Why act now
Quantum computers don't break Bitcoin's hashes — they break its signatures. Once you see exactly what breaks, BIP-360 and BIP-361 become easy to place.
WHAT ACTUALLY BREAKS
Private to public takes an instant. The reverse was supposed to be impossible
Bitcoin's signatures rest on a one-way computation. Deriving a public key from a private key is trivial. Going back is, for classical computers, out of reach. That asymmetry is what protects your coins. Shor's algorithm lets you travel the arrow backwards.
So there are only two defences: keep the public key out of sight (BIP-360's job), and replace the signature scheme with one quantum computers can't solve (a future PQ signature BIP's job).
SHARED NOTATION
Five states of a key
Every diagram from here on paints keys in one of these five colours. Learn the colours and you can read the diagrams without reading the prose.
Public key sits behind a hash. Nobody has seen it yet
Public key is on-chain. A target for long exposure attacks
Private key has been derived by a quantum computer
Protected by post-quantum signatures (future, separate BIP)
Spendable only through a rescue protocol
LONG EXPOSURE ATTACK
Follow one coin through its life
When a public key gets exposed depends on your address type and on what you do. Pick an address type, press the action buttons, and watch the key change colour.
Figures illustrate the concept. On the capability scale, 6 and 15 bits are demonstrated results; everything above them is a hypothetical marker. It is not a time axis.
What this shows
bc1p (Taproot) is amber from the moment it's funded. The output itself is a public key on the curve, so it is exposed even if you never spend. That's why P2TR is marked vulnerable in BIP-360's table.
Exposure can't be undone. Once a public key is on-chain it stays there forever. All you can do is move the funds sitting under that key somewhere else.
SHORT EXPOSURE ATTACK
A race against the next block
Whatever address you use, spending means showing your public key. If someone derives the private key in the short window before the transaction confirms, they can take the funds. No amount of key hygiene prevents this one.
A conceptual simulation. Real quantum computers cannot yet derive a 256-bit key at all — the demonstrated result is 15 bits — so every speed level here is hypothetical.
THE PIVOT
BIP-360 (P2MR) cannot win this race. P2MR only addresses long exposure attacks; a spend still reveals a Schnorr public key in the witness. The BIP itself states that P2MR does not by itself protect against short exposure attacks, and that these can be mitigated by future activation of post-quantum signatures.
TABLE FROM BIP-360
Long exposure vulnerability by output type
This table appears in BIP-360 itself. Tap a row to see why it lands where it does.
| Type | Long exposure | Prefix |
|---|
* Funds become vulnerable any time the script reveals a public key, for example through address reuse. Sharing extended public keys (xpubs) or wallet descriptors also exposes quantum-vulnerable public key information. — note in BIP-360
WHERE WE STAND
The threat is still distant. The deadlines are not
HONEST NOTE
On 24 April 2026, Project Eleven's Q-Day Prize was won by breaking a 15-bit elliptic curve key with a variant of Shor's algorithm on publicly accessible quantum hardware — a 512-fold jump from the 6-bit result of September 2025. It is still nowhere near Bitcoin's 256 bits.
Estimates of the hardware needed vary widely. Google's April 2026 white paper put a 256-bit attack under 500,000 physical qubits; a later Caltech/Oratomic paper brought that down to 10,000 using a neutral-atom architecture. Both are theoretical estimates.
BIP-361 cites a McKinsey report for the range of 2027–2030 at the earliest. That is the BIP’s cited projection, not a settled forecast. BIP-360 takes a different approach: it argues preparation is worthwhile whether or not such a computer ever materialises, and makes no prediction about timing.
Mandates post-quantum migration for software and networking equipment, with browsers and operating systems by 2033
Plans to disallow ECC across the US federal government, with an exception for hybrid cryptography
As of 1 March 2026, over 34% of all bitcoin have revealed a public key on-chain (BIP-361)
NEXT
Two proposals answer these two attacks. BIP-360 builds a vessel that never shows a public key (01); BIP-361 sets a deadline for moving into it (02). Both are Drafts, and no activation is planned.
BIP-360: an address that hides your public key
Some of today's addresses show your public key to everyone. BIP-360 proposes a new kind of address that doesn't.
THE MAIN IDEA
The only difference is what's written in the address
Today's Taproot addresses — the ones starting with bc1p — have your public key written right in them. Once a public key is visible, a quantum computer can eventually work out the private key. BIP-360's new address, starting with bc1z, writes only a hash instead. A hash can't be reversed, so there's nothing to work from.
Tap either card above, or either door of the house, to see what it is.
Both addresses are exactly the same length. Only the contents change.
