The Exposed Third: Europol, Glassnode, and the 6.04 Million Bitcoin That Cannot Hide

Six million and forty thousand. That is the number of Bitcoin that Glassnode classifies as sitting on addresses whose public keys have been permanently written to the chain. At a spot price north of $83,000 per coin, that is a pool worth more than $502 billion — roughly thirty percent of every Bitcoin that will ever exist. Not a rounding error. Not a cold-wallet footnote. A third of the monetary base of the world's most secure settlement network, sitting in a state that cryptographers have a specific word for: exposed. The dominant narrative in the market right now is that quantum computing is a problem for someone else — a decade away, a research curiosity, a topic that belongs in the same bucket as asteroid insurance and Y2K. Europol disagrees, or at least its latest threat assessment does. The agency's report does not claim that a quantum computer exists today that can break Bitcoin. It claims something more uncomfortable: that for a measurable, quantifiable, and alarmingly large subset of the supply, there is no cryptographic fix available, only an operational one. And the operational fix requires coordination across a network that has no coordinator. That is the anomaly worth chasing. Not whether quantum computers can break ECDSA — they can, and the mathematics is not in dispute. The question is what happens to a decentralized monetary system when a third of its supply needs to be moved, cannot be moved by any central authority, and has no software patch that can make the problem go away. THE TWO PRIMITIVES To understand what Europol is actually warning about, you have to separate two cryptographic primitives inside Bitcoin that the market routinely conflates. The first is the hash function. The second is the signature scheme. They have almost nothing in common in terms of quantum resistance, and this asymmetry is the single most under-discussed fact in the entire debate. Bitcoin's proof-of-work consensus rests on SHA-256. Mining is a brute-force search for a hash below a target threshold. The best known quantum algorithm against hash preimages is Grover's, which offers only a quadratic speedup — a quantum miner would need to search roughly the square root of the classical search space, which in practice collapses to a manageable factor. SHA-256 is not meaningfully threatened by quantum computing in any realistic horizon. This is why miners should sleep soundly and why the 'quantum kills Bitcoin' headline is lazy. Then there is ECDSA over the secp256k1 curve. This is the signature scheme that proves you have the right to spend a coin. Its security rests on the hardness of the discrete logarithm problem. And the discrete logarithm problem is precisely what Shor's algorithm — a quantum algorithm with exponential speedup, published in 1994 — solves efficiently on a sufficiently large fault-tolerant quantum computer. This is not speculation. It is a proven result. The only open variable is the engineering question of how many physical qubits, with what error correction overhead, are required to run Shor's algorithm against a 256-bit curve. Europol's framing, as reported, is technically accurate on this point: a quantum machine could derive a private key from an exposed public key. The agency is careful to note that the threat is theoretical and early, that no timeline is given, and that the affected population is narrower than a blanket panic would suggest. That last qualifier is the one worth interrogating, because 'narrower' is doing a lot of work when the narrow slice is six million coins. The other institution in this story is Glassnode, the on-chain analytics firm whose supply classifications make the exposure measurable. Glassnode's taxonomy separates coins by address type, and address type is destiny in a post-quantum threat model. This is where the forensics begins. Following the exit liquidity to its cold storage is usually a rug-pull exercise. Here it is inverted. The 'exit liquidity' is the exposed supply, and its 'cold storage' is the set of addresses that are safest precisely because their public keys have never been revealed. THE EXPOSURE TAXONOMY Here is the technical distinction that decides which coins are safe and which are not, and it comes down to a single property: whether the public key is revealed before or after the spend. A legacy P2PKH address — the ones that begin with a '1' — stores the hash of the public key, not the public key itself. The public key is only revealed at the moment of spending, when it is included in the unlocking script. Until that moment, an attacker sees only a 160-bit hash fingerprint. A quantum computer running Shor's algorithm cannot reverse a hash to recover a public key; that would require a preimage attack against SHA-256 and RIPEMD-160, which Grover's algorithm does not solve in polynomial time. So an unspent P2PKH address is, counterintuitively, among the safest places to hold Bitcoin against a quantum adversary. The exposure only