Glassnode: Exchanges Hold 6M Bitcoin with Exposed Keys

Glassnode’s on-chain analysis finds about 6.04 million Bitcoin, equal to 30.2% of the circulating supply, are held in addresses where public keys have already been revealed. The firm reports that roughly half of labeled Bitcoin balances held by exchanges fall into the exposed category.

The exposure metric Glassnode uses identifies addresses where a public key was published on-chain after a transaction signature. When a public key is published, any remaining funds in that address are visible on the blockchain and could be recoverable if future quantum hardware can break Bitcoin’s signature scheme.

Glassnode separates exposures into operational and structural categories. Operational risk, tied to practices such as address reuse and not rotating change outputs, accounts for about 4.12 million Bitcoin. Exchanges are a major source of operational exposure, holding an estimated 1.66 million exposed Bitcoin, a share that Glassnode equates to more than 8% of total issued supply.

The share of exchange-held Bitcoin Glassnode classifies as operationally safe has fallen over time, from roughly 55% in 2018 to about 45% today. The firm links that decline to expanding wallet infrastructure and deposit systems that have not consistently rotated addresses.

Exposure varies sharply across labeled platforms. Glassnode shows Binance with about 85% of its labeled Bitcoin balances in addresses where public keys are revealed. Bitfinex, Crypto.com, and Gemini appear in the dataset with 100% of labeled balances exposed. Coinbase’s labeled reserves show exposure on roughly 5% of balances. Custodians tied to ETFs and institutional services also vary: Fidelity’s labeled holdings show about 2% exposure, Grayscale about 50%, and WisdomTree about 100%. Retail platforms differ as well, with Block’s Cash App aligned with lower exposure levels while Robinhood and Revolut show near-complete exposure in labeled wallets.

Wallets associated with several governments show higher cryptographic hygiene in Glassnode’s measurements. Addresses linked to the United States, the United Kingdom, and El Salvador register safety rates above 99% and effectively zero exposure in the firm’s dataset.

Glassnode and other analysts note that quantum computers capable of breaking Bitcoin’s signature scheme do not yet exist at the necessary scale, so exposed public keys do not represent an immediate breach. The on-chain publication of public keys, however, makes specific exposure points visible today.

Glassnode points to operational mitigations custodians can apply without changing Bitcoin’s consensus rules. These include moving remaining balances out of addresses that have published public keys, retiring used addresses, avoiding address reuse, and altering systems to manage change outputs more securely.

A protocol-level transition to post-quantum signatures would require coordination among developers, miners, node operators, wallet providers and custodians and is expected to take years. Glassnode’s framework highlights which wallets and addresses would be most relevant in any future scenario where quantum hardware can defeat current cryptography.