How many bitcoin sit in open boxes

Updated September 2026

Most coverage of how many bitcoin are "quantum vulnerable" treats the number as one pile of at-risk coins, which flattens something that actually matters. A large share of that number sits in wallets people still use normally. A smaller, much-discussed slice hasn't moved since around 2010 and, by any ordinary account, never will again, at least not by the person who mined it. Calling that slice "vulnerable" anyway isn't loose language. A working quantum computer wouldn't need anyone's cooperation to move coins their original owner can no longer reach, which is stranger and arguably bigger than the "safe because it's already lost" framing you'll see repeated.

What the count actually is

Each count adds up the bitcoin sitting in outputs whose public key, or in some counts whose spending script, is already visible on-chain rather than hidden behind a hash. The chain is public, so anyone can count, but the answer depends on the counting rules, and the published counts disagree:

• Glassnode, May 20, 2026: 6.04 million BTC, 30.2 percent of the supply issued so far, of which 1.92 million comes from output types that show the key (P2PK, bare multisig and Taproot) and 4.12 million from reuse and custody habits.
• BIP-361, a draft proposal: over 34 percent of all bitcoin as of March 1, 2026, a figure the BIP states without a source.
• Project Eleven, September 14, 2026: its Bitcoin Risq List counts 8,177,337 BTC at block 966,848, about 41 percent of the roughly 20.08 million mined by then. About 6.19 million of that sits in addresses that have spent before and still hold coins, about 1.72 million in P2PK outputs and about 273,000 in Taproot.

Part of the spread is timing: near Glassnode's date, on May 25, 2026, Project Eleven counted about 6.92 million BTC, so most of the gap to its September figure is growth in its own count. The rest comes from definitions: whether an address that has spent and still holds coins counts now or only at its next spend, whether Taproot counts, and how to treat a P2SH or P2WSH address whose script a spend has revealed. Neither Glassnode nor Project Eleven counts the brief exposure of a spend waiting in the mempool, and Project Eleven leaves out keys leaked off the chain. The draft that sets out exposure levels for every output walks through those choices. Project Eleven's own count has risen by about 1.1 million BTC since mid-July 2026, almost all of it in spent-from addresses, and it has not published a reason.

Earlier versions of this page gave 5.4 million BTC, about a quarter of the 21 million cap. We could not trace that figure to a source, and the sourced 2026 counts above are all higher, so it has been replaced. Whichever count you use, it bundles together at least three situations that behave differently:

• Ordinary spent-from addresses. P2PKH ("1..."), P2SH ("3..."), and SegWit v0 ("bc1q...") addresses only reveal their public key at the moment they spend, since the spend has to include it alongside the signature. Anyone who has ever sent bitcoin from one of these addresses, even once, has exposed the key for good. This is the biggest, least dramatic slice: normal use, not carelessness.
• Taproot addresses that have received funds. P2TR ("bc1p...") addresses, live since Taproot activated in November 2021, commit to the actual public key directly in the address, so the key is visible the instant funds arrive, spent or not.
• Satoshi-era coins. An estimated 1.1 million BTC tied to Satoshi Nakamoto's early mining, the top of the 600,000 to 1.1 million range that Chaincode Labs' 2025 report cites, sits in early-format, exposed outputs, dormant since roughly 2010.

Inside all of that, an unknown fraction is also simply lost: keys destroyed, hardware discarded, seed phrases forgotten by owners who are still alive and just can't get back in. There's no reliable public number for how much of the exposed supply falls into that bucket, so treating any precise split as fact would be dishonest. "Publicly exposed" and "permanently lost" are two separate questions, and a coin can be both at once.

The rule sorting coins into the exposed category is simple enough to check yourself with our wallet checker, which applies this logic to a real address:

Why the dormant coins are the odd case, not the safe case

The 1.1 million BTC associated with Satoshi's early mining gets treated in casual conversation as basically theoretical, coins nobody will ever touch again, so why worry. That reasoning quietly swaps two different actors. The original holder can't move those coins today, seed lost to time either way. But the public key sitting in those outputs doesn't care who holds the matching private key. If a quantum computer ever became capable of running Shor's algorithm against secp256k1 fast enough, it could derive the private key from that exposed one and move the coins, with no cooperation from, or awareness by, whoever mined them. That's roughly 110 trillion sats moving to an attacker rather than sitting untouched forever. Dormant isn't inert.

What the closed majority actually buys you

The rest of the mined supply, roughly 12 to 14 million BTC depending on the count, sits in addresses that have never spent, so only a hash of the public key is visible on-chain, not the key itself. Reversing a hash is a different problem than the discrete logarithm problem Shor's algorithm solves, and it's the kind of problem where Grover's algorithm gives a quantum computer a real but much smaller advantage, generally answered by a larger hash output rather than a redesign. That's the honest reason this majority is harder to attack today.

It's not permanently safe, though. The moment any of those coins move, the transaction has to include the public key to verify the signature, briefly exposing it in the window between broadcast and confirmation. A sufficiently capable quantum computer could try to win that race, rather than breaking in at leisure on a key exposed for years. That's narrower and harder than the cases above, but not automatically zero, and it won't become fully moot until a broad share of the network actually uses quantum-resistant signatures.

None of this is close on today's hardware. No quantum computer that exists now, or is credibly expected within the next few years, can run Shor's algorithm against secp256k1 fast enough to threaten a real address, and serious timeline estimates still range from several years to a decade or more. For the fuller picture on what shifted in the conversation this year, see our explainer on whether bitcoin is safe from quantum computers.

The proposals, and the argument sitting next to them

BIP-360 and BIP-361 are draft proposals, still evolving, aimed at giving bitcoin a quantum-resistant address format and a migration path for old coins. Nothing about them is settled protocol yet, and specifics are likely to change before, or if, either gets adopted. Bitcoin hasn't committed to a specific scheme, though the industry reference point is the set of post-quantum standards, ML-KEM, ML-DSA, and the hash-based SLH-DSA, that NIST finalized in 2024.

The contentious part of the wider debate isn't the cryptography. It's a proposal, floated in that same conversation, to eventually restrict spending from long-dormant, exposed addresses (the Satoshi-era coins being the obvious example) if they aren't migrated within some window. That runs straight into bitcoin's norm that no one decides whose coins are allowed to move. My guess is that argument outlasts the cryptographic one by years.

The exposed-supply figure, whichever count you use, describes exposure, not urgency: the timeline for a capable quantum computer remains uncertain, and the near-term attack surface stays narrow either way. Which category any individual holding falls into is a matter of on-chain fact, checkable directly rather than assumed.