materializes once you move the coins — and by then, the coins have already moved. Now consider the opposite extreme. P2PK — pay-to-public-key — is Bitcoin's earliest output format, used by Satoshi in the genesis-era blocks. It stores the full public key directly in the output script. The public key is not hidden behind a hash. It has been visible to anyone with a block explorer since 2009. The same is true, in a different way, of Taproot. Taproot, activated in November 2021, introduced P2TR outputs using Schnorr signatures. Taproot was a genuine engineering achievement — smaller, more private for complex scripts, and more efficient. But it has a property that its advocates under-emphasized in the marketing: for the most common key-path spend, the output contains a tweaked public key directly. There is no hash layer hiding it. If you received Bitcoin to a Taproot address and have not spent it, your public key is already on-chain. You are, right now, in the exposed set. This is the detail that reframes the entire discussion. The naive assumption is that quantum vulnerability is a problem for old coins — the dusty 2010 wallets, the Satoshi stash, the forgotten early-adopter addresses. The reality is that it disproportionately affects modern, active users who adopted Taproot because they were told it was the best-practice address format of the future. The users who did everything right, who upgraded to the newest and most efficient standard, are the ones standing in the exposed third. Based on my own audit experience, this is the pattern that repeats across every security review I have run. The newest standard is rarely the safest one in a threat model its designers did not anticipate. When I audited the Zilliqa genesis contracts in 2017, the vulnerability I found — an integer overflow in the sharding transaction batching logic — was not in the legacy code path. It was in the new, elegant, optimized batching routine that everyone was proud of. Elegance and exposure correlate more often than the industry admits. I submitted a standardized patch via GitHub, and the project delayed its mainnet launch by two weeks to implement the fix. The lesson I carried forward: the code does not care how elegant it looks. It only cares about the assumptions it was built on. So the exposure taxonomy has three tiers, and they matter enormously for how any migration would work. Tier one: unspent P2PKH and unspent P2SH outputs, where the public key remains hash-protected until spend. Roughly seventy percent of supply, and relatively safe as long as the owner does not broadcast a spend that reveals the key. This is the majority. Tier two: Taproot key-path outputs that have received funds and not spent them. Public key visible, modern addresses, and this population is growing every day as more users and exchanges adopt P2TR. Tier three: legacy P2PK outputs, including the earliest mined coins, where the public key has been exposed since 2009 and, in many cases, the coins have never moved. This is the smallest tier by coin count but the most consequential by narrative weight. The Satoshi coins belong to tier three. Roughly a million Bitcoin attributed to the earliest mining period sit in P2PK outputs with public keys that have been visible for fifteen years. They have never moved. They may never move. And they are, in a strict technical sense, the single most attractive target on the network for a future quantum adversary — because the public key is known, the private key is unknown, and the coins have not moved to a new address that would reveal anything further. There is a fourth category that the report gestures at but does not fully develop: coins held on exchanges in reused deposit addresses. These are not a distinct cryptographic tier so much as a distributional amplifier. An exchange that reuses a Taproot deposit address for thousands of users has, in effect, pooled those users' exposure into a single publicly visible key. The users did not choose this. They cannot fix it. The exchange's operational hygiene decides whether a large slice of retail supply is quantum-soft, and most users have no visibility into that decision. THE MIGRATION MATH Europol, per the reporting, quantifies the migration burden. If the network needed to move all exposed coins to fresh, hash-protected addresses, the throughput constraint becomes the bottleneck. Under a full-capacity scenario, the migration window is estimated at seventy-six days. Under a more conservative assumption of using only a quarter of available block capacity, the window stretches to roughly three hundred days. These numbers deserve scrutiny because they are load-bearing for every downstream conclusion. Seventy-six days to move thirty percent of the supply. Three hundred days if you want to leave room for everyone else's transactions. Now layer on the signature bloat. Post-quantum signature schemes — the NIST-standardized ML-DSA and SLH-DSA families, finalized in 2024 — are not drop-in replacements for ECDSA. Their signatures are ten to a hundred