BitGo Holdings, Inc. (NYSE: BTGO) unveiled new quantum-risk management tools for Bitcoin wallets on July 9, 2026. The rollout gives institutional custody clients exposure scoring, a guided remediation workflow, and new default wallet controls.
Key Takeaways
- BitGo launched four quantum-risk management capabilities for Bitcoin wallets, covering UTXO-based and multi-signature custody.
- The UTXO Selection Method groups and prioritizes unspent transaction outputs by address to reduce exposure created by partial spends.
- A new Quantum Risk Score gives institutions an in-platform reading of quantum-related exposure across supported Bitcoin wallets.
- CEO Mike Belshe said institutions do not need to wait for a quantum event to begin managing quantum risk.
- Blockstream co-founder and CEO Adam Back said the work should start “while it’s calm and optional rather than urgent and forced”.
What Happened?
The new tools, according to BitGo, were designed to help institutions assess, manage, and reduce quantum-related exposure across UTXO-based wallets. The launch expands BitGo’s multi-signature security architecture with new operational tools for managing wallet-key exposure, improving UTXO handling, and strengthening institutional wallet operations as the industry prepares for a post-quantum future.
Institutional custody differs sharply from the retail holders, who manage their own keys without a custodian’s scoring or remediation tools.
BitGo pioneered multi-signature wallets for Bitcoin and has long advocated for security models that reduce single points of failure. Its wallet architecture, strict address hygiene, and use of new addresses for Bitcoin transactions already help reduce unnecessary key exposure; the new capabilities extend that work into scored, guided remediation.
BitGo is announcing new quantum risk management capabilities for bitcoin wallets.
— BitGo (@BitGo) July 9, 2026
The launch adds a Quantum Risk Score, a guided workflow to move funds off exposed addresses, a new UTXO selection method, and updated default address type controls, all built on the multi-sig… pic.twitter.com/NFxirD2jQI
Inside the Four New Safeguards
The toolkit targets a narrow, well-defined problem: Bitcoin addresses whose public keys have already been exposed on-chain carry quantum-related risk that hardened custody has not previously scored or remediated.
| Capability | What it does? |
|---|---|
| UTXO Selection Method | Groups and prioritizes UTXOs by address to reduce exposure created by partial spends. |
| Quantum Risk Score | An in-platform scoring system for potential quantum-related exposure across supported Bitcoin wallets. |
| Fix Exposed Addresses Workflow | A guided remediation flow that moves funds away from addresses with elevated exposure into newly generated addresses with improved key hygiene. |
| Default Address-Type Controls | Updated default wallet behavior designed to reduce reliance on Bitcoin address types and transaction patterns that carry added quantum-related considerations. |
Funds already sitting in address types that expose a public key from creation, such as Taproot or Pay-to-Public-Key, need separate remediation and fall outside the scope of this rollout. That carve-out matters: it signals BitGo is sequencing the easier, address-hygiene fixes first and leaving the harder legacy-exposure cleanup for a later phase, rather than overselling one launch as a complete fix.
Why Exposed Public Keys Are the Real Risk?
Bitcoin’s standard receiving addresses hide a wallet’s public key behind a hash until the owner first spends from it, which is why practical quantum attacks against Bitcoin are not available today, though future advances in quantum computing could create risk for addresses whose public keys have been exposed on-chain. Taproot and Pay-to-Public-Key addresses skip that hashing step, publishing the key immediately, which is exactly the exposure category BitGo’s new default controls are built to discourage.
Adam Back, co-founder and CEO of Blockstream said:
BitGo said the new controls are not a substitute for future Bitcoin protocol-level post-quantum signature upgrades, but are designed to reduce address and transaction level exposure using tools available today.
That distinction separates BitGo’s rollout from a genuine fix at the protocol layer: a Bitcoin wide move to post-quantum signatures still requires a network upgrade, while BitGo’s tools instead reduce how much exposed-key inventory sits in custody while that upgrade gets designed. The approach tracks a harden-the-operations-first pattern seen across prior custody-side breaches, where exchanges and custodians close the operational gap long before any underlying protocol changes.
The new capabilities apply to supported UTXO based assets and multi-signature wallet configurations, Belshe added. We believe institutions do not need to wait for a quantum event to begin managing quantum risk. The right approach is to reduce exposure now, harden wallet operations, and prepare for the migration from today’s security models to future post-quantum standards, he said.
CoinLaw’s Takeaway
BitGo is sequencing a known, narrow exposure class, keys already published on-chain through Taproot, Pay-to-Public-Key, or reused addresses, well before any quantum computer can act on it, while the fix is still cheap and optional rather than forced. Institutional custody clients benefit most directly: a Quantum Risk Score and a guided remediation workflow turn an abstract, years-out threat into a concrete, auditable checklist custodians can run today.
Retail holders who self-custody, whom BitGo does not serve, get none of this scoring by default and stay more exposed to whichever migration path Bitcoin’s protocol layer eventually adopts.
The harder to source risk is the one BitGo’s own release carves out: legacy Taproot and Pay-to-Public-Key balances that already expose a public key from creation. Those require separate remediation the company says is outside this launch’s scope, which means the addresses most vulnerable to a future quantum break are, for now, the ones this tool does not touch.
