Key takeaways

  • Quantum exposure is a property of an unspent output and its history, not a property shared equally by every bitcoin.
  • P2PK and Taproot outputs display public keys at rest. P2PKH and P2WPKH usually begin with public-key hashes, but a spend reveals the key.
  • Reusing a key or address can leave remaining outputs exposed after one spend. A spent output itself is no longer a coin to steal.
  • The difference matters for planning a future protocol response; it is not a personal investment recommendation or a claim of present-day quantum theft.

Which Bitcoin addresses face the greatest quantum risk? Those whose unspent outputs can already be associated with visible elliptic-curve public keys face the clearest hypothetical key-recovery path. But the word “address” can mislead. Bitcoin does not store balances inside address-shaped boxes. It stores unspent transaction outputs—UTXOs—with scripts that define how each output can be spent.

Those scripts reveal different information. Some contain a public key, some contain a hash of one, and some commit to a more complex script. Earlier transactions can change what an observer knows. That makes “all Bitcoin is equally exposed” as unhelpful as “addresses always hide public keys.” Both collapse distinctions that matter.

First, what exactly is exposed?

A private key is the secret that lets a wallet sign. A public key lets the network verify a signature. The familiar secp256k1 relationship is designed so a classical observer cannot feasibly recover the private key from the public one. Shor’s algorithm would change that assumption on a sufficiently large fault-tolerant quantum computer. Such a computer has not been publicly demonstrated attacking Bitcoin.

The key question is therefore whether an observer knows the actual public key associated with an unspent output. A public-key hash is not the public key itself. The hash commits to it; ordinary verification later requires revealing the key. Generic quantum search against a hash is a different, less direct issue from Shor’s discrete-logarithm attack. The Shor-versus-Grover comparison explains why the two should not be conflated.

This article is about potential exposure under a future cryptographically relevant machine. It does not rank people, tell holders to move funds, or estimate a personal loss probability. Outputs can have scripts and spending histories that a simple address label does not reveal.

Pay-to-public-key: visible from the beginning

Early Bitcoin transactions often used pay-to-public-key, or P2PK. A P2PK output carries a public key directly in its locking script. Bitcoin Core’s descriptor documentation represents this with pk(KEY). Anyone reading the chain can extract the point needed for a hypothetical Shor attack, whether or not its owner ever spends.

That creates a long-exposure scenario: there is no need to wait for a transaction to reveal the key. It does not establish that a particular old coin is lost. A UTXO can be dormant because its owner chose not to spend, because its keys are unavailable, or for reasons an outside observer cannot know. Age is evidence of inactivity, not proof of abandonment.

If a future protocol debate turns to restricting exposed old outputs, this inability to identify the rightful owner becomes central. Our lost-coin freezing debate examines that problem without treating silence as consent.

Public-key hashes: protection until the key appears

The familiar P2PKH output contains a hash of a public key. The spender provides both the public key and a signature when redeeming it; Bitcoin’s transaction guide shows the relevant locking and unlocking scripts. Native SegWit P2WPKH, defined by BIP 141, similarly commits to a 20-byte public-key hash and reveals the key in witness data during a spend.

Before that first reveal, a future attacker cannot apply the direct Shor route to a public key they do not have. Once a spend is broadcast, the public key becomes visible. If that spend consumes the only output associated with the key, a later key-recovery attack cannot steal the output already consumed. The transient concern is whether an attacker could derive the key and produce a competing spend before the intended transaction confirms.

If other unspent outputs remain under the same key, the situation is different. The revealed public key could make those outputs long-exposure targets. This is one reason address reuse matters. It is not that the blockchain changes an old address from “safe” to “unsafe” by magic; new public information changes what an observer can compute about outputs controlled by that key.

An address string by itself will not tell you whether it has been used before, whether related keys are exposed in other scripts, or whether a custodial service manages funds behind it. For rigorous measurement, researchers inspect scripts and on-chain history, then state their classification assumptions. Even an accurate count of exposed UTXOs would not identify who can still control them.

Taproot: a public key in the output

Taproot is sometimes mistakenly described as hiding keys because it makes many spending conditions less visible. It does improve privacy in some script-path situations, but its output structure is relevant here. BIP 341 specifies a 32-byte witness program representing a tweaked public key. An observer sees that output key before it is spent.

It is the tweaked output key—not necessarily the wallet’s internal key—that is visible. A Shor-capable adversary who derived the private scalar for the output key could nevertheless satisfy a key-path spend under today’s rules. The details of a particular Taproot script path can be more involved, but the visible output key is enough to explain why Taproot should not be called post-quantum cryptography.

This observation is not a criticism of Taproot’s existing benefits. It is a reminder that upgrades solve particular problems. Schnorr signatures are elegant and useful, but they remain elliptic-curve signatures rather than quantum-resistant ones.

Script hashes and multisignature: look inside the conditions

P2SH and P2WSH outputs commit to a script hash. The script is generally disclosed when spent, and it may include public keys, thresholds, time conditions, or other branches. BIP 16 and BIP 141 define these arrangements. Their exposure cannot be summarized safely as “hidden” or “visible” without examining the actual script and what has already appeared on-chain.

Multisignature does not automatically remove the quantum concern. A future adversary able to recover private keys from multiple exposed public keys could meet a threshold. But the effort and timing depend on the script, the number of necessary keys, and which keys are visible. Likewise, an output encumbered by a script can have a hash-only commitment at first yet reveal a rich set of keys when a different output with the same script is spent.

The point is not to classify every conceivable Bitcoin script in one chart. It is to avoid treating an address prefix as a complete threat model.

Spent outputs are history; unspent outputs are targets

An output that has already been spent no longer exists in the UTXO set. Its revealed public key may still be visible forever in transaction history, but that historical output cannot be spent again. What matters is whether another unspent output can be controlled with the same key, or whether an attacker could have raced the original spend while it was pending.

This distinction prevents a common overcount. Summing all transactions that ever revealed keys does not measure bitcoin currently at risk. Neither does counting only P2PK outputs capture every already-exposed public key. Reuse, Taproot output keys, scripts, and spent-versus-unspent status all affect the estimate.

One must also distinguish an on-chain fact from a future scenario. “This UTXO contains a visible public key” is observable. “A future attacker can recover its private key quickly enough and profitably steal it” depends on hardware, cost, timing, and Bitcoin’s future rules. The 2026 quantum-risk overview puts those uncertainties together.

A practical way to read the risk, without a wallet prescription

The useful mental model has three questions. First: Is the output still unspent? Second: is the public key needed for a valid spend already exposed through the output or earlier transactions? Third: if it is not, when would a legitimate spend reveal it, and what would a hypothetical attacker have to do before confirmation?

That framework explains why an old P2PK coin, an unused P2WPKH output, a reused-key balance, and a Taproot output do not occupy the same exposure category. It does not answer who should move coins, what output type to choose, or when a future risk becomes actionable. Those decisions require facts about the owner’s setup, available protocol options, custody, and threat tolerance that a public article cannot supply.

Bitcoin’s likely response is therefore not a slogan about “all addresses.” It is careful analysis of the UTXO set, review of post-quantum spending proposals, and a migration path that deals honestly with both exposed and not-yet-exposed keys. The exposure map is uneven. A sound policy has to be at least as precise as the problem.

Sources