About 30% of Bitcoin Has Exposed Public Keys: What Google’s Quantum Breakthrough Really Means

Disclosure: Early Bird Wins earns a commission from qualifying Amazon purchases made through links on this page, at no extra cost to you. This article is for education only and is not financial advice. We also earn a commission from some other partner links, such as Ledger, at no extra cost to you.

On October 15, 2026, Google Quantum AI published a blog post titled “Bringing the magic: Google breaks open a bottleneck in quantum computing”, by research scientist Emma Rosenfeld and Craig Gidney. Within hours, crypto X was full of posts claiming Google had “broken Bitcoin.” It hasn’t. But the result does matter, and it brings back an uncomfortable statistic: about 30% of all bitcoin is held in a way that a future quantum computer could, in theory, attack.

Here is what Google actually showed, where the 30% figure comes from, and what (if anything) you should do about it.

What Google announced: magic state cultivation on Willow

Quantum computers need two kinds of operations. Most are relatively cheap to protect from errors. A few, called non-Clifford or “T” gates, need special ingredients known as magic states, and making clean magic states has long been one of the most expensive parts of a fault-tolerant machine.

In 2024, Gidney, Noah Shutty and Cody Jones proposed a shortcut called magic state cultivation. Google describes it as a filter: inject a noisy state into a small patch of the chip, run coordinated checks, and throw away any attempt that shows an error. What survives is grown into a larger, more useful encoding.

According to Google’s post and the peer-reviewed paper in Science (also on arXiv), the team:

• ran cultivation on its Willow processor and cut errors about 40-fold versus uncultivated states;
• produced T-states with a record logical fidelity of 99.99% (an error bound of roughly 1 in 10,000);
• moved a cultivated state from a small color code into a distance-5 surface code, the kind of code Google plans to scale.

The fine print matters. The paper says this fidelity came while keeping only about 8% of attempts; the rest were discarded by the filter. Google also says larger demonstrations are still needed before the method supports practical fault-tolerant computing. Breaking cryptography is generally thought to need far lower error rates than 1 in 10,000.

Why a lab result about “magic” worries Bitcoin holders

Bitcoin signatures use elliptic-curve cryptography on the secp256k1 curve. A large enough quantum computer running Shor’s algorithm could work out a private key from its public key. Magic states are the fuel for exactly that kind of computation, so cheaper magic states mean a smaller machine for any given attack.

That is why reactions from people who follow this closely were split, not panicked. Project Eleven CEO Alex Pruden told The Block the result “doesn’t necessarily move Q-Day timelines,” because cultivation was already assumed in earlier estimates, but that it makes those estimates more credible. Castle Island Ventures’ Nic Carter told the same outlet there is “no imminent threat,” while noting that progress is speeding up. On X, Bitcoin Well summed up the mood: “Google just broke bitcoin” was all over the timeline, but Google’s actual claim was a roughly 40x error reduction.

How much bitcoin is actually exposed? Checking the “30%” claim

The key question is whether a coin’s public key is already on the blockchain. Most modern addresses only show a hash of the public key until you spend from them, and hashes are not something Shor’s algorithm can reverse. Public keys become visible “at rest” in three main ways:

• P2PK outputs: the earliest format (2009–2010 era), which puts the full public key directly in the output. Satoshi-era mining rewards use it.
• Address reuse: once you spend from an address, its public key is published. Any coins still at that address, or sent to it later, are exposed.
• Taproot (P2TR, bc1p…) outputs: Taproot puts a (tweaked) public key in the address itself, so these coins are exposed from the moment they arrive.

Here is how the main estimates compare:

Verdict: “About 30%” is accurate if you mean coins with exposed public keys today. Glassnode’s 30.2% is the closest match, and Project Eleven’s ~33% is in the same range. The often-quoted ~25% comes from Deloitte’s older, narrower count, which left out Taproot and some reuse types. Numbers differ because each team counts slightly different scripts and because reuse changes week to week.

Two caveats keep this from being a doom number. First, “exposed” means attackable by a machine that doesn’t exist yet, not “at risk of theft this year.” Second, most of the exposure is fixable. Glassnode found that exposure from behavior (mainly reuse) is about twice the size of exposure built into the script type, and Chaincode calls reuse a “manageable” vulnerability because owners can still move their coins. Big chunks sit with exchanges and custodians: Glassnode counts about 1.66M exposed BTC tied to exchanges.

What about Satoshi’s coins?

Satoshi Nakamoto is widely believed to hold around 1 million BTC (often quoted as about 1.1 million), based on researcher Sergio Demian Lerner’s 2013 “Patoshi” mining-pattern analysis. That attribution is circumstantial, not proven. These early coins sit mostly in P2PK outputs and have never moved, so they are permanently exposed unless the owner wakes up and migrates them.

This is the hardest part of the debate. Coins whose keys are lost can never be upgraded, so a future attacker could treat them as a prize. Google’s whitepaper estimates dormant, quantum-vulnerable bitcoin may reach about 2.3 million BTC across script types. Developers are split between “freezing” such coins and leaving them alone on property-rights grounds.

How big would a Bitcoin-breaking quantum computer need to be?

