How Much ETH Is Quantum Exposed? The 55% Problem Bitcoin Doesn't Have

Is Ethereum More Vulnerable to Quantum Computers Than Bitcoin?

Yes. Roughly 55 to 60 percent of all ETH value is in addresses that have already sent at least one transaction. Every one of those addresses has its public key permanently on-chain. Bitcoin protects roughly 70 percent of its supply behind cryptographic hashes. Ethereum has no equivalent protection. The structural gap between the two networks is large, underreported, and cannot be patched retroactively.

This is not a hypothetical future concern. Every ETH address that has ever sent a transaction is already in a state where a sufficiently powerful quantum computer could derive its private key without any further action from the user. The public key is on-chain right now.

To understand why, you need to understand how the two networks handle public key exposure differently at the protocol level — and why that difference compounds the quantum risk for ETH holders in a way that Bitcoin largely avoids.

Where Does the 55% Figure Come From?

The 55 to 60 percent estimate for quantum-exposed ETH is not a single authoritative study number — it is derived from on-chain analytics of Ethereum's account activity weighted by balance. Here is the methodology behind the figure.

Ethereum's state database contains approximately 230 million addresses with non-zero ETH balances as of mid-2026. Of these, on-chain transaction records indicate that roughly 190 to 200 million addresses have sent at least one outgoing transaction. Each of those sending addresses has its secp256k1 public key permanently recorded in the Ethereum transaction history, recoverable via the ecrecover function from any transaction they have signed.

The critical insight is that raw address counts are not the right metric — balance-weighted exposure is. The distribution of ETH is highly concentrated. A small number of high-balance addresses hold a disproportionately large share of total ETH value, and those addresses are overwhelmingly active wallets. Institutional custodians, whale wallets, DeFi power users, and staking participants have all sent transactions. Dormant addresses that have never transacted tend to hold smaller average balances.

When on-chain balance data from Glassnode, Dune Analytics, and independent academic studies is weighted by current ETH holdings rather than address count, the exposed share of ETH value consistently falls in the 55 to 65 percent range. The academic work of Stewart et al. (2023) "Assessing the Quantum Risk to Bitcoin Addresses" and subsequent Ethereum-specific analyses use similar methodology and arrive at comparable figures. NIST IR 8547's framing of the ECDSA deprecation problem implicitly acknowledges this scale of exposure across all ECDSA-dependent systems.

A conservative working figure of 55 percent of ETH value quantum-exposed is well-supported. The true number could be higher if concentrated institutional wallets have all transacted, which available data suggests they have.

How Ethereum's Account Model Works — and Why It Leaks Public Keys

Ethereum uses an account model. Every address on the network has a persistent balance, nonce, and state. When you send a transaction from an Ethereum address, the transaction includes your ECDSA signature over the transaction data. From that signature, the Ethereum network recovers and verifies your public key using the ecrecover function.

That recovered public key gets used to confirm the transaction is valid. The signature, and therefore your public key, is permanently recorded in the transaction data on-chain. Anyone can look at any transaction from your address and extract the full secp256k1 public key. It has been there since your first outgoing transaction.

This is not a bug. It is how Ethereum's signature verification was designed. There is no way to send a transaction on Ethereum without exposing your public key. Zero exceptions. That includes simple ETH transfers, DeFi interactions, NFT purchases, contract deployments, and every other on-chain action an Ethereum account can take.

How Much ETH Is Quantum Exposed?

Approximately 55 to 60 percent of all ETH value — roughly 60 to 65 million ETH at current issuance levels — sits in addresses that have sent at least one outgoing transaction. These addresses have their public keys permanently on-chain. Every single one of them is quantum-exposed in the full sense: a powerful enough quantum computer could steal the funds without the owner doing anything further.

For DeFi specifically, the exposure is effectively 100 percent. Every address that has interacted with a smart contract has sent at least one transaction, revealing its public key. Uniswap users, Aave borrowers, Compound depositors, liquid staking protocol participants — all quantum-exposed, by definition.

Grover's algorithm also matters here: it provides a quadratic speedup for searching hash preimages. But Grover's speedup on keccak-256 is currently considered manageable — the effective quantum security remains around 128 bits. That is far safer than the elliptic curve vulnerability, which Shor's algorithm eliminates entirely.

Bitcoin's Different Architecture: Why ~70% of BTC Has a Quantum Safety Window

Bitcoin uses a UTXO model. Every unspent output locks funds to a specific spending condition. The most common conditions in use today are P2PKH (pay-to-public-key-hash) and P2WPKH (pay-to-witness-public-key-hash). In both formats, the locking condition commits only to a hash of the public key — not the key itself.

