Quantum-resistant Bitcoin: BIPs 360 and 361
Two proposals for the day quantum computers can break elliptic-curve keys.
Two proposals answer the same question: what happens to Bitcoin's signatures if quantum computers can break elliptic-curve keys.
| BIP | Title | Type | Status | Assigned |
|---|---|---|---|---|
| 360 | Pay-to-Merkle-Root (P2MR) | Consensus (soft fork) | Draft | 2024-12-18 |
| 361 | Post Quantum Migration and Legacy Signature Sunset | Consensus (soft fork), Informational | Draft | 2026-02-11 |
BIP 360: Pay-to-Merkle-Root
P2MR keeps Taproot's tree of scripts but removes the key-path spend, so an output never reveals a public key until it is spent. That guards against long-exposure attacks on keys sitting on chain. Keys revealed in the mempool while a payment waits for a block (short exposure) would still need post-quantum signatures, which the authors leave to a later proposal.
BIP 361: the sunset plan
- Phase A
- After a post-quantum output type exists, sending to quantum-vulnerable addresses is no longer allowed.
- Phase B
- A pre-announced flag day five years after activation: legacy ECDSA and Schnorr spends must go through a quantum-safe rescue protocol, so vulnerable coins cannot simply be stolen.
The authors' motivation: NIST ratified three post-quantum signature schemes in 2024, and over 34% of bitcoin had a revealed public key on March 1, 2026.
Questions
- Is Bitcoin vulnerable to quantum computers?
- Not today. A large enough quantum computer running Shor's algorithm could derive a private key from a public key. Coins whose public key is already on chain would be at risk; BIP 361 puts that at over 34% of all bitcoin as of March 1, 2026.
- What is BIP 360?
- Pay-to-Merkle-Root (P2MR): a proposed output type that works like Taproot without the key-path spend, so no public key sits exposed on chain. It protects against long-exposure attacks; short-exposure attacks in the mempool would need post-quantum signatures.
- What is BIP 361?
- A migration plan by Jameson Lopp and co-authors. Phase A stops sending to quantum-vulnerable addresses; Phase B, at a flag day five years after activation, restricts old ECDSA and Schnorr spends behind a quantum-safe rescue protocol.
- Does this affect miners?
- Both are consensus changes that would need a soft fork. Miners would signal and enforce them, and BIP 361's authors note that a quantum attack could also hurt miners' ability to secure the network.
Sources
Meet the people who mine and build Bitcoin
Soft forks only happen when miners, node operators and developers line up. Mining Disrupt 2027 puts them in one room, March 22–24 at the Irving Convention Center, Dallas. Get a pass or exhibit.
More: All BIPs · BIPs for miners · BIP 54 · BIP 323 · Covenant BIPs · Taproot · BIP 110
Three days. One floor. The whole industry.
March 22–24, 2027 · Irving Convention Center · Dallas
Mining Disrupt is NOT affiliated with any other brands, groups, events, meetups, individuals, sponsors, exhibitors, agents, or referrals, except the Industry Ambassadors listed on this site. We do not sell any lists. Beware of scams claiming otherwise.
There are imitators and scammers using our name to solicit sponsors and attendees. Always verify directly through our official Telegram group. Stay vigilant!
Mining Disrupt Policy: No refunds. No outside food or drinks. No third-party event solicitations.
Unauthorized solicitation, sales, advertising, product demonstrations, or distribution of promotional materials, including magazines, brochures, flyers, catalogs, business literature, and promotional giveaways, is strictly prohibited anywhere within the event venue unless expressly authorized by Mining Disrupt.
Marketing activities are reserved exclusively for approved exhibitors, sponsors, and authorized event partners. Attendees found engaging in unauthorized promotional activities may be required to cease immediately, surrender promotional materials, and may have their event credentials revoked without refund at the sole discretion of event management.