Counting Quantum Vulnerable Bitcoins

The quantum vulnerable Bitcoins are the ones that are at risk of being stolen by a quantum adversary due to being held by a quantum vulnerable address.

Quantum computing threat

These kinds of computers are different from the actual ones, from now on “classical”. The security in the “classical” world is held by “hard” mathematical problems. These problems are considered impossible to be solved at a reasonable time because of the lack of efficient algorithms to do it. They aren’t impossible, because for example using brute force you will be able to get the answer, but the time needed for that is probably larger than the Earth lifetime. One of these challenges is the DLP or Discrete Logarithm Problem, being the core of almost every cryptographic algorithm. Nevertheless, in the “quantum” world, some of these problems are “easy” to compute. This means that they are no longer secure, and we can’t rely on them. The mathematician Peter Shor developed an algorithm to efficiently compute the DLP by using the power of the quantum computers. Despite the threat, the technology needed to execute this algorithm is higher than the actual one, but, in theory, the threat is real.

Bitcoin is one of the systems that relies on these kinds of problems to ensure security, so the existence of a quantum computer shakes the community. Basically, the coins in Bitcoin are protected behind a digital signature. To unlock them, it is only necessary to, using the private key associated with the public key, sign the transaction that spends the money.

Types of quantum vulnerable addresses

The difference lies in the fact of when the users disclosure the public key. This creates two groups of addresses: the ones that show the public key directly on the scriptPubKey, making them vulnerable from the moment they receive coins, and the others that use hash functions to hide it. We will call them exposed and non-exposed.

Another possible distinction is related to when is going to happen this disclosure. We find, again, two categories: long-range and short-range. In the first category we find those addresses that expose the public key in the address, leaving a large time window to a quantum adversary to compute the private key. The other group, only shows the public key when the transaction is waiting to be mined, leaving a smaller time window. It is obvious that the larger the time window is, the less computation requirements are needed.

We can think that it is as easy as only using the hash addresses, and we will be protected for a long time. And that’s true, but at the moment that a hashed address is spent, it automatically converts itself to a non-hashed one, so the reuse of this address will make the users feel safe when truly they aren’t. Even though it is highly inadvisable to reuse addresses, not for this problem but for many others, a lot of users nowadays still reuse addresses. This leaves us with a higher quantity of vulnerable coins than we initially thought.

In the table below we can see how we can classify each address type.

Measuring the quantum vulnerable coins

Achieving the exact value of quantum vulnerable coins is not trivial. First, we must consider coins that are being held by the long-range vulnerable addresses being the “easy” part of the work. Second, we have to consider the reused short-range vulnerable ones. Third, we should think out of the box, by this we mean thinking in situations where we can find a public key disclosure, like the fork in Bitcoin that created Bitcoin Cash. This alternative blockchain still uses the same addresses as Bitcoin, so the use of an address on either chain will disclosure the public key. Similarly happens with the lightning network, once the channel is opened, the output remains unspent to avoid closing it. The payments between users require signing transactions, disclosing the public key. Since any user wants to force close the channel, to avoid losing the money, a quantum adversary could start computing the private key.

Identifying the long range quantum vulnerable coins

For this work we are only going to focus on computing the number of long-term coins. In order to obtain this value, we first identified the scenarios where due to the users behaviour coins are locked behind those addresses.

First, and the easiest scenario, is that one where the coins are locked behind exposed addresses. As we saw, those addresses are directly long-term. The second scenario, also already explained, is where the users reuse hash address. Initially they were short­-range, but by reusing them , they become long-range. Lastly, we have a special case of address reuse. Sometimes, users tent to receive different payments into the same address, as soon as one of that UTXOs is used, all the other will became vulnerable.

Once we have identified where the coins are generated, we have to develop an algorithm in order to count them. To track the address reuse, we leverage into the bloom filters. This probabilistic structure allows us to store a huge amount of data in a small space, and more important, allows fast pertinence proves, being an important trait when dealing with such a huge amount of data. The algorithm is pretty straightforward, as we can see in the image below.

To compute the total amount of long-range quantum-vulnerable coins, we parse the entire blockchain, examining every transaction in every block. The pipeline is divided into two stages: outputs first, then inputs.

Starting with the outputs, for each one we check whether the address is exposed. If it is, we directly add its amount to the global counter, since as we discussed, exposed addresses are quantum-vulnerable by definition. If the address is not exposed, we use the bloom filter to check whether it has been reused in the past. We use this technique to avoid searching through all past addresses every time, which would be prohibitively slow. If we find a match, those coins are also vulnerable, and we add them to the counter. If we do not find a match, the address is new and unexposed, which corresponds to the third scenario we described earlier, so we store the amount in a dictionary for later.

Once all outputs are processed, we go through the inputs following the same pipeline. If the input address is exposed, we subtract its amount from the global counter, as those coins are no longer vulnerable once spent. If it is not exposed, we again query the bloom filter for the same reasons as before. Whether the address turns out to have been reused, we will subtract the amount of the global counter. If it has not been used before, we are in the third scenario: we recover any amount stored for that address in the dictionary, add it to the counter, and insert the address into the bloom filter to keep track of future reuse.

With this pipeline we can efficiently compute all the long-range quantum-vulnerable coins present in the blockchain.

Results

Below we can see the results obtained after executing the algorithm.

As shown above, the amount of quantum-vulnerable coins varies over time, reaching its peak around block height 250,000. After that point, the amount gradually decreased until the Taproot activation, which introduced a new wave of exposed addresses. Since then, the number has been steadily growing, reaching close to 5 million coins currently at risk of theft.

The bar plot above shows the proportion of quantum-vulnerable coins relative to the total supply in circulation. This ratio has remained relatively stable over time, starting at around one third of all coins in the early blocks and gradually settling at approximately one quarter of the total supply today.

Conclusion

This work allowed us to analyse the real risk that quantum computing poses to the Bitcoin network, showing that approximately one quarter of all coins in circulation are currently at risk of theft. Furthermore, we found that the majority of these vulnerable coins stem from address reuse, which is not only a quantum computing concern but also a broader privacy issue that affects all users of the network.

This work has been published in Jornadas Nacionales de Investigación en Ciberseguridad (JNIC) 2026