Estimates have fallen sharply, mostly because of better algorithms rather than better hardware:

• RSA-2048: In May 2025, Gidney estimated RSA-2048 could be factored in less than a week with fewer than one million noisy qubits, down from 20 million qubits in his 2019 estimate with Ekerå. Cultivation was one of the tricks that made that cut possible.
• Bitcoin’s ECC (secp256k1): Google’s 2026 cryptocurrency whitepaper (Babbush, Gidney, Boneh and others) estimates Shor’s algorithm could run with about 1,200–1,450 logical qubits, or fewer than 500,000 physical qubits on a superconducting design, finishing in minutes. The authors shared a zero-knowledge proof of their circuit size rather than the circuit itself.

For scale, Willow has 105 physical qubits. Going from about 100 to about 500,000 high-quality qubits is a huge engineering gap, and nobody can promise when, or whether, it will close. Public timelines vary. Google has said it aims to move its own systems to post-quantum cryptography by 2029, and some commentators float “Q-Day” dates as early as 2028, but those are targets and guesses, not forecasts anyone can verify.

The whitepaper also flags a newer worry: a fast superconducting machine might crack a key in roughly 9–12 minutes, close to Bitcoin’s 10-minute block time. That could put even unexposed coins at risk while they are being spent, which is why a protocol upgrade, not just good habits, is the long-term fix.

BIP-360 and Bitcoin’s post-quantum roadmap

Bitcoin has no single migration plan yet, but the proposals are getting more concrete:

• BIP-360 started life as P2QRH (Pay to Quantum Resistant Hash). After several rewrites it is now Pay-to-Merkle-Root (P2MR): essentially Taproot with the quantum-exposed key-path spend removed. It was merged into the BIPs repository in February 2026 but is still a Draft, not activated. It does not add post-quantum signatures itself; the authors say that needs a separate future proposal.
• BIP-361 outlines a phased plan that would first stop sending to quantum-vulnerable addresses and later block spending from them. BitMEX Research has proposed a “canary” alternative that would trigger a freeze only if a quantum computer proves itself on-chain.
• Chaincode’s report lists other ideas, including Lamport signatures and commit-delay-reveal migration, and says all of them remain early stage.

Any of these would need a soft fork and broad agreement, which in Bitcoin usually takes years.

What Bitcoin holders can do today

You don’t need to panic-sell. You can, however, take yourself out of the “exposed at rest” group with a few habits that are good security practice anyway:

1. Stop reusing addresses. Use a fresh receive address every time. Modern wallets do this automatically; don’t override it.
2. Spend whole outputs and send change to new addresses. Leaving a balance on an address you’ve already spent from keeps that balance exposed.
3. Move coins off old reused or P2PK addresses to a fresh native SegWit (bc1q…) address you control. If you mined or bought very early, check which address types you hold. Project Eleven’s open-source Risq List lets you look up whether an address is flagged.
4. Consider avoiding Taproot (bc1p…) for long-term cold storage until P2MR or something like it exists, since Taproot outputs expose a key by design. Both Google’s whitepaper and Chaincode’s report make this point.
5. Use a hardware wallet bought from a trusted source. It won’t stop a quantum computer, but it keeps your keys off internet-connected devices today and makes clean address management easy. See our guide on how to buy a hardware wallet safely in 2026 and our Ledger vs Trezor 2026 comparison.
6. Don’t share your extended public key (xpub) with apps you don’t need. Google’s paper notes xpub exposure could let a future attacker go after many keys at once.
7. Ask your exchange or custodian about its quantum plan if you leave coins there. Glassnode’s data shows big differences in key exposure between custodians.

For more background, see our earlier explainer, Quantum Computers vs Bitcoin: What Google’s New Research Means for Your Crypto.

The bottom line

The 30% figure is real, but it measures exposure, not losses. Google’s magic state result is a meaningful step that makes existing resource estimates more believable. It is not a machine that can break Bitcoin, and the gap from 105 qubits to hundreds of thousands is still huge. The sensible response is boring: clean up address reuse, keep keys offline, and follow BIP-360 and related proposals as they move forward.

FAQ

Is 30% of bitcoin about to be stolen by quantum computers?

No. About 30% (roughly 6–7 million BTC) has public keys visible on-chain, which would make it a target if a large, fault-tolerant quantum computer existed. No such machine exists today.

Did Google break Bitcoin’s encryption?

No. Google showed a better way to make the high-quality “magic states” that a future fault-tolerant quantum computer would need. It did not attack any cryptography.

How many qubits would it take to break Bitcoin?

Google’s 2026 whitepaper estimates fewer than 500,000 physical superconducting qubits (about 1,200–1,450 logical qubits). Willow has 105 physical qubits.

Are Satoshi’s coins vulnerable?

Probably, in theory. The roughly 1 million BTC attributed to Satoshi sit mostly in early P2PK outputs with public keys showing. Whether Bitcoin should freeze such coins is an open and contentious question.

Is my bitcoin exposed?

If you never reused an address and hold coins on unspent, hash-based addresses (such as bc1q…), your public key generally isn’t visible at rest. Coins on reused addresses, P2PK outputs or Taproot (bc1p…) addresses are exposed.

What is BIP-360?

A draft Bitcoin proposal, first called P2QRH and now Pay-to-Merkle-Root (P2MR), that would create a Taproot-like output without the exposed key path. It has been merged as a draft but is not activated.

Will a hardware wallet protect me from quantum attacks?

Not by itself. Its job is to keep your private keys offline and make it easy to use fresh addresses. That keeps you out of the “exposed at rest” group, which is what you can control right now.

Not financial advice. This article is for informational purposes only. Do your own research and consider speaking with a qualified professional before making investment or security decisions. As an Amazon Associate, Early Bird Wins earns from qualifying purchases.