A golden Bitcoin coin, one half solid and intact, the other half dissolving into a geometric quantum-circuit pattern made of blue light fragments
Original illustration generated with AI (Adobe Firefly) — not representative of real data.

Bitcoin's Quantum Problem: What BIP-360 Fixes, and What BIP-361 Wants to Do About the Rest

NodeWitness Team 4 min read

"Your keys, your coins" has an unspoken asterisk most holders never think about: it assumes no one can ever freeze what's yours. In April 2026, a coalition of Bitcoin developers put a proposal on the table that would do exactly that, on a multi-year timeline, to roughly $75 billion worth of coins that never move to safer addresses. That proposal is BIP-361, and it's a different document from the one actually making headlines for the right reasons: BIP-360.

Two proposals, one confused headline

Coverage of "Bitcoin goes quantum-resistant" tends to blur BIP-360 and BIP-361 into one story. They're not the same thing, and the distinction matters for anyone trying to judge how urgent this actually is, which ties directly into why address reuse is a mistake: the exact same habit already worth avoiding for privacy is, it turns out, also the one that determines your exposure here.

BIP-360, technically Pay-to-Merkle-Root (P2MR), merged into the BIPs repository on February 11, 2026. It introduces a new address type designed to avoid revealing a real public key on spend, unlike Taproot today. Its authors describe it explicitly as a first step, not a full fix — it doesn't yet include a quantum-resistant signature scheme itself. That part is deferred to future proposals. What P2MR does now is remove the piece of the problem that can already be removed, without waiting on cryptography that isn't finalized yet.

Exposure isn't uniform, and that's the part worth understanding

Comparison between a Bitcoin address that has only received funds (public key not exposed) and one that has already spent at least once (public key written on-chain)
Original diagram: exposure depends on whether an address has ever spent, not on how much it holds.

A Bitcoin address is technically a hash of a public key, not the key itself. As long as an address only receives funds, the actual public key never touches the chain. The moment it does is the moment you spend from it: the signature, and the public key behind it, gets written permanently. Two wallets holding identical balances can carry completely different exposure: one has never spent and its key stays hidden; the other spent once, years ago, and its key has been public ever since.

The number that actually frames this

Roughly 34% of circulating Bitcoin sits in addresses with an already-exposed public key — a mix of Satoshi-era coins that never moved under modern key management and ordinary addresses that simply spent at least once.

On timing, estimates vary by source rather than converging on one date. Industry roadmaps from IBM, Google, Microsoft, Amazon, and Intel point to a window measured in a handful of years; the US federal government has set 2035 as its own deadline to migrate off ECDSA. None of these are hard predictions: they're planning assumptions from very different institutions, but they agree on the order of magnitude: years, not the comfortable decades some assume.

BIP-361 is where the real disagreement lives

This is the part that actually splits opinion, and it's worth not conflating with BIP-360. BIP-361, a separate document with its own co-authors (including Casa CTO Jameson Lopp), lays out what happens to coins that never migrate. In phases, spread over years after any hypothetical activation: an early phase would stop legacy address types from receiving new deposits; a later one would stop recognizing legacy signatures entirely, at which point anything still sitting in a vulnerable address is, in practice, frozen. A third piece is meant to let legitimate owners recover frozen funds by proving they hold the seed, using zero-knowledge proofs, without exposing the vulnerable key itself — but reviewers on the technical process have flagged it as the least finished of the three, and arguably the one the whole plan depends on.

The backlash was immediate. Freezing anyone's coins, however well-intentioned, runs straight into the promise that made Bitcoin trustworthy in the first place: no third party gets to decide your funds are inaccessible. Whichever side of that argument you land on, this is still a proposal, not policy: nothing here is active, approved, or scheduled.

What this actually means for you today

Nothing urgent. Neither proposal is live, and both would need broad network consensus before they could be. The one practical habit worth adopting is one you should already have for privacy reasons: stop reusing addresses, and when you have a choice, prefer moving funds toward an address that hasn't exposed its public key yet over leaving them indefinitely in one that has. It's not an emergency measure — it's the same wallet hygiene that was already a good idea.

Want to check whether any of your addresses has already exposed its key through reuse? The privacy audit tool checks your wallet for free, against our own Bitcoin node.

Last updated: September 5, 2026