In detail: the actual bytes
A P2TR output is OP_1 + OP_PUSHBYTES_32 + a 32-byte tweaked public key. A P2MR output is OP_2 + OP_PUSHBYTES_32 + a 32-byte Merkle root, built with a TapBranch-tagged hash. The push opcode is the same, which is why the output is always the same size.
Signature message construction is identical to BIP-342, including annex (0x50) support. P2MR is fully tapscript-compatible, so existing tapscript programs run unmodified. Dropping the internal key and the tap tweak simply makes validation a strict subset of P2TR script path spending.
Nodes that haven't upgraded treat a SegWit version 2 output as anyone-can-spend, but they won't relay or mine it — which is what makes a soft fork deployment possible.
THE ONE THING TO REMEMBER
The new address writes a hash where the public key used to be. Nothing can be recovered from a hash, so while your coins are just sitting there, a quantum computer has no way in.
WHEN YOU SPEND
Register many rules, reveal only one
The new address lets you register several ways to spend — “my signature alone,” “two family signatures,” and so on. When you pay, you reveal only the one you actually use. Nobody can even tell the others exist.
ルールを1通りだけ登録しています。下のスライダーで増やしてみてください。
The byte counts are the actual values from the BIP-360 specification.
In detail: exact byte counts, and one more comparison
The part of a spend that proves the path is called the control block. For P2MR it is 1 + 32×m bytes; for P2TR the internal key adds 32 more, making 33 + 32×m.
Across the whole witness: a P2TR key path spend is 1+1+64 = 66 bytes, P2MR is 103 + 32×m, and a P2TR script path spend is 135 + 32×m. So P2MR is always smaller than a like-for-like P2TR script path spend, by exactly the 32 bytes of the internal key.
The specification allows a depth of up to 128; this demo shows up to 4. Security rests on a 256-bit hash — 128-bit collision resistance, 256-bit preimage resistance — the same as P2WSH.
THE ONE THING TO REMEMBER
Payments carry a little more data, so fees rise slightly. In exchange, your coins stop being a target while they sit — and the rules you didn’t use stay secret.
HOW THEY LOOK
bc1q → bc1p → bc1z
The first character tells you which generation an address belongs to. Tap a card to compare.
In detail: why q, p and z
That first character encodes the witness version. The bech32 character set runs qpzry9x8gf2tvdw0s3jn54khce6mua7l, so position 0 is q, position 1 is p and position 2 is z. P2MR is SegWit version 2, hence bc1z.
By the same ordering, position 3 is r — which is why P2Q, a separate draft proposal, would use bc1r (see chapter 04). Note also that version 0 uses bech32 while version 1 and above use a different checksum scheme, bech32m.
HOW FAR IT REACHES
BIP-360 is only half of it. The other half doesn't exist yet
There are two ways a quantum computer can come after your coins: while they're sitting there, and at the moment you spend. BIP-360 only stops the first one.
There is no timeline for when stage two might exist.
In detail: the technical terms
Going after coins while they sit is called a long exposure attack; going after the moment of spending is a short exposure attack. BIP-360 states plainly that P2MR is resistant to long exposure attacks only, and that it does not by itself protect against short exposure attacks — those can be mitigated by future activation of post-quantum signatures.
Stage two would be added through tapscript's OP_SUCCESSx upgrade route. P2WSH has no such route, which is one reason BIP-360 built on Taproot's design instead. The specification says only that algorithms such as ML-DSA and SLH-DSA are under research; no specific opcode name has been settled.
EASY TO MISREAD
This is not a "quantum-proof address"
HONEST NOTE
BIP-360 is sometimes described that way, and it isn't accurate. It only stops attacks on coins that are sitting still. At the moment you spend, your public key is shown exactly as it is today.
And even that depends on never reusing an address. Reuse one and the public key is out. Handing someone your wallet's extended public key (xpub) does the same thing.
It is also still a Draft. Being merged into bitcoin/bips means the document was accepted — not that the change is usable. There is no date for when it might take effect.
In detail: the proposal's basic data
BIP editor Murch noted in review that the BIP cannot advance to Complete, and deployment cannot begin, until a post-quantum signature BIP materialises. The name P2MR only arrived on 10 February 2026; before that it was called P2QRH, then P2TSH (see chapter 04).
NEXT
A new address is worth nothing if nobody moves to it. Right now, more than a third of all bitcoin sits at addresses whose public key is already visible. BIP-361 is the proposal to put a deadline on that move.
BIP-361: setting a deadline to move
A new address exists, but nobody has to use it. BIP-361 proposes a deadline for moving. It is often described as a freeze proposal — the current version isn’t one.
