BIP-360 (Pay-to-Quantum-Resistant-Hash)

What Is BIP-360?

BIP-360 is a Bitcoin Improvement Proposal that defines a quantum-resistant address format for Bitcoin. Originally titled Pay-to-Quantum-Resistant-Hash (P2QRH) and later renamed to Pay-to-Merkle-Root (P2MR), the proposal was authored by Hunter Beast (MARA), Ethan Heilman, and Isabel Foxen Duke. First proposed on the Delving Bitcoin forum in June 2024, BIP-360 was merged into the official Bitcoin BIP repository on February 11, 2026.

The core problem BIP-360 addresses is that Bitcoin's current cryptography relies on elliptic curve cryptography (specifically the secp256k1 curve), which a sufficiently powerful quantum computer could break using Shor's algorithm. When a public key is exposed on-chain, a quantum attacker could derive the corresponding private key and steal funds. BIP-360 removes the need to ever expose a classical public key by committing only to a Merkle root of post-quantum-safe scripts.

How It Works

BIP-360 builds on the SegWit versioning system that Bitcoin already uses. While P2WPKH uses witness version 0 and P2TR (Taproot) uses witness version 1, BIP-360 introduces witness version 2. Addresses begin with the bech32m-encoded prefix bc1z.

P2MR vs P2TR

The design closely mirrors Taproot but with one critical difference: it removes the key-path spend. In a standard P2TR output, the witness program commits to a tweaked public key that enables two spending paths: a fast key-path spend (using the internal public key directly) and a script-path spend (using the Merkle tree of tapscripts). The key-path spend is what makes Taproot vulnerable to quantum attacks because it requires exposing an elliptic curve public key on-chain when spending.

P2MR eliminates the key-path entirely. The output commits only to the 32-byte Merkle root of the script tree. Spending always goes through the script path, where post-quantum signature verification opcodes can be used.

# P2TR ScriptPubKey (witness v1, vulnerable key-path)
OP_1 OP_PUSHBYTES_32 <tweaked_public_key>

# P2MR ScriptPubKey (witness v2, no key-path)
OP_2 OP_PUSHBYTES_32 <merkle_root>

Post-Quantum Signature Algorithms

BIP-360 itself does not mandate a specific post-quantum cryptography (PQC) algorithm. Instead, it provides the address format and spending framework. PQC signature verification would be added via tapscript opcodes (using currently reserved OP_SUCCESSx codes). The leading candidates are all NIST-standardized algorithms:

For comparison, current Schnorr signatures on secp256k1 are 64 bytes with a 32-byte public key. Even the most compact PQC option (FALCON-512 at 666 bytes) represents roughly a 10x increase in signature size.

Control Block and Witness Structure

The P2MR control block is slightly more compact than P2TR's because it omits the 33-byte internal public key. A P2MR control block is 1 + 32m bytes (where m is the Merkle tree depth, 0 to 128), compared to P2TR's 33 + 32m bytes. The minimal witness size for a single-leaf script tree is 103 bytes before adding the PQC signature itself.

The Quantum Threat to Bitcoin

The urgency behind BIP-360 stems from accelerating progress in quantum computing. A March 2026 paper from Google Quantum AI estimated that breaking secp256k1 would require fewer than 500,000 physical qubits: a 20x reduction from the 9 million qubits estimated in Litinski's 2023 analysis. DARPA stated in March 2026 that building a utility-scale quantum computer by 2033 "seems more likely than not."

Not all Bitcoin address types face equal risk. Addresses that have already exposed their public key on-chain are most vulnerable:

• P2PK (Pay-to-Public-Key): the public key sits directly in the output script. Approximately 1.72 million BTC are held in these addresses, including an estimated 1.1 million BTC attributed to Satoshi Nakamoto's early mining outputs.
• Reused P2PKH/SegWit addresses: the public key is revealed after the first spend. Approximately 4.9 million BTC are held at reused addresses with exposed keys.
• P2TR (Taproot) key-path spends: the public key is exposed on-chain when the output is spent, creating a similar vulnerability window.