and twenty times larger, depending on the scheme and parameters. A single post-quantum signature can occupy more space than an entire block's worth of legacy transactions. If Bitcoin's address format migrates to a post-quantum scheme without a corresponding protocol-layer capacity increase, the effective throughput of the network collapses. The mempool, which is already a labyrinth during congestion events, becomes a permanent traffic jam. Tracing the ghost liquidity behind the rug pull taught me that migration events are where risk concentrates. When a token's liquidity is pulled, it is not the withdrawal that kills holders — it is the queue. Everyone tries to exit through a door sized for a fraction of the crowd, and the last ones through get nothing. A forced Bitcoin migration to post-quantum addresses is structurally similar, except the 'door' is block space and the crowd is six million coins. If the trigger is a credible quantum breakthrough announcement, the migration will not be orderly. It will be a stampede, and the fee market will price the door accordingly. This is the point where I depart from the report's implicit optimism. Europol presents migration as the solution — the only available remedy for exposed coins. But migration is an operation, not a fix. It requires that every holder of an exposed coin recognize their exposure, understand the correct remediation, acquire a wallet that supports the new address format, and broadcast a transaction before the adversary acts. For institutional holders, it requires custodians to upgrade infrastructure. For exchange-held coins, it requires the exchange to migrate on behalf of users who cannot. For the Satoshi coins, it requires a decision that no one has the authority to make. Run the arithmetic on the ninety-day version of that window. To clear six million coins in three hundred days is roughly twenty thousand coins per day of net migration, on top of the network's normal traffic. That is not a spike the fee market can absorb without repricing block space by an order of magnitude. And because post-quantum outputs are larger, each migrated coin consumes more block weight than the coin it replaces. The migration is not a one-for-one transfer of load. It is a transfer that inflates the load as it proceeds. The network would be asked to do more work per coin at the exact moment when the number of coins demanding work is at its maximum. That is the definition of a congestion cascade. THE ASYMMETRY NOBODY PRICES Here is the new insight that the market has not absorbed: the quantum threat to Bitcoin is not symmetric across the network's functions, and this asymmetry creates a strange inversion in the security narrative. Proof-of-work mining is quantum-resistant. SHA-256 is safe. The hash rate, the energy expenditure, the physical security of the consensus mechanism — none of it is threatened by Shor's algorithm. A quantum computer cannot mine Bitcoin faster in any meaningful sense. Grover's quadratic speedup against hashing is real but economically trivial compared to the capital cost of quantum hardware. Signatures are quantum-fragile. ECDSA over secp256k1 falls to Shor's algorithm the moment a sufficiently large fault-tolerant machine exists. So Bitcoin has a quantum-hard consensus layer bolted to a quantum-soft authorization layer. The engine is fine. The key to the engine is the problem. This is a deeply unusual security posture, and it means that the popular framing of 'quantum kills Bitcoin' is exactly backwards. Quantum does not kill Bitcoin's consensus. It threatens Bitcoin's ownership records. Those are different things, and they require different responses. The market, predictably, prices neither. When a quantum-advancement headline lands — a new qubit-count record, a correction-threshold milestone — the reflexive trade is to buy 'quantum-resistant' tokens and sell Bitcoin. That trade is incoherent on the technical merits. Bitcoin's mining layer is the quantum-resistant part. The coins that get sold are the ones whose value depends on the network's continued operation, which is precisely the part quantum does not threaten. Meanwhile, the actual risk — exposure of specific address types — is not a property of the Bitcoin asset at all. It is a property of where the coins are held, and that is invisible to a ticker. I have seen this mismatch between narrative and data before. In 2021, when I compiled a database of fifteen NFT projects with broken IPFS metadata links, the market was pricing the JPEGs and ignoring the provenance layer entirely. Metadata holds the provenance the price ignored, and the same is true here. The public-key exposure status of a Bitcoin address is the provenance layer of its spendability, and the market is not pricing it because there is no ticker for it. This asymmetry also produces a strange political economy inside the network. The constituency with the most influence over protocol upgrades — miners, who signal for soft forks — is the constituency with the least quantum urgency. Their