When you want to spend a P2PKH or P2WPKH output, you reveal the full public key in the transaction's unlocking script. At that moment, the public key is on-chain. But until you spend, the public key is hidden behind a hash. A quantum attacker would need to invert a 160-bit hash function to derive the public key from just the address — a problem that even quantum computers cannot efficiently solve with current or projected hardware.

This is the quantum safety window. Bitcoin outputs in P2PKH or P2WPKH format, in addresses that have never been used as a sender, retain this window. According to recent academic research on Bitcoin quantum vulnerability, approximately 6 to 6.9 million BTC are meaningfully quantum-exposed right now. That includes roughly 1.1 million BTC in Satoshi-era P2PK outputs — the original P2PK format that writes the full public key directly into the output script, with no hash protection at all. And P2PKH and P2WPKH addresses that have previously sent transactions.

The remaining roughly 70 percent of circulating BTC supply sits in addresses that have never been used as senders. These outputs retain their quantum safety window. Ethereum has no equivalent to this 70 percent protected pool.

The Quantum Exposure Comparison: Bitcoin vs Ethereum vs QuanChain

The table makes the structural asymmetry clear. Bitcoin's P2PKH design creates a meaningful quantum safety window for unspent outputs. Ethereum's account model eliminates that window the moment a user first transacts.

When Does the 55% Exposure Become a Real Problem? The Timeline

The 55 percent exposure figure is a present fact. The question is when a quantum attacker gains the hardware capability to exploit it. The timeline involves two distinct thresholds.

Harvest threshold (already passed): The point at which adversaries begin archiving public keys for future attacks. This requires no quantum hardware at all — just data storage. Nation-state adversaries almost certainly passed this threshold years ago. The entire Ethereum transaction history is publicly downloadable and contains every exposed public key in plaintext. Any organization with sufficient storage is already holding the data needed for future quantum attacks.

Attack threshold (estimated 2030–2038): The point at which quantum hardware can derive a private key from a secp256k1 public key in a practically relevant timeframe — hours to days rather than years. This requires a fault-tolerant quantum computer with approximately 2,330 logical qubits (Webber et al., 2022). Converting to physical qubits at current surface code overhead (approximately 1,000:1) requires roughly 2.3 million high-quality physical qubits. The best public systems in 2026 have hundreds to low thousands of physical qubits with non-fault-tolerant error rates. The most optimistic credible estimates for a cryptographically relevant machine are 2029–2032. The median estimate is 2033–2038. The wide range reflects genuine uncertainty in quantum hardware scaling trajectories.

The gap between now and the attack threshold is the migration window. ETH holders with exposed addresses need to move funds before the attack threshold is reached. The harvest-now-decrypt-later threat means that adversaries are already positioned; the only question is when they become capable of acting on that positioning.

What Ethereum's Roadmap Says About This Problem

Ethereum's founder has not been silent on this issue. Vitalik Buterin has publicly discussed the quantum exposure problem created by the account model. EIP-7702, included in the Pectra upgrade deployed in May 2025, is partly a response. EIP-7702 allows externally owned accounts (EOAs) to temporarily delegate transaction signing to a smart contract, opening a path for post-quantum algorithms — but it does not protect the millions of existing EOA addresses that have already sent transactions.

Dedicated EVM precompiles for ML-DSA or SLH-DSA have been proposed but not yet scheduled for any Ethereum upgrade. The timeline for full PQC migration is post-2027 at earliest, and realistic timelines stretch to 2030 and beyond.

NIST IR 8547 explicitly warns that organizations depending on ECDSA should begin migration planning immediately. The NIST recommended migration timeline does not accommodate a post-2030 transition gracefully for systems that signed commitments in 2020–2024.

The Irreversible Exposure Problem

Here is the element of this problem that gets the least attention: even a successful Ethereum post-quantum upgrade does not protect already-exposed addresses.

When your ETH address sent its first transaction in 2018, 2020, or 2023, your public key was written permanently to Ethereum's transaction history. The Ethereum blockchain is immutable. That transaction data will exist forever. When Ethereum eventually deploys post-quantum signature verification, it will enable future transactions to use quantum-resistant algorithms. It will not erase the past.

A quantum attacker in 2035 can look up every Ethereum address that has ever sent a transaction, extract the public key from the transaction history, and run Shor's algorithm against it. The fact that Ethereum has by then adopted ML-DSA for new transactions is irrelevant. The old public key is already on-chain. The old funds at that address are still vulnerable.

