BitGo Launches Quantum-Risk Tools for Bitcoin Custody Before Any Threat Exists
BitGo launched four Bitcoin quantum-risk management tools on July 9, 2026, giving institutions a practical way to measure and reduce address-key exposure before any quantum computer can threaten the network.
The largest regulated Bitcoin custodian is doing the unglamorous work now, while it's still optional.
Key takeaways
- BitGo (NYSE: BTGO) launched four Bitcoin quantum-risk tools on July 9, 2026, including a Quantum Risk Score and a guided workflow to migrate funds away from addresses with exposed public keys.
- No quantum computer can break Bitcoin today, but an estimated 6.5 to 6.9 million BTC may sit in addresses whose public keys are already visible on-chain, creating theoretical long-term exposure.
- BitGo frames the tools as a bridge to future protocol-level post-quantum upgrades, not a permanent fix, with active Bitcoin proposals (BIP-360 and BIP-361, both currently in Draft status in the bitcoin/bips repository) representing the eventual protocol-layer solution.
BitGo Holdings (NYSE: BTGO) announced four new quantum-risk management capabilities for its Bitcoin custody platform on July 9, 2026, per the company's official press release. The tools cover UTXO-based wallets and multi-signature custody configurations, giving institutional holders a practical way to measure and reduce address-key exposure before any quantum machine can threaten the network.
What BitGo Actually Shipped
The four features work as a layered system. A Quantum Risk Score rates potential quantum exposure across supported Bitcoin wallets inside the platform. A Fix Exposed Addresses Workflow guides clients through moving funds from elevated-risk addresses into new addresses with stronger key hygiene.
A new UTXO Selection Method groups and prioritizes coins by address to reduce the partial-spend exposure that standard coin selection can create. Updated default address-type controls steer wallets away from transaction patterns that compound quantum risk.
The scope has a hard boundary worth noting. Taproot and Pay-to-Public-Key address types expose a public key from the moment of creation and fall outside these tools entirely. Those require separate remediation.
BitGo CEO and co-founder Mike Belshe said the safest address is one whose public key has never been revealed on-chain, and that the new capabilities give institutions a practical way to understand and reduce quantum exposure while continuing to rely on the proven security of multi-signature custody.
Adam Back, co-founder and CEO of Blockstream, put the timing plainly in comments attributed to him in connection with the announcement: institutions should start the work now, while it is calm and optional rather than urgent and forced, because no quantum computer can touch Bitcoin today.
BitGo is not new to this work. On May 26, 2026, the company and Silence Laboratories completed the first post-quantum MPC transaction simulation by a regulated custodian. Today's tooling extends that groundwork into live client-facing infrastructure.
The Exposure Problem in Plain Numbers
The asymmetry here is worth sitting with. BIP-361, the Draft post-quantum migration proposal in the bitcoin/bips repository, estimates that roughly 6.5 to 6.9 million BTC sit in addresses whose public keys are already on-chain. Those coins are not at risk today. But every day they go unmigrated is a day they drift closer to theoretical vulnerability on a long enough time horizon, and protocol-level solutions move slowly by design.
Bitcoin developers have been building quantum defenses for years, and active proposals like BIP-360 and BIP-361, both currently in Draft status at the bitcoin/bips repository, represent the protocol-layer path forward. But consensus on a Bitcoin protocol change takes time, sometimes years. Custodian-layer hygiene tooling is the bridge that covers that runway.
BitGo is explicit that its tools are a complement to those future protocol upgrades, not a replacement. That framing matters. The honest version of this announcement is: here is what institutions can do right now, before the protocol catches up.
The self-custody crowd should be paying attention too. The address-hygiene problem is not exclusive to institutions. Anyone sitting on UTXOs in reused or key-exposed addresses carries the same theoretical exposure.
What Comes Next
The more important signal from this launch is adoption. BitGo shipping the tools is step one. Whether institutions actually use the Quantum Risk Score and migrate funds at scale is the variable that determines whether this work matters.
If uptake is thin, or if the Bitcoin protocol moves to a post-quantum standard faster than custodians migrate, the custodian-layer tooling becomes redundant before it proves its value. Watch for adoption disclosures in BitGo's future communications and for progress on BIP-360/361 in the Bitcoin developer community.
Sources
Frequently Asked Questions
No. BitGo explicitly states no quantum computer can break Bitcoin at present. The concern is addresses that have already broadcast a public key on-chain. Those become theoretically vulnerable only when a sufficiently powerful quantum machine exists, which researchers generally place years to decades away.
Addresses that have already revealed a public key on-chain are the primary exposure class. Taproot and Pay-to-Public-Key types expose the public key from creation and are outside the scope of BitGo's new tools, requiring separate handling. Per BitGo's CEO, the safest address is one whose public key has never appeared on-chain at all.
Active proposals exist. BIP-360 and BIP-361, both in Draft status at the bitcoin/bips repository, propose quantum-resistant transaction types and a migration path away from ECDSA signatures. Protocol changes require broad consensus and move slowly by design. BitGo's custodian-layer tooling is explicitly framed as a complement to that eventual upgrade, not a substitute for it.
