Public Key Exposure

"Exposed" means the public key that controls a coin is out of your hands: on the chain, where everyone can read it, or handed to someone else, as a shared xpub hands over every key under it. The counts on this page cover the on-chain case only. Exposed does not mean stolen. There is no known way to work a private key out of a public key on its own, and no cryptographically relevant quantum computer exists. Signing bugs such as nonce reuse are a different problem: they leak the key through flawed signatures, not through the public key. What matters here is whether a hash still stands in front of the key.

Two classes:

• Always-exposed, from creation: P2PK, where the key is in the output itself; bare multisig, where all the keys are; and Taproot (bc1p), where the address is the tweaked key.
• Reuse-exposed: P2PKH (1...), P2WPKH (bc1q, 42 characters), P2SH (3...) and P2WSH (bc1q, 62 characters) put a hash of the key or script in the output. The key stays hidden until the first spend, when it appears in the scriptSig or witness. A P2SH multisig reveals its keys in the redeem script; the common nested-segwit "3..." address reveals its key in the witness, not the redeem script. The key is then on the chain forever, and every later deposit to that address sits behind it for as long as it stays unspent.

Exposure follows the key, not the address string. One private key yields a P2PKH, a P2WPKH and a nested-segwit address; reveal it through any one and all three are exposed. Switching address type is not moving to a fresh key.

BIP-360 names the two cases. A long exposure attack "Attempts to derive private keys from public keys that are exposed for an extended period of time; that is, longer than the window of time that a public key is generally exposed in the mempool while waiting to be confirmed." Short exposure attacks "cannot be prevented through wallet hygiene, as revealing a public key is necessary for spending." And the line that puts the job on users: "Protection from long exposure quantum attacks does not depend on the activation of post-quantum signatures in Bitcoin, but requires that users do not expose their public keys to attackers via public key reuse or other unsafe practices."

How much is exposed depends on the counting rule. ChainQuery's quantum-exposure report at block 970,878 (snapshot 2026-10-11) put the total at about 35 percent of supply, 7,105,243 BTC. Of that, 5,172,596 BTC was reuse-exposed, about one coin in four, and the largest bucket was P2WPKH at 2,081,021 BTC: segwit-era wallets, not Satoshi's. Project Eleven's Risq List and Glassnode count under different rules, so the three figures bracket each other rather than agree to the coin.

The way out is the oldest advice in Bitcoin: use each address once, and if you already spent from a reused address, move everything there to a fresh hashed address in one transaction. See Address Reuse, Post-Quantum Bitcoin and the Quantum and Bitcoin rabbit hole.