function is safe. The constituency with the most quantum urgency — Taproot users and exchange-held retail — has almost no direct influence over the upgrade process. The people who need the migration are not the people who decide whether it happens. That is not a conspiracy; it is a structural mismatch, and it is the kind of thing that makes decentralized governance slow at exactly the moment speed matters. THE FREEZE QUESTION There is a proposal, mentioned in the reporting, that some developers support freezing vulnerable coins. This is the most dangerous idea in the entire discussion, and it is more threatening to Bitcoin's core value proposition than the quantum computer itself. Consider what freezing means. To freeze a coin is to render it unspendable by its current holder — to declare, by some governance process, that certain outputs are invalid. In a system whose entire selling point is credible neutrality and censorship resistance, this is a constitutional rupture. Who decides which coins are 'vulnerable'? On what evidentiary standard? Enforced by whom, when there is no central operator? The moment Bitcoin's community demonstrates the capacity to invalidate specific coins, it has demonstrated the capacity to invalidate any coins. The precedent is the threat. The legalistic framing here matters. Freezing vulnerable coins is a taking of property by protocol rule change. It creates liability questions that no court has adjudicated because the scenario has never existed: a decentralized network retroactively altering the spendability of specific outputs based on a cryptographic property of the holder's address. The holders of those coins did nothing wrong. They followed the then-best practices. And a future governance vote could strip their property rights in the name of collective security. This is why the Satoshi coins are the ultimate governance trap. They are exposed, they are enormous, they have no owner who can migrate them, and any attempt to freeze or burn them would be the single most consequential precedent in Bitcoin's history. The coins are, in effect, a hostage situation with no hostage-taker. Nobody can move them. Nobody can claim them. And the community cannot agree on whether to neutralize them preemptively or leave them as a permanent quantum target. The freeze proposal also reveals a deeper philosophical fault line. Bitcoin's value proposition has always rested on the claim that no one can take your coins without your private key. A quantum computer does not break that promise — it does not seize coins, it merely makes them stealable by anyone who can run the algorithm. A freeze would break the promise directly, by community fiat. In the effort to defend against a theoretical thief, the network would become the actual thief. That is the trade the proposal implicitly makes, and it is a bad one. WHY COORDINATION FAILURE IS THE REAL THREAT Strip away the quantum mechanics and the report describes a coordination problem dressed as a cryptography problem. The cryptography is settled: ECDSA is vulnerable to Shor's algorithm, and post-quantum signatures are the remedy. What is not settled is how a decentralized network of millions of independent holders, thousands of nodes, hundreds of exchanges, and dozens of custodians executes a simultaneous migration under time pressure with no central authority. I built a correlation matrix during the 2022 collapse that showed the hidden leverage links between Celsius and Three Arrows Capital. The lesson from that exercise was not about any single counterparty. It was that systemic risk lives in the connections, not the nodes. The same is true here. The quantum threat does not act on individual coins. It acts on the network's ability to move them in concert. The vulnerability is the coordination layer, and that layer has never been stress-tested at this scale. Consider the actors and their incentives. Individual holders of unspent P2PKH coins have no urgency. Their coins are hash-protected. The rational move is to do nothing until the threat is imminent — which means they migrate last, into the worst congestion. Taproot users have urgency they may not know about. Their public keys are exposed, but nothing in their wallet tells them so. There is no 'exposure meter' in the standard interface. The information asymmetry between the on-chain reality and the user's awareness is the single largest unaddressed risk in the report. Exchanges hold coins in reused addresses, meaning large pools of user funds are exposed by the platform's operational choices, not the users' choices. Users cannot migrate what they do not custody. The exchange's upgrade timeline becomes the user's security timeline. Custodians and ETF providers hold coins under audit and compliance regimes that were written for a pre-quantum world. Their address hygiene is a black box to the public, and their remediation would be slow by design. Miners are the only major constituency with no quantum urgency, because their function is quantum-resistant. This is the