Bitcoin Core merged BIP-361, a post-quantum migration proposal that could freeze legacy ECDSA and Schnorr-based coins before quantum computers crack them open.
Bitcoin Core contributors merged BIP-361 into the official proposals repository on April 15. The proposal carries a blunt title: “Post Quantum Migration and Legacy Signature Sunset.” Authored by Jameson Lopp and five co-authors, it outlines a phased plan to retire ECDSA and Schnorr signatures before a quantum computer makes them worthless.
Over 34% of all bitcoin had already exposed public keys on-chain as of March 1, 2026. That number comes directly from the BIP-361 document itself. Those UTXOs sit fully visible to any attacker with enough quantum capability.
The 1.7 Million BTC Nobody Talks About Losing
Three phases structure the whole thing. Phase A blocks new sends to legacy locking scripts roughly three years after activation. Phase B is the one drawing fire. At a set block height, nodes reject any transaction relying solely on ECDSA or Schnorr keys.
Lopp has been developing these ideas since mid-2025. The BIP builds directly on BIP-360, which introduced a new output type called pay-to-Merkle-root. That earlier proposal strips out the key-based spending path, the part most exposed to quantum-era risk.
WuBlockchain, on X, described the proposal as specifically targeting early P2PK addresses where public keys are already sitting exposed on-chain, noting those outputs are the core vulnerability the BIP attempts to close.
The coins at stake include an estimated 1,700,000 BTC tied to early P2PK outputs. Satoshi Nakamoto’s untouched holdings sit inside that number. Current value near $74,000 per coin puts that pile somewhere around $74 billion.
Phase C Is Where Things Get Complicated Fast
BIP editor murchandamus, who merged the final commits, was candid about his own view. He does not think the quantum threat materializes within the next few decades. Still, he pushed the proposal through. Publication in Draft status is not endorsement, he clarified on GitHub. It simply means the ideas are on-topic and ready for community consideration.
Contributor Ethan Heilman called the BIP “excellent” in his review on GitHub, though he pressed Lopp for more detail on why rejecting legacy transactions was chosen over freezing vulnerable outputs outright. The delta between those two approaches, he wrote, matters.
Phase C offers a recovery path. Users with frozen funds and an HD wallet seed phrase could construct a quantum-safe zero-knowledge proof to reclaim their coins. That mechanism does not exist yet. Conduition, reviewing after the merge, called this the single most critical piece of any confiscatory freezing proposal and argued the BIP is incomplete without it.
The deployment section was pulled before final approval. Lopp confirmed that move himself on GitHub, stating the preconditions for deployment have not been met. A consensus-backed post-quantum signature scheme must come first.
The Community Is Not Quietly Going Along With This
Pushback came fast. One GitHub reviewer called Phase B “active censorship.” Another said the proposal introduces permissioned transacting and throws out Bitcoin’s foundational principles. A separate reviewer pointed out that stolen quantum coins would be indistinguishable from legitimate spends, making the “just burn suspicious coins” argument unworkable.
Lopp’s response was direct. No one can be forced to migrate their coins. On the flip side, the GitHub thread records him writing, no one can be forced to accept coins from quantum-vulnerable signature schemes either.
Conduition flagged a fourth option the BIP omitted entirely. Restricting legacy spending conditions could block quantum theft while still letting authentic owners spend. That path got no section in BIP-361’s current draft.
The BIP does not set dates. It does not name which post-quantum signature scheme wins. It only describes what happens after those questions get answered. That alone is why conduition described the existing technical spec section as “really short” and the other 90% of the document as motivation and rationale.
What BIP-361 actually does is put a number on the problem. 34% of circulating supply. 1.7 million coins. A quantum attacker who moves slowly and quietly, bleeding funds over weeks without triggering chain watchers. That framing is now sitting in Bitcoin’s official proposal repository, and it is not going anywhere.
Be the first to comment