BitGo has announced four new features for institutional Bitcoin wallets, focusing not on responding to past attacks, but on proactively managing the risk of public key exposure posed by quantum computing. The company states that these tools are designed for its supported Bitcoin multisig wallets to identify, organize, and migrate balances from wallets at risk of exposure.
Most Bitcoin addresses do not reveal their public key until the first spending transaction occurs; however, once a spend happens, the public key required to verify the transaction appears on the blockchain. If the same address is reused, or if a balance remains at the address after a transaction, those funds could theoretically face higher risk in the future if quantum computing capabilities become sufficient. Taproot addresses differ in that their public key information is revealed at the time the output is created.
Added risk scoring and address repair
BitGo’s newly launched features include quantum risk scoring, exposure address remediation流程, a new UTXO selection method, and updated default address controls. The quantum risk scoring feature measures the extent of public key exposure for supported wallets within the platform.
However, BitGo has not publicly disclosed the calculation formula, weights, or thresholds for this score. This means it functions more as an internal risk management metric rather than a unified security standard at the Bitcoin network level.
UTXO processing method synchronized adjustment
The new UTXO selection method aggregates funds by address. When a wallet prepares to spend a UTXO from a specific address, the system attempts to also select other UTXOs associated with that address and transfer them together. This is done to avoid leaving remaining funds on an address whose public key has already been exposed after a single transaction.
BitGo has also introduced a "Repair Exposed Addresses" process to migrate associated funds to newly generated addresses, whose public keys have not yet appeared on-chain. Meanwhile, default settings have been adjusted to reduce the use of address types and transaction patterns that lead to premature public key exposure.
BitGo stated that funds that expose public key information from creation, such as Taproot and Pay-to-Public-Key, require separate handling. However, the company did not specify whether these remediation paths are covered in this product update.
This is currently a forward-looking preparation.
BitGo, in its explanation, cited Adam Back, co-founder of Blockstream, stating that there are currently no quantum computers capable of threatening Bitcoin. This means these tools are aimed at future risks, not at current, executable methods of stealing coins.
Meanwhile, Bitcoin developers are discussing the BIP 360 draft. The proposal aims to introduce a new output design via a soft fork to reduce risks associated with long-term public key exposure. However, this proposal is still in draft form and has not been activated on the Bitcoin network.
On-chain research firm Glassnode previously estimated that, as of May this year, approximately 6.04 million BTC were in a state where their public keys had been exposed, accounting for 30.2% of the issued supply. Of this, about 1.92 million BTC were exposed due to output structure, while approximately 4.12 million BTC were linked to address reuse, partial spending, or custodial operations. The study did not suggest that these bitcoins are currently at risk of theft, but rather identified which balances have exposed public keys and which risks could be mitigated through improved wallet management.
BitGo has not disclosed how many customers have access to these features, whether they are charged separately, or when support may be expanded in the future.