How many bitcoin are actually quantum vulnerable right now

Updated August 6, 2026

Most coverage of the "5.4 million bitcoin are quantum vulnerable" figure treats it as one pile of at-risk coins, which flattens something that actually matters. A large share of that number sits in wallets people still use normally. A smaller, much-discussed slice hasn't moved since around 2010 and, by any ordinary account, never will again, at least not by the person who mined it. Calling that slice "vulnerable" anyway isn't loose language. A working quantum computer wouldn't need anyone's cooperation to move coins their original owner can no longer reach, which is stranger and arguably bigger than the "safe because it's already lost" framing you'll see repeated.

What the 5.4 million actually is

The figure comes from adding up every bitcoin sitting in an address whose public key is already visible on-chain, rather than hidden behind a hash. That's roughly 25 percent of the 21 million coins that will ever exist, a real, checkable measurement, not a guess. But it bundles together at least three situations that behave differently:

• Ordinary spent-from addresses. P2PKH ("1..."), P2SH ("3..."), and SegWit v0 ("bc1q...") addresses only reveal their public key at the moment they spend, since a valid signature has to include it. Anyone who has ever sent bitcoin from one of these addresses, even once, has exposed the key for good. This is the biggest, least dramatic slice: normal use, not carelessness.
• Taproot addresses that have received funds. P2TR ("bc1p...") addresses, live since Taproot activated in November 2021, commit to the actual public key directly in the address, so the key is visible the instant funds arrive, spent or not.
• Satoshi-era coins. An estimated 1.1 million BTC tied to Satoshi Nakamoto's early mining sits in early-format, exposed outputs, dormant since roughly 2010.

Inside all of that, an unknown fraction is also simply lost: keys destroyed, hardware discarded, seed phrases forgotten by owners who are still alive and just can't get back in. There's no reliable public number for how much of the 5.4 million falls into that bucket, so treating any precise split as fact would be dishonest. "Publicly exposed" and "permanently lost" are two separate questions, and a coin can be both at once.

The rule sorting coins into the exposed category is simple enough to check yourself with our wallet checker, which applies this logic to a real address:

Why the dormant coins are the odd case, not the safe case

The 1.1 million BTC associated with Satoshi's early mining gets treated in casual conversation as basically theoretical, coins nobody will ever touch again, so why worry. That reasoning quietly swaps two different actors. The original holder can't move those coins today, seed lost to time either way. But the public key sitting in those outputs doesn't care who holds the matching private key. If a quantum computer ever became capable of running Shor's algorithm against secp256k1 fast enough, it could derive the private key from that exposed one and move the coins, with no cooperation from, or awareness by, whoever mined them. That's roughly 110 trillion sats, in the units our sats converter works in, moving to an attacker rather than sitting untouched forever. Dormant isn't inert.

What the other 75 percent actually buys you

The roughly 15.6 million BTC not in the exposed category sit in addresses that have never spent, so only a hash of the public key is visible on-chain, not the key itself. Reversing a hash is a different problem than the discrete logarithm problem Shor's algorithm solves, and it's the kind of problem where Grover's algorithm gives a quantum computer a real but much smaller advantage, generally answered by a larger hash output rather than a redesign. That's the honest reason this majority is harder to attack today.

It's not permanently safe, though. The moment any of those coins move, the transaction has to include the public key to verify the signature, briefly exposing it in the window between broadcast and confirmation. A sufficiently capable quantum computer could try to win that race, rather than breaking in at leisure on a key exposed for years. That's narrower and harder than the cases above, but not automatically zero, and it won't become fully moot until a broad share of the network actually uses quantum-resistant signatures.

None of this is close on today's hardware. No quantum computer that exists now, or is credibly expected within the next few years, can run Shor's algorithm against secp256k1 fast enough to threaten a real address, and serious timeline estimates still range from several years to a decade or more. For the fuller picture on what shifted in the conversation this year, see our explainer on whether bitcoin is safe from quantum computers.

The proposals, and the argument sitting next to them

BIP-360 and BIP-361 are draft proposals, still evolving, aimed at giving bitcoin a quantum-resistant address format and a migration path for old coins. Nothing about them is settled protocol yet, and specifics are likely to change before, or if, either gets adopted. Bitcoin hasn't committed to a specific scheme, though the industry reference point is the set of post-quantum standards, ML-KEM, ML-DSA, and the hash-based SLH-DSA, that NIST finalized in 2024.

The contentious part of the wider debate isn't the cryptography. It's a proposal, floated in that same conversation, to eventually restrict spending from long-dormant, exposed addresses (the Satoshi-era coins being the obvious example) if they aren't migrated within some window. That runs straight into bitcoin's norm that no one decides whose coins are allowed to move. My guess is that argument outlasts the cryptographic one by years.

The 5.4 million BTC figure describes exposure, not urgency: the timeline for a capable quantum computer remains uncertain, and the near-term attack surface stays narrow either way. Which category any individual holding falls into is a matter of on-chain fact, checkable directly rather than assumed.