THE STARTING POINT
More than a third of all bitcoin sits with its key on show
As chapter 01 showed, coins whose public key is visible are the ones a quantum computer would come after. The problem is how many of them there already are.
As of 1 March 2026, over 34% of all bitcoin have revealed a public key on-chain. (figure from BIP-361)
THE AWKWARD PART
This kind of theft can happen quietly. An attacker who derives the private keys doesn’t have to move immediately — they can wait weeks or months and drain funds gradually. Which means the day quantum computers arrive may pass unnoticed while the damage is already underway. Waiting until it happens is too late: that is where this proposal starts.
WHAT IT PROPOSES
Two deadlines. If you’ve moved, nothing happens to you
Pick your situation, then move forward from the start. What happens differs completely depending on whether you’ve moved to a new address.
いまはふつうに使えます。
The “~3 yrs” and “~5 yrs” are measured from the start — the day the proposal takes effect. There is no date for that start yet.
In detail: the formal names and exact periods
The two deadlines are Phase A and Phase B. Phase A activates 160,000 blocks — roughly 3 years — after the proposal takes effect. Phase B follows 2 years later, on a well-publicised flag day 5 years after activation.
Phase A forbids sending to quantum-vulnerable addresses. Phase B encumbers ECDSA/Schnorr spends with a quantum-safe rescue protocol. On compatibility: after Phase A, un-upgraded wallets cannot receive and can only send to upgraded addresses; after Phase B, both sender and receiver must be upgraded.
Nodes that haven’t upgraded treat the new outputs as anyone-can-spend, so this too can ship as a soft fork.
THE ONE THING TO REMEMBER
The funds of anyone who has moved are never restricted at any point. The deadlines exist to create a reason to move, not to punish those who don’t.
THE MOST MISREAD PART
The second deadline is not a freeze
You’ll often see this described as a proposal to freeze old coins. The current version isn’t that. It asks you to prove you are the rightful owner when you spend — something only the real owner can do, and an attacker cannot. Here’s how that works.
The proof would use a technique that demonstrates knowledge without revealing it — a zero-knowledge proof. Designs are still being researched.
A COMMON QUESTION: COULDN’T A QUANTUM COMPUTER FIND THE SEED TOO?
No — for two reasons.
First, the only road a quantum computer can travel is public key → private key: the reversed arrow from chapter 00. A seed isn’t a public key, and it never goes on the chain. There is no starting point for the computation, because nobody has ever seen it.
Second, the road from a key back to the seed is made of hashing, and hashing can’t be undone even by a quantum computer. That is exactly why you can end up knowing the private key that’s on the chain while still having no idea what seed produced it. The step in the diagram above is that hashing.
That said, if someone reads the paper you wrote your seed on, or you type it into a fake site, you are in trouble — just as you would be today. That risk has nothing to do with quantum computers.
THERE IS AN EXCEPTION
This works only for wallets that derive their keys from a seed. Coins in the oldest format (P2PK, from before 2012) have no such structure, so even the rightful owner cannot produce the proof. The authors therefore argue a separate proposal, Hourglass, should cover those. Most of the coins attributed to Satoshi are in this old format.
In detail: what exactly gets proved
The mechanism rests on the knowledge asymmetry created by BIP-32 hardened derivation. An HD wallet whose key path includes a hardened step can prove knowledge of a parent XPriv that a quantum attacker has essentially no way to learn.
Research suggests ZK-STARK-based proofs could scale efficiently here. A commit/reveal approach would be more efficient still, but brings a multi-stage security model. The BIP frames it this way: if the rescue protocol can cover the bulk of the supply, restricting ECDSA/Schnorr validation is at most mildly confiscatory.
For completeness: BIP-32 hardened derivation uses HMAC-SHA512. Shor’s algorithm attacks the discrete logarithm problem, not hash functions, so this step can’t be walked backwards even with a quantum computer. Grover’s algorithm does apply to hashes, but it only reduces a search to square-root order, leaving a 256-bit hash with about 128 bits of effective strength.
P2PK is the exception because it predates BIP-32 (2012), so the knowledge asymmetry can’t be constructed at all. The authors support Hourglass for those outputs, noting it would be compatible if activated before Phase B.
WHO HAS A REASON TO MOVE
Whose interests does this actually serve?
Whether a proposal like this works comes down to whether each party has a reason to act. Tap a card.
EASY TO MISREAD
The proposal has changed since the early coverage
HONEST NOTE
The version published in April 2026 really did stop those spends outright. A later revision changed it so the rightful owner can still spend by proving ownership. Most explainers online were written from the April text, so if you see this called a freeze proposal, check which version it describes.
