Bunker Tracker

How much of each institution's published Bitcoin sits at addresses whose public key is already known, and how much is still hidden behind a hash.

Live: https://bunker-tracker.vercel.app

Exposure is not a vulnerability today. It measures preparedness against a hypothetical future break of the signature scheme Bitcoin uses.

How it works

• registry/btc/<org>.yaml lists addresses each organization published or publicly confirmed itself, with a source URL for every entry.
• scripts/snapshot.py checks every address's checksum, asks a public Esplora API for its funded and spent totals, and classifies it.
• An address is exposed if it is Taproot, has at least one confirmed spend, or the organization published its key or script off chain (for example a signed ownership message). Otherwise it is hidden.
• scripts/prerender.mjs builds the pages in site/ from site/template.html and site/src/, with the snapshot baked in.

Run it

python3 -m venv .venv && .venv/bin/pip install -r requirements.txt
.venv/bin/python scripts/snapshot.py            # fetch and rebuild (needs Node)
.venv/bin/python scripts/snapshot.py --render   # rebuild pages from data/latest.json

Public explorers rate-limit, so a full run can take around 15 minutes.

Known limits

• Hidden means no known exposure. An address that has never spent could still share a key with one that has; that cannot be checked from outside.
• Mempool spends and key reuse across addresses are not checked.
• Coverage differs by organization: Coinbase's entry is its cbBTC reserves only, Bitfinex's list was last updated in 2022, OKX is limited to the addresses holding at least 1 BTC in its file, and Tether's single address is sourced to a news report quoting its CEO because the original post has not been located.
• A falling exposed balance does not prove a migration: funds moved to addresses outside the published lists simply leave the tracker.

Corrections

Open an issue with the address, the organization, and a link to a source the organization itself published.

License

MIT. See LICENSE.