BIP 361 is a draft Bitcoin Improvement Proposal designed to prepare Bitcoin for a future in which sufficiently powerful quantum computers could break its current digital signatures.
Officially titled “Post Quantum Migration and Legacy Signature Sunset,” the proposal would create a deadline-driven migration away from Bitcoin addresses protected by ECDSA or Schnorr signatures.
The goal is not to change Bitcoin immediately. BIP 361 attempts to establish a plan that could be activated after Bitcoin adopts a new post-quantum output type.
For broader protocol and network coverage, follow CoinSaga’s Bitcoin News section.
Why Quantum Computing Could Threaten Bitcoin
Bitcoin ownership is protected through public-key cryptography.
When users spend certain Bitcoin outputs, their public key becomes visible onchain. Today, deriving the corresponding private key is considered computationally infeasible.
A sufficiently advanced quantum computer running algorithms such as Shor’s algorithm could theoretically reverse that protection and calculate private keys from exposed public keys.
An attacker could then create valid signatures and steal vulnerable bitcoin without obtaining the original wallet or seed phrase.
The BIP’s authors claim that more than 34% of the bitcoin supply had exposed a public key onchain as of March 2026. This estimate comes from the proposal and should be treated as the authors’ assessment rather than an independently established deadline for a quantum attack.
Phase A: Stop Creating New Vulnerable Outputs
The first stage would encourage migration toward post-quantum addresses.
After Phase A activates, transactions would generally be permitted to move funds from legacy scripts into post-quantum scripts. Sending funds into quantum-vulnerable output types would no longer be accepted under the new consensus rules.
The current draft schedules Phase A approximately 160,000 blocks, or around three years, after BIP 361 activation.
This would affect:
- wallets generating receiving addresses;
- exchanges processing deposits and withdrawals;
- custodians holding bitcoin for clients;
- merchants accepting BTC;
- individuals storing funds in legacy address types.
Users would therefore have a clear incentive to upgrade before the next phase.
Phase B: Restrict Legacy Bitcoin Signatures
Phase B would begin approximately two years after Phase A.
At that point, nodes would tighten the conditions under which ECDSA and Schnorr signatures could spend legacy outputs. The current Bitcoin BIPs repository describes this as using a quantum-safe rescue protocol intended to distinguish authentic holders from attackers who calculated a private key with quantum computing.
The exact rescue method has not been finalized.
One possibility involves proving knowledge of information that the original owner possesses but a quantum attacker would probably not know, such as a parent private key from a hardened hierarchical deterministic wallet.
This is one reason BIP 361 depends on additional research and a separate post-quantum signature proposal.
Could Old Bitcoin Become Frozen?
Potentially, yes.
Funds that are not migrated before the legacy-signature sunset could become difficult or impossible to spend through their original signature method.
Supporters see this as necessary to stop quantum attackers from stealing abandoned or exposed coins. Critics may view it as confiscatory because legitimate owners who fail to migrate could lose normal access.
The proposal tries to address this with rescue mechanisms based on cryptographic proof of original wallet ownership. However, not every old output can necessarily be linked to an HD wallet seed.
Very early pay-to-public-key outputs are particularly difficult because many were created before BIP 32 hierarchical deterministic wallets existed.
Is BIP 361 Already Approved?
No.
BIP 361 is currently marked Draft and Informational. It has been assigned a BIP number, but that does not mean it has been accepted, activated or implemented in Bitcoin Core.
The official BIPs repository explicitly states that publication only means a proposal meets the repository’s formal criteria. Adoption ultimately depends on technical review and support from Bitcoin users, developers, miners, businesses and the wider economic network.
The proposal can also change. Some wording on BIP361.org differs from the latest text in the Bitcoin BIPs repository, showing that its phases and recovery model are still evolving.
Why BIP 361 Matters
BIP 361 matters because it moves Bitcoin’s quantum-security debate from an undefined future problem toward a concrete migration framework.
Its core argument is that waiting until a quantum attack becomes visible may be too late. Wallets, exchanges, custodians and miners could require years to adopt new address formats and security infrastructure.
At the same time, BIP 361 would introduce unprecedented trade-offs involving backward compatibility, potentially frozen funds, larger signatures and difficult questions about who should be allowed to recover vulnerable bitcoin.
Final Thoughts
BIP 361 proposes a staged sunset of Bitcoin’s current ECDSA and Schnorr signature systems after a post-quantum alternative becomes available.
Phase A would stop users from creating new quantum-vulnerable outputs. Phase B would restrict legacy spending and potentially require an additional proof that the spender is the authentic owner.
It is an important proposal, but it remains an early draft—not Bitcoin’s confirmed quantum upgrade.
