A new proposal circulating among Bitcoin developers is forcing the network to confront a long-standing theoretical risk: the impact of quantum computing on its cryptographic foundations.
Bitcoin Improvement Proposal 361 (BIP-361), introduced by a group of researchers including Jameson Lopp, outlines a structured plan to migrate the network away from legacy signature schemes and toward quantum-resistant alternatives. If adopted, the proposal would impose a phased deadline that could ultimately render unmigrated coins permanently unspendable.
The proposal aims to reduce Bitcoin’s exposure to a future scenario in which sufficiently advanced quantum computers can break the elliptic curve cryptography that underpins its current system.
“Even if Bitcoin is not a primary initial target of a cryptographically relevant quantum computer, widespread knowledge that such a computer exists and is capable of breaking Bitcoin’s cryptography will damage faith in the network,” the BIP authors wrote.
Today, Bitcoin relies on ECDSA and Schnorr signatures to secure transactions. Both remain robust against classical computing but are theoretically vulnerable to Shor’s algorithm, which could allow an attacker to derive private keys from exposed public keys. This risk is not evenly distributed across the network. Older address types, particularly pay-to-public-key outputs and reused addresses, reveal public keys onchain and are considered the most vulnerable.
Estimates cited by the proposal suggest that more than one-third of all bitcoin in circulation falls into this category, including early holdings attributed to Satoshi Nakamoto. In a quantum attack scenario, those funds could be compromised, potentially destabilizing the network and redistributing wealth to technologically advanced actors.
The proposal’s transition phases
BIP-361 introduces a three-phase transition designed to preempt that outcome. Phase A, expected roughly three years after activation, would prohibit new transactions from sending funds to legacy address types. While users could still move funds out of vulnerable addresses, the restriction would push wallets and services toward adopting quantum-resistant formats.
Phase B, beginning about two years later, would escalate the transition by invalidating all legacy signatures at the consensus level. At that point, any bitcoin that has not been migrated would become effectively frozen, unable to be spent under network rules.
A proposed Phase C, still under research, would offer a limited recovery mechanism. This would rely on zero-knowledge proofs tied to seed phrases, allowing users to demonstrate ownership of frozen funds without exposing private keys. The feasibility and timeline of this phase remain uncertain.
The proposal frames the forced migration as a defensive measure rather than a punitive one. By freezing coins that fail to upgrade, the authors argue the network can eliminate a major attack surface before quantum capabilities emerge.
They also note that permanently inaccessible coins would reduce effective supply, a dynamic long discussed within Bitcoin’s economic model.
No activation timeline has been set, and BIP-361 remains in draft form.