Quantum exposure of the 100 richest Bitcoin addresses

Name: Quantum exposure of the 100 richest Bitcoin addresses, 2026-09-03
Creator: ShorWatch
License: https://creativecommons.org/licenses/by/4.0/

We took the hundred largest Bitcoin balances on the chain and asked one question of each: is the public key already visible, or only its hash? The answer for two thirds of them is that the key is out, and almost none of it is because of Taproot.

Gerard SalaSnapshot 3 September 2026, block 965,290Updated monthly

3,132,958 BTC

held by the top 100 addresses · 15.6% of all bitcoin · ≈ $243.7B

67 of 100

addresses have their public key on-chain, holding 2,239,681 BTC · ≈ $174.2B

33 of 100

show only a hash and have never spent, holding 893,278 BTC

65 vs 2

of the exposed addresses are exposed by address reuse versus by Taproot

Exposed 2,239,681 BTC · 71.5%Protected 893,278 BTC · 28.5%

What the numbers say

Address reuse, not Taproot, is where the large balances are exposed. Of the 67 exposed addresses, 65 are hashed address types that have spent at least once, which put their public key (or their full script, for multisig) on the chain permanently. Only 2 of the hundred are Taproot outputs. Public discussion of Bitcoin's quantum exposure tends to focus on Taproot because it exposes the key by design; among the largest holders, the old habit of sending to the same address again and again matters far more.

The exposed set is dominated by custodial cold wallets. 14 of the exposed addresses carry a public label that points to an exchange or a stablecoin issuer (Binance, Bitfinex, Coincheck, Crypto.com, OKEx, Robinhood, Tether). These are addresses that receive deposits continuously and have spent many times: reuse is how they operate. That concentration is a double-edged fact. It means a relatively small number of organisations control a large part of the exposed balance, and could move it in a few transactions if they chose to. It also means that their customers' quantum exposure is decided by the custodian's address hygiene, not their own.

Much of the “protected” balance is protected only because it cannot move. 6 of the 33 protected addresses are publicly labelled as hack proceeds, recovered or confiscated funds, or the remains of Mt. Gox. They have never spent because nobody who can spend them has done so. They are safe at rest in the narrow sense that matters here, and they illustrate the point made in our BIP-360 article: coins whose owners are gone or constrained will not migrate anywhere on their own.

This is a snapshot, and it will change. Large wallets rotate. A protected address in this table becomes exposed the day it spends, and an exposed one drops out of the list the day it is emptied into a fresh address. We will re-run the analysis monthly and keep the history.

By address type

Type	Addresses	Balance	Exposed	Exposed balance
Legacy (1…)	38	765,898 BTC	24	394,634 BTC
Script hash (3…)	20	889,603 BTC	15	761,061 BTC
Native SegWit (bc1q…, 42 chars)	31	951,566 BTC	18	569,594 BTC
SegWit script (bc1q…, 62 chars)	9	495,432 BTC	8	483,932 BTC
Taproot (bc1p…)	2	30,460 BTC	2	30,460 BTC

Taproot barely appears among the largest balances: custodians have not adopted it for cold storage. Every other row is exposed by spending. For the script types (3… and the long bc1q…), a spend reveals the redeem script, which for a multisig means every key in it.

The full list

Ranked by balance at the snapshot. Labels are the ones commonly published by public block explorers; we have not verified them and they may be wrong. Click an address to see it on mempool.space.