The only way to protect funds in a currently-exposed ETH address is to move them to a new address that uses post-quantum signing — before a quantum attacker reaches sufficient capability.

Migration Steps for ETH Holders with Exposed Addresses

There is no perfect migration path available today because Ethereum does not yet support post-quantum signature verification natively. The following steps represent the best available risk-reduction strategy given current protocol capabilities.

• Step 1 — Identify exposure: Use Etherscan or a similar block explorer to check each address you hold ETH or ERC-20 tokens in. If the address has any outgoing transaction history, mark it as exposed. The exact date of first transaction is irrelevant — the key is whether an outgoing transaction exists at all.
• Step 2 — Create fresh receive-only addresses: Generate new Ethereum addresses that have never sent transactions. Move high-value holdings to these addresses. Treat them as cold storage: do not interact with DeFi, do not approve token contracts, do not send from them. Each interaction permanently ends the quantum safety window for that address.
• Step 3 — Prioritize high-balance addresses: Focus migration effort on addresses with the largest ETH and ERC-20 balances first. An attacker optimizing for value will target high-balance addresses with exposed public keys before smaller addresses.
• Step 4 — Handle ERC-20 approvals carefully: ERC-20 approval transactions are outgoing transactions. If you have existing approvals from a fresh address, revoke them through a separate address if possible — any interaction from your "fresh" address will expose its key.
• Step 5 — Monitor EIP-7702 wallet support: When MetaMask and other wallets ship EIP-7702 delegation support with PQC verifiers, this will provide post-quantum protection for new transactions from fresh addresses. Keep wallet software updated and watch for PQC-specific release announcements.
• Step 6 — Consider quantum-native chains for new activity: For new assets and new DeFi activity, chains using NIST-standardized post-quantum signatures at the base layer eliminate the exposure problem structurally. ML-DSA (CRYSTALS-Dilithium) is the NIST-standardized algorithm for blockchain-appropriate post-quantum signing.

DeFi Amplifies the Exposure Problem

The DeFi context makes this worse. The majority of ETH value in DeFi protocols — Uniswap liquidity positions, Aave collateral, Lido stETH, Rocket Pool rETH, Maker Vault positions — comes from addresses that have actively interacted with those protocols. Every interaction is an outgoing transaction. Every outgoing transaction reveals the public key.

Smart contracts themselves add another layer. Many DeFi protocols are controlled by multisig governance or protocol-owned contract addresses. The human-controlled governance keys that can upgrade or drain those contracts have almost certainly sent transactions — meaning those governance keys are quantum-exposed. A quantum attacker could potentially compromise governance keys and drain protocol treasuries, not just individual wallets.

New ETH Addresses: A Misunderstood Safe Harbor

One nuance that most coverage gets wrong: new Ethereum addresses that have never sent a transaction are not quantum-exposed in the same sense.

An Ethereum address is the last 20 bytes of the keccak-256 hash of the public key. If an address has never sent a transaction, its public key has never been published on-chain. A quantum attacker looking at that address sees only the 20-byte hash. They cannot invert keccak-256 to recover the public key — that would require approximately 128 bits of quantum effort using Grover's algorithm, far beyond practical attack.

But this safe harbor has a catch. The moment you use that address to send anything, the public key is exposed and the protection is gone forever. In practice, ETH is useful only when you can spend it. A wallet you can only receive to and never spend from is not a functional wallet for most users. Bitcoin's UTXO model makes it natural to rotate addresses with each spend. Ethereum's account model has no equivalent — your address is fixed, and public key exposure is permanent after your first send.

How QuanChain Solves This at the Architecture Level

QuanChain was built to eliminate this class of problem entirely. The network uses ML-DSA-87 (CRYSTALS-Dilithium) as its signature scheme — standardized by NIST in FIPS 204. ML-DSA is designed to be secure against quantum computers running Shor's algorithm. There is no classical ECDSA on QuanChain. The secp256k1 vulnerability does not exist in QuanChain's stack.

Beyond the signature algorithm, QuanChain's SpendAndRotate mechanism further limits key exposure per transaction. Every time a QuanChain account sends a transaction, the key material rotates atomically in the same operation. The old key is invalidated. The new key is installed. An attacker who records today's public key and gains quantum capability in five years will find that key is already retired — it no longer controls any funds. This design eliminates the irreversible exposure problem that affects Ethereum's 55 percent exposed address pool entirely.