And the biggest caveat of all: this proposal requires a post-quantum signature BIP that does not exist yet (Requires: TBD). Until there is somewhere to move to, there is no deadline to set.
Opinion is sharply divided. Critics argue it turns a technical question into a political one, and that attaching conditions to other people’s assets violates property rights. Even co-author Jameson Lopp has said he doesn’t like the proposal — he wrote it because he likes the alternatives less. Chapter 03 covers that argument.
In detail: basic data, and where the numbers come from
The projection that quantum computers could arrive as early as 2027–2030 is BIP-361 citing a McKinsey report — the proposal’s cited source, not a settled forecast. BIP-360 takes a different approach, arguing preparation is worthwhile either way, and makes no prediction about timing.
Note also that BIP-361 states NIST approved three production-grade post-quantum signature schemes in 2024. Strictly, of the standards finalised in August 2024, FIPS 203 is ML-KEM (key encapsulation); the signature schemes are two — ML-DSA in FIPS 204 and SLH-DSA in FIPS 205.
NEXT
So far this has been about what is being proposed. Whether it should happen is another matter entirely — and touching coins that may be lost forever has started a very large argument.
The debate: whose coins are they?
From here on this stops being a technical question and becomes a question of values. Both sides, with sources. This site does not draw a conclusion.
THE QUESTION
There are only three roads
Once quantum computers exist, coins with a visible public key can be moved by anyone — including coins whose owner lost the keys decades ago. There are broadly three roads from there. BIP-361 compares all three and picks the third.
The proportions here are illustrative; nobody knows how it would actually split. The three-way split follows BIP-361’s own taxonomy.
THE HEART OF THE ARGUMENT
Of the three, only the third is something people actively decided. The first is what happens by choosing not to act; the second only buys time. Only the third reaches into how other people’s coins are treated. That is why what looks like a technical question turns into a question about who gets to decide what.
A QUESTION FIFTEEN YEARS OLD
Who did the lost coins belong to?
At the root of this argument sits something Satoshi Nakamoto wrote in 2010. BIP-361 turns that same sentence inside out and makes it their case. Flip the card.
HOW TO READ IT
A coin that stays lost and a coin that gets carried off are not the same thing, even though both are “lost.” That distinction is where the case in favour begins. The case against starts somewhere else entirely: with the idea that deciding what happens to other people’s coins is not something a conversation should settle. Both sides can cite Satoshi — which is exactly what makes this hard.
FOR AND AGAINST
Both sides carry real weight
Here are the arguments from each side. Tap the ones you find convincing and the scales will tip. The tilt reflects what you selected — it is not a verdict.
THE CASE AGAINST
THE CASE FOR
Each argument has more behind it. Tap one for a fuller explanation.
These scales have no correct reading. They are a tool for finding out what you weigh most heavily.
A MOVING ARGUMENT
The criticism changed the proposal itself
This argument hasn’t just been noise. Objections led to BIP-361 actually being rewritten.
Stop the spends outright. Past the second deadline, spending in the old format becomes invalid. Any way of recovering those coins was set aside as future work.
The rightful owner can spend by proving it. Recovery was folded into the deadline itself. It is no longer a freeze — it is a demand for proof.
THE AUTHOR’S OWN WORDS
Co-author Jameson Lopp has acknowledged how unpopular the proposal is, and said he doesn’t like it either — he wrote it because he likes the alternatives less. Even the people advancing it aren’t choosing this road gladly. That says a good deal about the problem.
THE SIDE IN FAVOUR ISN’T ONE BLOC
Treating “people who back quantum measures” as a single group will lead you to misread this. The BIP-360 team, who built the new address, consider questions like burning coins to be outside the scope of their proposal, and keep their distance from BIP-361. Some of that same team have put forward a separate proposal, Hourglass. Several design philosophies are running in parallel on the same problem.
WHERE THIS SITE STANDS
We don’t draw a conclusion
HONEST NOTE
What this chapter covers isn’t a technical problem with a right answer. It is a clash of values: how absolute property rights are, against how much the safety of the whole network should count. No calculation settles that.
And none of it is decided yet. BIP-361 is a Draft, and the post-quantum signature BIP it depends on doesn’t exist. Positions that look entrenched today may well shift again as the design firms up — they already did once, between April and now.
The arguments from both sides, and the sources behind them, are collected in the footer. Read them, then decide for yourself.
In detail: how the specification frames it
BIP-361 sorts the existing proposals three ways: anyone can steal, throttled theft, and nobody can steal. It argues for the third. On the second, it points out that a replace-by-fee bidding war would follow, leaving miners earning revenue from stolen coins.
