The index now reads how each reserve is actually spent

Until now the index answered one question per address: has the public key behind it been revealed. That is the quantum question, and it stays the headline. But the same public transactions say more, and we were leaving it unread.

What a spend reveals

When an address spends, the input carries the script that unlocks it. For most addresses that script is one signature from one key. For custody wallets it is often a multisig script, two of three or three of five, and the script says so in plain numbers. Taproot outputs spend through a key path, one signature that may stand for several signers, or through a script path.

We now read those inputs for a sample of the largest addresses in each reserve, and the reserve page says what it found: how much of the balance is spent by a single key, how much through a multisig script and in what shape, and how much has never spent and so has not shown its hand. One caveat is on the page in the same breath: a single key and a threshold-signature (MPC) wallet look identical on-chain, so "single key" means "one signature", not "one person".

Repeated nonces

Every ECDSA and Schnorr signature uses a fresh random number, the nonce. If a key signs two different transactions with the same nonce, the private key falls out of the two signatures by elementary algebra. No quantum computer is needed. RFC 6979 exists to make the nonce deterministic for exactly this reason, and wallets that do not follow it, or that draw from a bad random number generator, still get caught by it.

The scan records the nonce value of every signature it reads, grouped by key, and flags any key that used the same value twice across different transactions. A clean result is reported as the number of signatures and keys checked; a hit is reported with the transaction ids and the balance affected. So far, across the reserves scanned, none has been found. That is the expected result for professional custody, and it is now a checked result rather than an assumed one.

Freshness

A score is only as good as the list behind it. Each reserve now shows how recent the holder's own publication is: read from a live endpoint, published this week, this month, months ago, or older. One holder has stopped publishing addresses; its row says so and stays on the last publication that carried them.

What it would cost to move

For each reserve we count the unspent outputs sitting behind revealed keys and price the move to fresh addresses at today's fee rates, in BTC and as a share of one day's block space. For most reserves the chain is not the constraint: the fee is tens of dollars and the block space is a fraction of a percent of one day. There is one exception worth knowing about. HTX's published addresses hold about 1.5 million unspent outputs, and sweeping them into fresh addresses would take roughly 3,800 transactions, about 2.7 BTC in fees at the one-hour rate, and close to two days of the entire chain's block space. A reserve like that cannot move in a hurry, whatever the signing setup. For everyone else what dominates is the signing ceremony and the custody procedure, and the page says that too.

Contract wallets on Ethereum

Contract accounts used to sit outside the score, because a contract's exposure depends on whoever controls it. Where a contract publishes its owner list and threshold through the Safe interface, we now read both, check each owner the same way we check any account, and call the wallet exposed when enough owners have revealed a key to reach the threshold. A four-of-seven wallet with six revealed owners is exposed; a four-of-seven with three is not, yet.

On the exposure page

The same checks are available for any single address on the exposure page: expand an address and choose "Check signatures". The spec has the rules as Appendix B.