Quantum computers and Bitcoin, calmly
Bitcoin signatures rely on elliptic-curve cryptography. Today it is practically impossible to work backwards from a public key to the private key that controls the coins. A sufficiently large, fault-tolerant quantum computer running Shor’s algorithm could in principle do this. No such machine exists, and estimates of when one might range from many years to never — but because blockchain data is permanent, it is sensible to understand where public keys are already visible.
When is a public key exposed?
- Pay-to-public-key (P2PK), used in Bitcoin’s earliest years (including many early mined coins), puts the public key directly on-chain. Always exposed.
- Taproot (bc1p…) addresses contain a tweaked public key directly. Exposed as soon as the address is known.
- Legacy (1…) and native SegWit (bc1q…) addresses only contain a hash of the public key. The key is revealed the first time coins are spent from the address. If the address is then reused and still holds coins, those coins sit behind a public key everyone can see.
- Script addresses (3…, long bc1q…) reveal their script when spent. Whether that exposes public keys depends on the script — for wrapped SegWit and typical multisig, it does.
Short-range vs long-range exposure
Every spend briefly reveals a public key while the transaction waits for confirmation. Attacking that window would require a very fast quantum computer. Coins that sit for years on an already-exposed key are a bigger theoretical target, which is why avoiding address reuse matters.
What you can do
Use a fresh address for every payment, which almost all modern wallets do automatically. If you hold funds on an address that has already been spent from, consider moving them to a fresh address when fees are low. Follow proposals such as BIP-360 for quantum-resistant outputs; if Bitcoin adopts one, moving to it will be the real long-term fix. And be wary of anyone using quantum fears to rush you into sending them coins.
Worked example
Imagine a bc1q address that received 0.5 BTC, then spent 0.2 BTC, with the remaining 0.3 BTC sent back to the same address as change. The first spend revealed its public key, so the tool reports it as exposed and notes 0.3 BTC remaining on a reused address. A different bc1q address that has only ever received coins shows as not revealed by this address’s own history — an amber result, not an all-clear, because the same key could have been revealed somewhere else. The genesis-block address 1A1zP1… is a famous case: it was never spent from, yet its public key is on-chain in the block-0 pay-to-public-key output, so the tool reports it as exposed. Any bc1p Taproot address shows as exposed, because its key is part of the address.
Frequently asked questions
Can a quantum computer steal bitcoin today?
No. No existing quantum computer comes anywhere near breaking the elliptic-curve cryptography Bitcoin uses. This tool is about understanding long-term exposure, not an imminent threat.
Why does spending from an address reveal the public key?
Legacy and SegWit addresses commit only to a hash of the public key. To spend, you must show the actual public key and a signature, so it becomes visible on the blockchain forever.
Why is Taproot always shown as exposed?
A Taproot address encodes a (tweaked) public key directly, rather than its hash. This was a deliberate design trade-off for efficiency and privacy. It means the key is visible as soon as the address is known.
Does it work on Signet or Testnet4?
Yes. Pick the network above the form. Test-network results use mempool.space’s Signet or Testnet4 explorer and involve test coins with no value.
Is a never-spent bc1q address completely safe?
Not necessarily. Its own history does not reveal the public key, which is why the result is amber rather than green. But the same key could have been used in another output type (such as an early pay-to-public-key output), and it can be revealed elsewhere, for example if you shared an extended public key (xpub) with a service or signed a message. This tool checks a list of early P2PK keys (blocks 0–999), but no list can be complete. And when you do spend, the key becomes visible while the transaction waits to confirm.
What is BIP-360?
BIP-360 is a proposal to add a new output type designed to make Bitcoin more resistant to future quantum attacks. It is still under discussion; follow it if you care about long-term preparedness.
Should I move my coins now?
There is no need to panic. Good practice is to avoid address reuse, and to move funds sitting on an address whose key is already exposed to a fresh address when it is convenient and fees are low.