political irony: the group with the most influence over protocol upgrades has the least direct stake in the migration. That last point deserves emphasis. A post-quantum migration would almost certainly require a soft fork at minimum and possibly a hard fork to accommodate signature-size expansion. Miner signaling matters. But miners are not the exposed party. Their incentives are orthogonal to the migration's urgency. You have a situation where the actors who must coordinate have divergent and in some cases opposite interests, and no mechanism to align them short of an existential scare. Chasing the gas fees through the mempool labyrinth is a routine part of my on-chain work, and it has taught me how fee markets behave under stress. During the 2021 NFT minting frenzies, transaction fees spiked by orders of magnitude within minutes as a wave of identical transactions hit the mempool simultaneously. A post-quantum migration triggered by a quantum headline would be that pattern at a scale the network has never seen, multiplied by the signature bloat of post-quantum outputs. The fee market would not clear. It would ration by wealth, and the last coins through the door would be the ones whose holders could not afford the fee — which, in a thirty-percent-of-supply migration, is a lot of coins. WHAT GLASSNODE'S DATA ACTUALLY SHOWS Return to the number. Glassnode's classification puts thirty point two percent of supply — six point zero four million Bitcoin — in the exposed category. That figure is the report's most concrete and most under-discussed asset. It converts a vague threat into a measurable population. But the number needs interpretation, and the market is not doing it. Thirty point two percent is a snapshot, not a forecast. It includes coins that will move tomorrow and coins that will never move. It includes exchange hot wallets that will be upgraded by corporate decision and Satoshi-era coins that will be upgraded by no one. The raw figure overstates immediate risk and understates the coordination challenge, because the composition of the exposed set matters more than its size. The exposure is not evenly distributed across holders. It is concentrated in exactly the populations least equipped to respond: passive long-term holders who adopted Taproot on advice, exchange users who do not control their keys, and the archaeological layer of early coins whose owners may be dead, lost, or simply absent. This is where on-chain forensics earns its keep. A naive analyst sees thirty percent and panics. A forensic analyst asks: of those six million coins, how many are in addresses that have moved in the last year? How many are in exchange clusters? How many are in known Taproot wallets versus legacy P2PK? How many are provably lost? The remediation strategy depends entirely on these sub-classifications, and none of them appear in the headline. I would want to see the exposed supply broken down by last-moved date, by address type, and by cluster attribution. That decomposition would tell you the true migration burden. A coin that moved last month to a Taproot address is a coin whose owner is active and reachable. A coin that has not moved since 2011 in a P2PK output is a coin that no one can migrate. These are not the same risk, and lumping them into a single thirty-percent figure is analytically lazy. The forward-looking signal to watch is therefore not the total exposed figure but its rate of change. If Taproot adoption keeps growing, the exposed share grows even as the total supply is fixed. If a migration begins, the exposed figure should fall. A falling exposed supply would be the first hard evidence that the network is actually responding to the threat rather than debating it. THE CONTRARIAN ANGLE Here is where I will contradict the framing that both the report and the market share. The consensus reading is that the quantum threat is a technology problem awaiting a technology solution — that post-quantum cryptography will arrive, the network will migrate, and the exposure will close. I think this is a category error. The threat is a coordination problem wearing a cryptography costume, and the cryptography is the easy part. Post-quantum signatures already exist. NIST finalized ML-DSA and SLH-DSA in 2024. The algorithms are not the bottleneck. The bottleneck is a decentralized network's inability to execute a simultaneous, time-bounded migration without a central authority, when the affected population is a third of its supply and the actors have misaligned incentives. The correlation-is-not-causation trap here is subtle. A quantum breakthrough headline would not cause a Bitcoin collapse by breaking ECDSA directly. It would cause a collapse by triggering a migration stampede that the fee market cannot absorb, which would then be misread by the market as a fundamental failure of Bitcoin rather than a transient coordination failure. The price would react to the stampede, not the cryptography. And the stampede is a function of the network's structure, not the quantum machine's