How much Bitcoin is exposed to a quantum attacker?

Where does the exposed value sit?

Every bucket is published separately with both count and value, including the ones that make the headline look small. One blended line would hide the fact that 92% of the exposed value is Satoshi-era P2PK.

Count and value tell opposite stories on purpose: Taproot is a third of all outputs but under 1% of exposed value; P2PK is a rounding error by count and 92% of exposed value.

How much of it has not moved in years?

Exposure and dormancy are different axes and we never add them. This grid answers the honest question: of the exposed value, how much sits in outputs that have not moved since each cutoff?

Dormancy here means the unspent output itself was created before the cutoff block and has never been spent. Age is measured in blocks (52,560 per year).

The dormant-P2PK movement watch

91.8% of all structurally exposed value is Satoshi-era uncompressed P2PK. We watch that exact set of outpoints every day and publish the set itself, so the claim is auditable.

Reference measurement: 34,199 outpoints holding 1,714,163 BTC at block 882,508 (2025-02-06, first-party). The difference between that measurement and today's count IS the realized movement rate over the period, published here before any alert can fire. A watched output leaving the set is a data point against this baseline, not an alarm.

No watched outpoint has left the set since daily recording began.

Why do published numbers range from 1.9M to 10M BTC?

Because they answer different questions. Instead of publishing an eleventh estimate, this table referees the existing ones: definition, date, unit and whether the figure is an independent measurement or a derivative of another row.

Our 1.87M and Glassnode's 1.92M measure the same structural definition 13 months apart on different snapshots; the gap is time and method detail, not disagreement. The 6-7M family adds address-reuse exposure, a different and softer definition that cannot be computed from a UTXO snapshot at all.

Methodology · published in full

The measurement is a pure function of our own node's UTXO snapshot (Bitcoin Core dumptxoutset, format v2). No third-party API touches the number. The classifier is open about every rule it applies, because the product is the reproducibility.

An output is exposed at rest if and only if its scriptPubKey contains an elliptic-curve point rather than a hash digest. Hash-locked families (P2PKH, P2SH, P2WPKH, P2WSH) reveal their key only when spent; that reuse axis is a different measurement and is not included here.

Some coverage states that Taproot hides the public key until spend; this is incorrect. The output key is on-chain by construction, consensus verifies a Schnorr signature against it directly, and a provably-unspendable internal key changes nothing about that. All three serious published methodologies (Glassnode, Google Quantum AI, Project Eleven) count P2TR as structurally exposed, and so do we.

Quantum hardware context, for scale rather than countdown: the authoritative resource estimate for secp256k1 is Babbush et al., arXiv 2603.28846 (2026): under 500,000 physical qubits at 10^-3 error rates in the paper's fast-clock working assumption. No such machine exists; progress is better read as a threshold model than a qubit count.

Exact classification rules (dump script-size codes)

• code 0 → P2PKH (20-byte hash) · not exposed
• code 1 → P2SH (20-byte hash) · not exposed
• codes 2,3 → P2PK compressed key · exposed if the x coordinate lies on secp256k1, else unspendable
• codes 4,5 → P2PK uncompressed key (x stored) · exposed if on-curve, else unspendable
• code ≥6 → raw script: OP_1 <32B> = Taproot, exposed iff lift_x succeeds · OP_0 <20B/32B> = P2WPKH/P2WSH, not exposed · OP_M <keys> OP_N OP_CHECKMULTISIG = bare multisig, exposed iff ≥M keys are on-curve · OP_2..OP_16 <2-40B> = witness v2+, own series · an on-curve 33/65-byte key immediately followed by OP_CHECKSIG = exposed and logged · anything else = unclassified, with its BTC value published, never dropped

Provenance

Every row carries base_height, base_hash, txoutset_hash, coins_written and the classifier version. Acceptance gates run before any row is written: exact end-of-file parse, output count equal to the header count, total value within 0.01% of the subsidy schedule, and a P2PK band check that makes the silent-zero failure mode impossible. A snapshot is refused if the node is in initial sync or lags its own headers.

base_height 962212 · base_hash 000000000000000000004b0d47e50a396a61edff6bad1d8358c45e2f207c6c18 · txoutset_hash 569b5ff7ef54fe0459b2827f0f372ba9e1bbbaef49990cadb025c5ed9ca719a4 · coins 165,861,232 · qclass_v1_20260813

What this measurement does NOT tell you

• It does not include address-reuse exposure (keys revealed by past spends on hash-locked addresses). That is a different, softer definition responsible for most of the 6-7M figures, and it is structurally impossible to compute from a UTXO snapshot.
• It does not say when, or whether, a cryptographically-relevant quantum computer will exist. We publish no countdown and no probability.
• It cannot attribute any specific movement to an attack: a quantum-derived spend would be byte-for-byte identical to an owner's spend.
• The 1.7M BTC of early P2PK is not “Satoshi's stash”: attributed estimates for the Patoshi pattern range from 700k to 1.1M BTC and are themselves contested.

Dataset · CC0

The daily series and the full watched-outpoint set are public domain. Every row carries the snapshot hash, so a citation can be verified against any Bitcoin node.

Daily series JSON · Watched outpoints CSV