Cryptocurrency exchanges are emerging as the clearest pressure point in Bitcoin’s long-running debate over quantum computing risk, sitting on millions of coins with publicly visible cryptographic keys.
Bitcoin quantum risk begins with a fundamental feature of its transaction verification: public keys are hidden until funds are spent.
Once a wallet signs a transaction, the public key required to verify that signature is permanently published to the blockchain. The risk compounds when a custodian reuses that address, leaves remaining balances in it, or continues directing deposits to wallets that should have been retired.
That exposure has reached a massive scale, with Glassnode noting that about 6.04 million Bitcoin, representing 30.2% of the asset’s circulating supply, are currently held in wallets with exposed public keys.
In Glassnode’s framework, public key exposure becomes the core metric for identifying wallets that would matter most in a future quantum-attack scenario.
The data does not imply an immediate threat because quantum computers remain years away from the scale required to break Bitcoin’s encryption.
However, the metric reveals exactly where the network’s vulnerabilities are concentrated if advances in quantum hardware eventually make public-key exposure a practical security concern.
According to Glassnode, roughly half of all Bitcoin held by labeled exchanges is susceptible under the firm’s public-key visibility framework, compared with less than 30% of the non-exchange supply.
Notably, the exposure breaks down into two distinct categories, with the largest being operational risk.
This bucket covers 4.12 million Bitcoin and is tied directly to poor wallet management decisions, such as address reuse and partial spending without proper rotation of change outputs. Exchanges account for a significant portion of this risk, holding about 1.66 million exposed Bitcoin, equal to more than 8% of the total issued supply.
Moreover, data suggests custody standards are slipping as trading platforms expand their wallet infrastructure, deposit systems, and liquidity operations. The share of exchange-held Bitcoin considered operationally safe has steadily fallen from about 55% in 2018 to roughly 45% today.
That makes Bitcoin wallet security a measurable custody issue rather than a theoretical protocol debate.
Crypto exchanges vs Wall Street vs Sovereign wallets
A broader look at the data reveals that public-key exposure is wildly uneven across the global financial landscape, fracturing sharply along the lines of crypto-native platforms, traditional Wall Street institutions, and nation-states.
The clearest gap appears in crypto exchange wallets, where address reuse and legacy infrastructure leave large balances more visible on-chain.
Within the crypto sector alone, security standards vary drastically.
Binance, the world’s largest crypto exchange by volume, holds 85% of its labeled Bitcoin balances in addresses where public keys have already been revealed, Glassnode found.
With users holding more than $40 billion in Bitcoin on the platform, per DeFiLlama data, that methodology places over $34 billion of those assets squarely in the exposed category.
Meanwhile, other major trading venues show even higher concentrations. Bitfinex, Crypto.com, and Gemini each have 100% of their labeled Bitcoin balances classified as exposed.
Coinbase, the largest US-based exchange, sits at the opposite end of the spectrum. The Brian Amrstong-led firm carries public-key exposure on just 5% of its Bitcoin reserves, placing it among the strongest large-scale custodians in the report.
Meanwhile, that same custody divide is glaringly apparent when comparing crypto exchanges to traditional finance heavyweights and retail-focused platforms.
Bitcoin ETF issuers like Fidelity maintain exposure levels near 2%, while rivals like Grayscale and WisdomTree have exposure levels of around 50% and 100%, respectively.
Other platforms, like Block’s Cash App, align with industry best practices, while Robinhood and Revolut flag nearly 100% exposure in their labeled wallets.
Government actors, meanwhile, display the strictest cryptographic hygiene of all. Wallets tied to the United States, the United Kingdom, and El Salvador have maintained zero quantum exposure, boasting safety rates above 99% for several years.
The split across these platforms confirms that the vulnerability stems from internal wallet architecture and address rotation policies, rather than from the inherent burden of managing massive liquidity.
A slow Bitcoin upgrade leaves exchanges with the first move
While the timeline for a quantum-capable attack remains fiercely debated, Glassnode’s data makes one thing clear: the crypto industry’s most immediate defense lies in basic operational hygiene, not protocol-level overhauls.
By separating the exposed supply into structural and operational categories, the data highlights that operational exposure, the largest vulnerability, can be drastically reduced without waiting for a complex change to Bitcoin’s consensus rules.
This means that trading platforms can immediately lower their risk profile simply by moving balances to fresh addresses, retiring used wallets, and tightening internal controls around change outputs.
This gives custodians a direct path to secure customer funds while the broader Bitcoin community debates longer-term cryptographic solutions.
Notably, Bitcoin itself cannot be refitted overnight. So any systemic migration to post-quantum signatures would require massive coordination across developers, miners, node operators, wallet providers, and custodians.
Given that consensus changes are intentionally slow, a broad cryptographic transition would likely unfold over several years.
Exchanges, however, have a much shorter path available to them right now.
As Bitcoin becomes increasingly embedded in spot ETFs, traditional brokerage accounts, and institutional custody products, the first line of defense against future quantum threats will not come from code upgrades, but from the entities holding the largest pools of customer coins.
Wallet hygiene is no longer a back-office detail; it is a highly visible test of whether Bitcoin’s custodial layer is prepared for a threat that, while uncertain in its timing, is already measurable on-chain.
Bitcoin quantum computing risk is therefore becoming a test of custody before it becomes a protocol-level emergency.