#	Address	Label	Type	BTC	Status	Why
1	34xp4vRoCG…4Twseo	Binance coldwallet	P2SH	248,598	Exposed	Has spent
2	3M219KR5vE…DjxRP6	Binance coldwallet	P2SH	219,060	Exposed	Has spent
3	bc1ql49yda…8859v2	Robinhood coldwallet	P2WPKH	140,850	Exposed	Has spent
4	bc1qgdjqv0…jwvw97	Bitfinex coldwallet	P2WSH	130,010	Exposed	Has spent
5	bc1qjasf9z…fc27a4	Tether	P2WSH	96,932	Exposed	Has spent
6	bc1qazcm76…uxwczt	Bitfinex Hack Recovery	P2WPKH	94,643	Protected	Never spent
7	bc1qd4ysez…gv4rzr	—	P2WSH	91,850	Exposed	Has spent
8	1FeexV6bAH…9sb6uF	MtGox Hack	P2PKH	79,957	Protected	Never spent
9	bc1q8yj0he…5qst4g	—	P2WPKH	78,317	Protected	Never spent
10	1Ay8vMC7R1…AbguJP	Mr.100	P2PKH	73,917	Exposed	Has spent
11	bc1qa5wkga…ek9hz6	SilkRoad FBI Confiscated	P2WPKH	69,370	Protected	Never spent
12	3LYJfcfHPX…YKzexb	Binance BTCB Reserve	P2SH	68,200	Exposed	Has spent
13	bc1q0ymzks…dev3rt	—	P2WPKH	64,658	Exposed	Has spent
14	3MgEAFWu1H…rP5pgd	OKEx	P2SH	55,905	Exposed	Has spent
15	1LdRcdxfbS…fBEQeC	—	P2PKH	53,880	Protected	Never spent
16	1AC4fMwgY8…MSdmtA	—	P2PKH	51,830	Protected	Never spent
17	bc1qws342r…gkcufy	—	P2WPKH	48,670	Exposed	Has spent
18	1LruNZjwam…kkc5os	—	P2PKH	44,000	Protected	Never spent
19	bc1q0j55cu…n4n0su	—	P2WPKH	42,791	Exposed	Has spent
20	bc1q4j7fcl…3qfgpr	Coincheck	P2WSH	42,424	Exposed	Has spent
21	bc1qy3uw2k…u8vha3	—	P2WPKH	39,484	Exposed	Has spent
22	bc1qa2eu6p…0qjg0e	—	P2WSH	38,194	Exposed	Has spent
23	3LQUu4v9z6…o1FW6a	Binance coldwallet	P2SH	37,927	Protected	Never spent
24	bc1q7ydrtd…mxjkug	UK Gov Confiscated	P2WPKH	36,000	Protected	Never spent
25	1EoGpcfUVY…w3PJFM	—	P2PKH	34,902	Exposed	Has spent
26	bc1qeh5e4n…944qvt	—	P2WSH	33,437	Exposed	Has spent
27	bc1qukw69m…62rhlk	—	P2WPKH	32,467	Exposed	Has spent
28	bc1qx9t2l3…xwdrp4	Binance Pool	P2WPKH	31,643	Exposed	Has spent
29	3FHNBLobJn…5PT61B	Binance coldwallet	P2SH	31,275	Protected	Never spent
30	12ib7dApVF…iAN1dr	967	P2PKH	31,000	Exposed	Has spent
31	bc1q8taf2e…szghzk	—	P2WSH	30,800	Exposed	Has spent
32	12tkqA9xSo…YEBqkv	—	P2PKH	28,151	Protected	Never spent
33	bc1q6h2v33…n2qu06	—	P2WPKH	27,603	Exposed	Has spent
34	3EMVdMehEq…sSz9A9	—	P2SH	26,984	Exposed	Has spent
35	3FsDiWdG76…aLrtxL	—	P2SH	26,916	Protected	Never spent
36	39eYrpgAgD…1ikBYw	—	P2SH	26,062	Exposed	Has spent
37	1N7jWmv63m…q1u8Yp	—	P2PKH	24,052	Protected	Never spent
38	15cHRgVrGK…LcnHxv	—	P2PKH	23,600	Exposed	Has spent
39	bc1qr4dl5w…0lk7a9	Crypto.com coldwallet	P2WPKH	22,721	Exposed	Has spent
40	bc1qs4z2d3…j9vfg3	—	P2WPKH	21,334	Exposed	Has spent
41	bc1qx2x5cq…jtpd9l	Bitbank coldwallet	P2WSH	20,283	Exposed	Has spent
42	17rm2dvb43…6yeNRn	—	P2PKH	20,008	Exposed	Has spent
43	1PeizMg76C…zU5zGW	—	P2PKH	19,414	Protected	Never spent
44	bc1q72nyp6…2wuweu	—	P2WPKH	18,160	Exposed	Has spent
45	bc1p6mv2d3…zsruxt	—	P2TR	17,960	Exposed	Taproot
46	bc1qyt5gsr…f4xwup	—	P2WPKH	16,350	Protected	Never spent
47	34HpHYiyQw…ZnBeBP	Binance coldwallet	P2SH	16,307	Protected	Never spent
48	38rFtDdFpX…5Xms2E	—	P2SH	16,116	Protected	Never spent
