360 introduces Pay-to-Merkle-Root (P2MR), a new output type that removes Taproot’s key-path spending option so no public key appears on-chain at creation time. It protects coins whose keys would otherwise be visible for a long period, but it does not address the on-spend race window and does not move existing coins automatically. A separate proposal, BIP-361, would freeze quantum-vulnerable addresses and has drawn community resistance over the roughly 1.7 million BTC in about 20,000 early pay-to-public-key outputs that Coinbase’s Independent Advisory Board attributed to Satoshi-era or lost wallets.

The signature layer is the harder problem. SHRINCS, a hash-based post-quantum scheme from Blockstream, published its BIP in August 2026 after signing real transactions on the Liquid sidechain. Its signatures run from 548 bytes (plus a 48-byte public key) up to 4,619 bytes, about nine times larger than Schnorr’s 64 bytes. Blockstream’s estimates show the throughput cost: full use of NIST’s lattice-based ML-DSA would drop Bitcoin to roughly 0.5 transactions per second and hash-based SPHINCS+ to 0.36, while SHRINCS would hold near 3 TPS. The BIP itself warns that its security proof is not yet complete and that the stateful key handling adds wallet-side failure modes.

Regulators have started treating the timeline as near-term. The Joint Committee of the European Supervisory Authorities added quantum computing to its autumn 2026 risk assessment, noting that cryptography protecting transactions and distributed ledgers could weaken before quantum computing reaches mass adoption. The European Union’s roadmap asks member states to begin post-quantum migration by the end of 2026, with critical infrastructure complete by 2030, and Google has set a 2029 internal deadline for its own systems.

An Audit Checklist for Bitcoin Holders and Custodians

• Generate a fresh address for every transaction and never publish a deposit address for reuse. This keeps the public key hash-locked until spend and is the single highest-value action.
• Inventory funds in pay-to-public-key outputs and Taproot key-path addresses, which expose the public key by design, and treat them as priority migration candidates.
• Classify holdings by how long the public key has been visible. A key exposed for years is already in the harvest-now, attack-later set.
• Verify how your exchange or custodian manages addresses. Glassnode’s data shows exchange wallets dominate operational exposure, so custody hygiene is partly a counterparty question.
• Track BIP-360 for P2MR support in wallet software, and treat BIP-361’s freeze proposal as an unresolved governance question, not a settled plan.
• Follow SHRINCS and ML-DSA signature proposals, but do not assume they are ready. The SHRINCS security proof is not complete, and the throughput cost of larger signatures is unresolved.
• Watch the resource estimates rather than the headline. Each 2026 revision dropped the qubit or gate count for ECDLP-256, which shortens the safe migration window.

Part 3 shifts from Bitcoin to Ethereum, where account abstraction, Layer 2 rollups, and the network’s own post-quantum roadmap shape a different migration problem.

Related Reading

More in-depth coverage from this blog on closely related topics:

• SSH Key Management Strategies for Security
• Post-Quantum Security for Blockchain Systems

Sources and References

Sources cited while researching and writing this article:

• Safeguarding cryptocurrency by disclosing quantum vulnerabilities …
• IonQ published
• A quantum computer may need just 10,000 qubits to empty your crypto wallets, researchers say
• ECDSA.Fail, more than 100 researchers using AI coding agents
• SHRINCS BIP published: Quantum-secure Bitcoin comes with a catch