Bitcoin’s potential exposure to a future quantum attack depends partly on whether public keys are visible on-chain, a distinction shaped by transaction formats and how people use or hold coins.
A public key can be visible on the Bitcoin blockchain while coins remain unspent, depending on an output’s design or earlier use. That visibility test describes what is exposed at rest; it does not establish how holdings might fare under other future attack conditions.
Some formats, such as early P2PK outputs, bare multisig and Taproot, expose public-key information as part of their design. Taproot’s output key is visible on-chain, but that visibility alone does not assess the protocol’s overall design.
A previously hidden public key may become visible through a spend, a reused address or a custody arrangement while the coins remain tied to it. Public-key visibility alone does not show whether a custodian has strong safeguards or can meet customer claims.
In theory, enough quantum computing capacity could allow Shor’s algorithm to recover a private key when its public key is known. The tally does not estimate when a quantum computer might be capable of carrying out such an attack.
Using fresh addresses and promptly moving change outputs may reduce operational exposure. BIP-360 proposes a P2MR output that would remove a vulnerable key path while retaining features similar to Taproot. Existing Taproot holdings would need a separate migration, and P2MR would address only part of post-quantum risk.