capabilities. This means the market is pricing the wrong variable. It watches qubit counts. It should watch address hygiene. It watches quantum-advancement news. It should watch Glassnode's exposed-supply breakdown. The event that matters is not the first cryptographically relevant quantum computer. It is the first credible announcement that one is near, because that announcement converts a dormant coordination problem into an active one, and the network's response to that conversion is what determines whether the exposure becomes a loss. There is a second contrarian point. The report's implicit remedy — migrate exposed coins — assumes that migration is safe. It is not, at least not uniformly. A migration reveals new information to the chain. When a Taproot user moves coins to a fresh address, they broadcast a spend that links their exposed address to their new one, creating a transaction graph that did not previously exist. When exchange wallets migrate in bulk, they create identifiable on-chain patterns that analysts and adversaries alike will parse. The act of fixing the exposure creates a new class of exposure: the metadata trail of the migration itself. Privacy and quantum resistance are, in this narrow case, in tension, and the industry has not resolved which it values more. A third contrarian point concerns the harvest-now-decrypt-later model. The report mentions the possibility that adversaries are already collecting exposed public keys and encrypted data, waiting for quantum machines mature enough to decrypt them. On its face this is a forward-looking threat. But applied to Bitcoin, it is almost redundant. Bitcoin's exposed public keys are not being harvested covertly — they are public by design, indexed by every block explorer, and downloadable by anyone. There is nothing to harvest. The 'harvest' already happened the moment the coins landed on an exposed address. The only thing an adversary needs is the future machine, and the archive of targets is sitting in plain sight, freely available, and growing with every Taproot output. This is the darkest implication of the exposure taxonomy: Bitcoin's quantum problem requires no espionage. It requires only patience. THE SYSTEMIC RISK CHECKLIST For readers who hold Bitcoin, here is the checklist I would apply, derived from the same framework I used to build the fund's emergency risk protocols in 2022. First, classify your addresses. If you hold unspent coins in legacy P2PKH or P2SH outputs, your public key is not exposed, and you are in the relatively safe majority. If you hold coins in Taproot key-path outputs that you have never spent, your public key is on-chain, and you are in the exposed set. Most users do not know which category they fall into, and that ignorance is the first risk. Second, check for address reuse. If you have received multiple payments to the same address, or if your exchange reuses deposit addresses, your exposure is higher than your address type alone would suggest. Address reuse is the operational sin that compounds every cryptographic risk. Third, understand your custody. If your coins are on an exchange, your quantum exposure is the exchange's problem to solve, and your security is their upgrade timeline. Long-term holders should weigh the trade-off between custodial convenience and self-custodial control, recognizing that only one of them lets you migrate on your own schedule. Fourth, do not panic-migrate on headlines. The threat is not immediate, and a rushed migration into congestion is worse than a deliberate migration into calm. The report gives no timeline, and the absence of a timeline is itself information: the network has time, and using it well is the whole game. Fifth, track the exposed-supply metric. If Glassnode's exposed figure starts falling, the network is responding. If it keeps rising with Taproot adoption, the network is accumulating a coordination liability that will eventually demand resolution. Sixth, watch the governance signals, not the price. The relevant question is not whether Bitcoin trades higher this quarter. It is whether Bitcoin Core developers converge on a migration path, whether miners signal for it, and whether exchanges commit to address upgrades. Those are the variables that determine whether the exposure becomes a managed transition or a forced crisis. TAKEAWAY The quantum threat to Bitcoin is real but mislocated. The danger is not that a quantum computer will appear and empty exposed wallets overnight. The danger is that a credible announcement will force a migration that the network's coordination layer cannot absorb, and that the resulting chaos will be mistaken for a failure of Bitcoin itself. The cryptography is solved. The coordination is not. And the thirty point two percent — six point zero four million coins, half a trillion dollars of exposed supply — is the measure of how much work remains. Watch the address-type breakdown, not the qubit count. The signal that matters is the one Glassnode is already publishing, and almost no one is reading it.