Exchange Custody Practices Are Responsible for 40% of Bitcoin's Quantum-Exposed Supply and the Gap Between Platforms Is Striking
-

Exchanges represent the largest identifiable subset of Bitcoin's operationally exposed supply, holding approximately 1.66 million BTC in quantum-vulnerable addresses, roughly 40% of the total operational exposure pool according to Glassnode. The concentration is notable both in absolute terms and relative terms: approximately half of all labeled exchange-held Bitcoin falls into the exposed category compared to less than 30% of non-exchange supply, suggesting that custodial practices at centralized platforms are a primary driver of the overall exposure problem. The gap between individual platforms is even more striking. Glassnode marks Coinbase balances at just 5% exposed, while Binance sits near 85% exposed and Bitfinex at 100%, a divergence that reflects dramatically different approaches to address management and custody infrastructure across the industry's largest players.
The pattern extends beyond exchanges. WisdomTree appears fully exposed across its holdings, while Grayscale holds approximately half its supply in exposed outputs. By contrast, sovereign wallets held by the US, UK, and El Salvador show zero exposure, suggesting government-level custodians have adopted more rigorous address hygiene practices than some of the largest commercial platforms. Glassnode also noted a long-term trend in the wrong direction: exchange-held Bitcoin has drifted from roughly 55% operationally safe in 2018 to approximately 45% today, meaning the industry's overall quantum exposure through custodial channels has been growing rather than shrinking over the past several years. For exchanges and institutional custodians, the findings represent a concrete and addressable risk that requires operational changes rather than waiting for protocol-level solutions to materialize.
