Public-key exposure is central to the threat. According to a crypto.news report dated October 9, 2026, Fireblocks Vice President of Research Michael Gutkin pointed to public estimates indicating that between 6.7 million and 7 million $BTC are held behind keys that are already exposed onchain. “Exposure ultimately comes down to whether the public key is already visible onchain,” he said.
Bitcoin’s post-quantum readiness starts with exposed keys
BIP 360’s authors note that an exposed public key could allow a sufficiently powerful quantum computer to work out the corresponding private key. They distinguish attacks against long-visible keys from faster attacks in the window between a transaction revealing its key and its confirmation.
Older pay-to-public-key outputs expose keys immediately. Gutkin explained that pay-to-public-key-hash and native SegWit addresses hide them until spending; receiving more funds at a previously spent address leaves those funds behind an exposed key. Taproot output keys are visible from creation.
The company’s proposed preparation extends beyond signatures: protect existing and newly created funds, fit scarce block space, preserve independent full-node validation, and support both institutional custody and ordinary wallets. Gutkin recommends fresh deposit and change addresses, alongside continuous tracking of exposed balances.
Hybrid spending paths and the state-management problem
A 1-of-2 hybrid construction would give the same funds alternative spending paths: one using a classical ECDSA/Schnorr key, the other a post-quantum key. The company supports evaluating staged protection before settling legacy-signature policy.
It also favors an output design that can introduce, replace or supplement signature algorithms without a complete redesign. P2MR under BIP 360 and P2TRv2 appear to offer that flexibility. Gutkin cautioned that BIP 360 reduces long-term key exposure but is not complete quantum protection; attacks before confirmation may still require post-quantum signatures.
Stateful signatures offer potential size and speed advantages, but reusing signing state can allow immediate forgery. Blockchain history cannot reliably reconstruct that state because not every signature or update reaches the chain.
For distributed custody servers, stateful signing requires exclusive access to a key and its state during signature generation. Failed updates and backup recovery complicate safe operation. The company recommends clear wallet guidance and a stateless fallback.
Signature selection must work for nodes and custodians
Bitcoin-specific evaluation must consider signature and key sizes, verification speed, security assumptions, implementation maturity and multi-party computation, or MPC, compatibility. Bitcoin signatures remain stored and are verified by every node, so generic rankings do not translate directly.
The company proposes evaluating ML-DSA, SLH-DSA, FN-DSA when standardized, and alternatives with different security assumptions. By pairing a compact, stateful FXMSS pathway with a stateless fallback derived from SLH-DSA, SHRINCS raises key questions about recovery mechanisms and implementation reliability that will shape its adoption.
Other tests include side-channel resistance, random-number dependence, signing throughput, hardware support, block capacity, fees, validation load and migration cost. Effective MPC protects against key theft; the company wants at least one promising MPC-compatible option.
In a September 23, 2026 report cited by crypto.news, Chief Cryptographer Yehuda Lindell described exploring programmable hardware security modules for cases when a blockchain’s chosen signature scheme cannot work with existing distributed-signing systems.
Legacy funds require a separate migration debate
Dormant, lost and exposed Bitcoin funds require distinct governance and engineering solutions. The company identifies permanently exposed keys, reused addresses, inaccessible seeds and legitimately controlled dormant holdings as different cases.
It says rescue proposals should demonstrate that their recovery path is quantum-safe and unusable by an attacker who knows only an exposed public key. Bitcoin’s post-quantum readiness also involves balancing exposure protection, usability, privacy, fees, script flexibility and implementation complexity.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
