The answer, up front
The quantum threat to digital assets moved from abstract to measured in 2026, and institutions that hold or safekeep cryptocurrency should treat it as a current diligence question. On March 31, 2026, Google Quantum AI published work that lowered the estimated cost of breaking the elliptic-curve signatures used by Bitcoin and several other chains by roughly twentyfold 1. Independent studies put millions of coins in exposed address types 2, 3. No quantum computer can do this today, but the distance has shortened enough that investors, auditors and counterparties are starting to ask how much of a holding sits in exposed form.
What Google published
Google's team described circuits needing fewer than 1,200 to 1,450 logical qubits, which on superconducting hardware would require fewer than 500,000 physical qubits for a few minutes, a roughly twentyfold improvement over earlier estimates 1. The accompanying paper estimated that about 6.9 million BTC are vulnerable across all protocols, counting weak locking scripts and address reuse, with a little over 1.7 million in one legacy output type 1. Separately, CoinDesk reported that Google would move its own authentication services to quantum-resistant cryptography by 2029, a planning horizon worth noting 4.
How much is exposed
Independent measurements agree on the broad shape. Glassnode, in May 2026, counted about 6.04 million BTC, or 30.2 percent of issued supply, as exposed at rest, meaning the public key needed to spend the coin has already appeared on the blockchain 2. It split that into structural exposure from older output designs and a larger operational share driven mainly by address reuse, and described the operational trend as reversible through ordinary address management 2. Chaincode Labs, in May 2025, estimated that 20 to 50 percent of Bitcoin in circulation, 4 to 10 million BTC, is at risk, and noted that migrating the whole set of coin records could take between 76 and 568 days 3.
Why the exposure is partly a management problem
The important nuance is that much of the exposure comes from how custodians and users manage addresses, not from a flaw nobody can fix 2. Glassnode describes the exchange trend as reversible, which makes address hygiene a low-cost first step 2. For an institution, that reframes the issue: ordinary address practices already within the firm's control can cut a meaningful share of risk today, while the deeper protocol questions play out over years.
What this means for holders and custodians
Executives who hold or custody Bitcoin should expect investors, auditors and regulators to ask what share of holdings sits in exposed address types, and the honest answer requires measuring it. The migration estimates make the second point: moving an entire holding or an entire system cannot happen quickly once a threat is acute, so the work belongs on the planning horizon now, not after someone announces a capable machine.
How ArcQubit approaches it
ArcQubit treats this as a measurement-first problem. The same discipline that QuCode applies to enterprise cryptographic discovery, finding where vulnerable keys and signatures live, applies to a digital-asset posture review, and QuTrust holds the resulting plan so a custodian can show investors and auditors a current, defensible view of exposure and the steps underway to reduce it.