49	1PJiGp2yDL…k6XEiw	Binance coldwallet	P2PKH	15,785	Exposed	Has spent
50	1GR9qNz7zg…bsieCG	—	P2PKH	15,746	Exposed	Has spent
51	3JZq4atUah…9rF97j	Bitfinex coldwallet	P2SH	15,496	Exposed	Has spent
52	1BAuq7Vho2…CmWQkD	—	P2PKH	15,000	Exposed	Has spent
53	36X44rmLtk…6dQ2n3	—	P2SH	14,645	Exposed	Has spent
54	1CNtkWbb4g…PHgzA8	—	P2PKH	14,236	Exposed	Has spent
55	3FM9vDYsN2…UxhbJ3	OKEx	P2SH	13,835	Exposed	Has spent
56	3KZbyboy2M…Yvso22	—	P2SH	13,589	Exposed	Has spent
57	bc1qsg6x2c…8vcp8w	—	P2WPKH	13,514	Exposed	Has spent
58	bc1qlt5nm3…cu4na0	—	P2WPKH	13,299	Exposed	Has spent
59	3GPAWK5aUB…bhFbay	78163677	P2SH	13,158	Exposed	Has spent
60	bc1qvrwzs8…3y6tp8	—	P2WPKH	13,108	Protected	Never spent
61	39gUvGynQ7…nLFPMN	—	P2SH	13,077	Exposed	Has spent
62	bc1q4vxn43…z38lwa	UK Gov Confiscated	P2WPKH	13,003	Protected	Never spent
63	bc1p4zxtwg…840aqm	—	P2TR	12,500	Exposed	Taproot
64	bc1qkmk4v2…3p3y0s	Bitfinex Hack Recovery	P2WPKH	12,267	Protected	Never spent
65	bc1q7uq3u8…3ew69f	—	P2WPKH	11,897	Exposed	Has spent
66	3CEPCFAXw1…tYo6t2	—	P2SH	11,603	Exposed	Has spent
67	3NWndKFmvV…Avr27H	—	P2SH	11,597	Exposed	Has spent
68	18F838WD5o…SNq9R8	—	P2PKH	11,510	Exposed	Has spent
69	bc1qvckrfw…6zdp2s	—	P2WSH	11,500	Protected	Never spent
70	bc1qm34lsc…j77s3h	Binance wallet	P2WPKH	10,790	Exposed	Has spent
71	1F34duy2ee…snAyWC	—	P2PKH	10,771	Protected	Never spent
72	bc1qatjx2q…xz8km3	—	P2WPKH	10,502	Exposed	Has spent
73	bc1qxlth5h…5shuud	—	P2WPKH	10,500	Protected	Never spent
74	12VuUfQHTG…hjGEzN	—	P2PKH	10,312	Exposed	Has spent
75	14FEEMRhaU…9nc9eq	—	P2PKH	10,306	Protected	Never spent
76	1Q8QR5k32h…MWhdv9	Binance Pool	P2PKH	10,217	Protected	Never spent
77	bc1qsxdxm0…5nhhtq	—	P2WPKH	10,002	Protected	Never spent
78	1Ki3WTEEqT…5mdCXT	—	P2PKH	10,000	Protected	Never spent
79	1DzsfLRDfb…mciBSB	—	P2PKH	10,000	Exposed	Has spent
80	1GUfWdZQoo…Y5ueTm	—	P2PKH	10,000	Exposed	Has spent
81	12HnxiXEeK…5LdGCt	—	P2PKH	10,000	Exposed	Has spent
82	17uULjz9mo…hY3Jia	—	P2PKH	10,000	Exposed	Has spent
83	18qNs1yBGG…PfixhS	—	P2PKH	10,000	Exposed	Has spent
84	1DP3VYwN6o…Xfaewi	—	P2PKH	10,000	Exposed	Has spent
85	1NhJGUJu8r…AwdLwJ	—	P2PKH	10,000	Exposed	Has spent
86	1MtUMTqtdr…tssej5	—	P2PKH	10,000	Exposed	Has spent
87	1MewpRkpcb…9Succy	—	P2PKH	10,000	Exposed	Has spent
88	1H2MXWiSni…1ic4kP	—	P2PKH	10,000	Exposed	Has spent
89	1CY7fykRLW…dvW923	OKX	P2PKH	10,000	Protected	Never spent
90	162bzZT2hJ…D6rHhw	gate.io coldwallet	P2PKH	9,901	Exposed	Has spent
91	bc1qxkhwkn…6wc7p6	—	P2WPKH	9,800	Protected	Never spent
92	bc1q9d5lq9…cccew8	—	P2WPKH	9,621	Exposed	Has spent
93	bc1q8urxlm…pqseu4	98590549	P2WPKH	9,591	Exposed	Has spent
94	bc1qd46j77…2rt9ly	—	P2WPKH	9,500	Protected	Never spent
95	1P9fAFAsSL…WTy9N8	—	P2PKH	9,425	Protected	Never spent
96	1LVYbnSX6f…zkqaay	—	P2PKH	9,375	Exposed	Has spent
97	17MWdxfjPY…81r1rn	—	P2PKH	9,343	Exposed	Has spent
98	1HLvaTs3zR…g6XYJT	—	P2PKH	9,260	Protected	Never spent
99	33eU1zeB2S…tMrMtZ	82375777	P2SH	9,252	Exposed	Has spent
100	bc1qukqenm…yxn079	—	P2WPKH	9,112	Protected	Never spent

