A draft BIP-361 titled “Post Quantum Migration and Legacy Signature Sunset” was published on Bitcoin’s BIP repository on GitHub. It was co-authored by several contributors in the Bitcoin quantum security space, including Jameson Lopp, Casa co-founder and others.
Bitcoin’s original cryptography primarily ECDSA over the secp256k1 curve is vulnerable to future quantum computers via Shor’s algorithm, which could theoretically derive private keys from public keys. The biggest risk applies to early addresses especially Pay-to-Public-Key or P2PK outputs from 2009–2011, where the public key is directly exposed on the blockchain.
Modern addresses like P2PKH, P2SH, Bech32 only reveal the public key when spending, reducing but not eliminating the risk for unspent outputs. Estimates suggest roughly 1.7 million BTC sometimes cited as high as part of ~6–7 million BTC total vulnerable supply sit in these legacy formats. This includes: The ~1.1 million BTC widely attributed to Satoshi Nakamoto’s early mining wallets (valued at around $74–75 billion at current prices).
Other dormant OG wallets from the 2010–2011 era. If a cryptographically relevant quantum computer (CRQC) emerges, an attacker could potentially steal these funds by cracking the exposed public keys. Recent discussions including a Google quantum research paper have highlighted timelines as potentially tightening toward the late 2020s in worst-case scenarios, though practical threats remain years away.
It builds directly on BIP-360 which introduced a new quantum-resistant output type called Pay-to-Merkle-Root or P2MR. BIP-361 outlines a three-phase sunset migration via a soft fork to incentivize moving funds to quantum-safe formats while eventually deprecating legacy signatures.
Phase A; triggered ~160,000 blocks /~3 years after activation: Prohibit new sends to legacy quantum-vulnerable addresses. All new transactions must use quantum-resistant types. Phase B ~5 years after activation, or 2 years after Phase A in some descriptions: Legacy ECDSA/Schnorr signatures become invalid on the network.
Any unmigrated funds in vulnerable addresses are effectively frozen permanently unspendable. Phase C: Introduce a mechanism allowing some owners to prove ownership and recover frozen funds without exposing keys broadly. The goal is proactive defense: Prevent a quantum heist that could flood the market with stolen coins, erode trust, or destabilize Bitcoin.
Proponents frame it as turning quantum security into a private incentive for holders to migrate.
The proposal is already sparking debate: Seen as responsible forward-planning by quantum security experts. Doing nothing risks catastrophic theft; freezing protects the network’s integrity long-term. Critics call it authoritarian, a violation of Bitcoin’s immutability and don’t trust, verify ethos. Freezing coins especially Satoshi’s touches on sacred principles like property rights and decentralization.
Some worry it could lead to chain splits, forced migrations with high fees or custody risks, or precedent for other interventions. Others argue the quantum timeline doesn’t yet justify such drastic steps. BIP-361 is still a draft—it would require broad consensus, testing, and activation likely via soft fork signaling like previous upgrades.
Not all vulnerable coins would be affected equally; coins in addresses without exposed public keys are safer until spent. This fits into broader ongoing work on post-quantum cryptography for Bitcoin. The network has time to deliberate, but the discussion is heating up as quantum hardware advances.