The BIP’s own assessment is that if the rescue protocol covers the bulk of the supply, restricting ECDSA/Schnorr validation is at most mildly confiscatory. Read the other way, the authors concede it is confiscatory to some degree.
Another pillar of the argument is that a quantum attack could unfold quietly. An attacker who derives keys can wait weeks or months and move funds covertly, so by the time anyone announces that Q-Day has arrived it may already be too late — hence the case for acting early.
NEXT
To close, a look at the order these proposals arrived in and how far each has actually got. The names and the designs have both changed more than once.
How it got here, and where it stands
How far have these proposals actually got? And what detours did they take on the way? Both the names and the designs have changed more than once.
WHERE IT STANDS
Of the four steps, one is done
Preparing Bitcoin for quantum computers takes four things, in order. Here is an honest account of how far along each one is.
Design an address that hides the public keyDONE
That is BIP-360, accepted as a formal document on 11 February 2026. Its status is still Draft.
Write the spec for a quantum-proof signatureMISSING
This is stage two of the rocket from chapter 01, and nobody has written it. Without it there is no protection at the moment of spending, and BIP-360 can’t advance either.
Set the deadline for movingDRAFTED
That is BIP-361, published on 14 April 2026. It names step two as a prerequisite, so it cannot move forward on its own.
Actually activate it on the networkNOT PLANNED
No consensus process, no schedule, nothing started. Being merged into the BIP repository and being usable are two different things.
THE ONE THING TO REMEMBER
When a headline says Bitcoin has adopted quantum protection, it is talking about step one. Steps two through four are still ahead, and nobody knows when. No need to rush — but worth keeping an eye on.
THE ROAD HERE
The name changed twice
What we now call P2MR started life under a completely different name, with a different design. Tap a dot or drag the slider to follow it — watch the name change as you go.
Dates follow BIP-360’s changelog and the bitcoin/bips record. The test implementation is a company announcement.
In detail: what the names meant, and why the design changed
P2QRH stood for Pay to Quantum Resistant Hash, P2TSH for Pay to Taproot Script Hash, and P2MR for Pay to Merkle Root. The renamings track the design. It began by claiming quantum resistance in its own name; once it was clear that what it really offers is resistance to long exposure attacks, it settled on a name that simply describes the mechanism.
The July 2025 pivot is the biggest fork in the road. Until then the plan was a bespoke quantum-resistant address format; after it, the change was reduced to removing Taproot’s key path, with post-quantum signatures to be added later via opcodes or leaf versions. The witness version also moved from 3 to 2 that same month.
You will sometimes read that the first proposal appeared on a mailing list in June 2024. The earliest version recorded in BIP-360’s changelog is 27 September 2024 (v0.1.0), and this timeline uses the dates that can be verified from that changelog.
THE WIDER PICTURE
These aren’t the only proposals
The two this site covers are two among several. Different philosophies are running in parallel on the same problem. Tap a station.
The middle of the main line doesn’t exist yet, which is why nothing beyond it can move.
WHAT OTHER CHAINS ARE DOING
As BIP-360 describes it, Ethereum has discussed a hard fork that would invalidate old formats, with a rollback if theft occurs. BIP-360’s assessment is that a rollback would be unacceptable on Bitcoin. Same quantum problem, different answers about what must be protected above all else.
In detail: proposals that didn’t fit on the map
There is also Tadge Dryja’s Lifeboat, and the commit/reveal approach first proposed in 2018 and revived in 2025 as a Fawkescoin variant. Commit/reveal means publishing only a commitment that you intend to spend, and revealing the details afterwards. It is efficient, but the extra stage complicates the security model.
On OP_CAT (BIP 347) with Lamport signatures, BIP-360 notes that they resist quantum attack but are one-time signatures: signing again with the same key risks leaking it, which sits badly with fee-bumping through RBF or CPFP.
IN SUMMARY
Four things worth taking away
What to watch from here
The prerequisite for everything else. Until it is submitted, the rest stays where it is.
Whether it moves from Draft to Complete. The BIP editor has said it can’t until the signature BIP exists.
6 bits in September 2025, 15 in April 2026. The distance left to Bitcoin’s 256 is the clearest single indicator.
BIP-361 has already been rewritten once. There is plenty of room for objections to reshape the design again.
FINALLY
This site was built from the primary sources: the master versions of BIP-360 and BIP-361 in bitcoin/bips. A lot of writing online still reflects the versions published at the time. Anything describing BIP-361 as a freeze proposal is describing something different from the current text.
This field moves quickly, and what you have read here will date. When something matters to you, follow the links in the footer and check the source. All of it is published in a form you can read for yourself.