Method

The set of addresses is the hundred largest balances as listed by public rich lists on 3 September 2026. Balances in this report are not taken from those lists: every address was re-queried against the public mempool.space API and re-ranked by the balance it returned.
Each address was classified with the same rule the ShorWatch scanner applies to any address you paste: a Taproot output is exposed; a hashed address that has ever spent is exposed; a hashed address that has never spent is protected. “Exposed” means the public key (or script) is on-chain and could be attacked at rest by a future quantum computer running Shor's algorithm. It does not mean anything can attack it today.
“Share of all bitcoin” uses the issued supply at the snapshot block, computed from the subsidy schedule.
The raw classification is published as JSON under a CC BY 4.0 licence. Quote it, link it, re-run it.

Limits

Per-address, not per-owner. An exchange spreads funds over many addresses, some in this list and most not. The table says nothing about any organisation's total exposure.
Multisig and scripts are opaque until spent. A never-spent 3… or long bc1q… address may hold a multisig whose keys we cannot see. That is exactly why it counts as protected: nothing is visible. Once it spends, everything is.
Labels are hearsay. Explorer labels are crowd-sourced and unverified. We show them because readers will look them up anyway, and we draw no conclusion about any specific entity from them.
No date. A cryptographically relevant quantum computer does not exist, and this report does not predict when one will. It measures what is already on the chain, which is the only part that is measurable.

Run the same check on your own addresses

The scanner applies exactly this classification to any address or extended public key you paste, in your browser, against public chain data. Nothing is sent to us and nothing is stored.

Scan an address

Read-only · Non-custodial · Nothing stored · No account needed

Citing this report. ShorWatch, “Quantum exposure of the 100 richest Bitcoin addresses”, snapshot 3 September 2026, https://shorwatch.com/reports/quantum-exposure-top-100-bitcoin-addresses.html. Data CC BY 4.0. Not financial or security advice.