Quantum risk to Bitcoin used to be a conference topic. It is becoming an inventory. On October 15, 2026, nine blockchain companies launched the Quantum Alliance and put a number on the problem: about 6.04 million bitcoin sit in addresses whose public keys are already visible on-chain.
That is roughly 30% of circulating supply. None of it is at risk today — but if a cryptographically relevant quantum computer arrives, those coins are the first in line.
Key facts
- The Quantum Alliance was founded by nine blockchain companies on October 15, 2026; one aggregator gives October 16.
- The alliance says about 6.04 million BTC sit in addresses with an exposed public key — 30.2% of circulating supply, per Glassnode data cited by TFTC.
- Decrypt names contributors including Quantus, Postquant Labs, Midnight Foundation, Keystone, Abelian and Hacken; TFTC adds American Fortress, Intmax and The Vault.
- A Google Quantum AI paper dated March 30, 2026 estimates fewer than 500,000 physical qubits would be needed to break secp256k1 — roughly one twentieth of earlier assumptions.
- A model run by two alliance contributors names March 2028 as the earliest window for a cryptographically relevant quantum computer.
- BIP-360 proposes a new “pay-to-merkle-root” output type; implementing it would require a soft fork.
What is the Quantum Alliance?
The Quantum Alliance is an industry group of nine blockchain companies set up to coordinate post-quantum standards for crypto. It models its process on the Internet Engineering Task Force and runs four working groups: migration, zero-knowledge methods, wallet security and cross-chain compatibility.
According to Decrypt, contributors include Quantus, Postquant Labs, Midnight Foundation, Keystone, Abelian and Hacken. Quantus founder and CEO Christopher Smith summed up the ambition: “In the future, post-quantum cryptography will simply be called cryptography, and everything else will be in a museum.”
The quantum clock doesn’t start when the computer exists. It starts when your public key is visible.
Why are 6 million bitcoin considered exposed?
A Bitcoin address normally hides its public key behind a hash until the owner spends from it. Once you spend, the signature reveals the public key on-chain — and a powerful enough quantum computer could in theory derive the private key from it. Coins in early pay-to-public-key outputs from 2009, and in reused addresses, are exposed already.
TFTC, citing Glassnode data, puts these coins at 30.2% of circulating supply. That figure includes long-dormant early coins whose owners may never move them, which is one reason the migration debate is so difficult.
How close is the threat?
The estimates are moving. A Google Quantum AI paper dated March 30, 2026 put the qubits needed to break Bitcoin’s secp256k1 curve at fewer than 500,000 physical qubits — about a twentieth of previous assumptions. A model from two alliance contributors names March 2028 as the earliest possible window, about 17 months away. Others consider that aggressive. Nobody can date it reliably.
What is BIP-360 and does Bitcoin need a fork?
BIP-360 proposes a new “pay-to-merkle-root” output type designed to support post-quantum signature schemes. A revision dated July 24, 2026 added Python examples and test vectors. Activating it would require a soft fork, which means broad agreement among node operators, miners and wallet developers — historically a slow process.
Pressure is building from the custody side. Coinbase has pushed since mid-October for an early start, warning that migration takes years, and Decrypt reports a consortium backed by BlackRock, Strategy and Coinbase has committed $15 million to quantum-risk work. Ethereum is on a similar path, as we covered in our report on its 2029 post-quantum deadline.
What can Bitcoin holders do now?
Avoid address reuse, so your public keys stay hidden until you spend. Use a wallet that generates a fresh receiving address every time. Keep long-term savings in addresses you haven’t spent from. None of this makes you quantum-proof, but it keeps you out of the “already exposed” group while the protocol work continues.
When you receive a swap through SwapZilla, use a fresh address from your wallet each time — most modern wallets do this automatically. Our guide to the best Bitcoin wallets of 2026 covers which ones handle address rotation well, and our Lightning vs on-chain guide explains how different BTC routes leave different on-chain traces.
Final thoughts
The Quantum Alliance doesn’t change Bitcoin’s code. It changes the conversation from “if” to “how many coins, and how fast can they move”. A 6-million-BTC inventory is the kind of number that makes protocol debates move faster — and that’s probably the point.