In total, an estimated 6.5 to 6.9 million BTC (roughly 30% of circulating supply) are considered at risk. For a deeper analysis, see the research article on Bitcoin's Taproot quantum vulnerability and the overview of post-quantum cryptography threats to Bitcoin.

Harvest Now, Decrypt Later

A key concern is the "harvest now, decrypt later" attack model. Even before quantum computers can break secp256k1 in real time, attackers can record Bitcoin transactions and exposed public keys today, then derive private keys once quantum hardware matures. This means the migration timeline is more urgent than the quantum computing timeline alone would suggest: BIP-360 co-author Ethan Heilman estimates a full migration would take approximately seven years if started immediately. NIST recommends completing migration to post-quantum cryptography by 2035. For more context, see the research article on harvest-now-decrypt-later attacks on Bitcoin.

Deployment and Migration

BIP-360 is designed as a soft fork, following the same backward-compatible upgrade path used for SegWit and Taproot. Legacy nodes would treat P2MR outputs as "anyone-can-spend," while upgraded nodes enforce the new spending rules. This means the upgrade does not require unanimous network adoption to activate.

Migration is voluntary: users move their funds to new bc1z addresses at their own pace. The P2MR format maintains compatibility with existing tapscript-based protocols, which means systems built on Lightning, BitVM, and Ark could transition without fundamental architectural changes.

BIP-361: The Companion Migration Proposal

A companion proposal, BIP-361, authored by Jameson Lopp and others and published in April 2026, outlines a more aggressive migration timeline. It proposes three phases: after activation, new BTC could no longer be sent to legacy addresses (Phase A, three years), then legacy ECDSA and Schnorr signatures would be invalidated entirely (Phase B, five years), and finally a zero-knowledge proof rescue mechanism would allow owners of frozen coins to prove ownership and recover funds (Phase C, still under research). BIP-361 has drawn significant debate, with some developers criticizing the coin-freezing mechanism. BIP-360 itself, which only enables voluntary migration, has broader community support.

Use Cases

Long-Term Cold Storage

The most immediate use case is protecting cold storage funds. Bitcoin held in multiyear or multigenerational custody arrangements faces the longest exposure window to future quantum attacks. Migrating these funds to P2MR addresses provides forward security: even if quantum computing advances faster than expected, the funds remain safe because no classical public key is ever exposed.

Institutional Custody

Institutional holders, including Bitcoin ETFs and corporate treasuries, face regulatory and fiduciary pressure to adopt quantum-safe cryptography. BIP-360 provides a concrete migration target. As NIST standards require post-quantum readiness by 2035, financial institutions holding Bitcoin will likely need to demonstrate compliance.

Protocol-Level Infrastructure

Layer 2 protocols and off-chain systems that rely on digital signatures for security (such as Lightning channels, multisig wallets, and discreet log contracts) will eventually need quantum-safe primitives. BIP-360 provides the on-chain foundation that these protocols can build upon.

Risks and Considerations

Transaction Size and Throughput

The most significant tradeoff is on-chain footprint. Post-quantum signatures are dramatically larger than their classical counterparts. Using ML-DSA-44 (CRYSTALS-Dilithium at NIST security level 2), signatures are roughly 35x larger than ECDSA. Analyses estimate that block capacity would drop from approximately 2,500 to 3,000 standard transactions per block down to roughly 500 to 700 PQC transactions: a 4 to 5x throughput decline. This would increase fee pressure unless offset by a witness discount or other scaling measures.

Algorithm Selection Uncertainty

BIP-360 deliberately avoids committing to a single PQC algorithm, which provides flexibility but also means the signature verification opcodes are not yet finalized. The PQC field is still maturing: NIST finalized its first post-quantum standards in 2024, but algorithm implementations continue to be refined. Choosing the wrong algorithm could require another migration in the future.

Migration Complexity

Migrating the entire UTXO set to quantum-safe addresses is a massive coordination challenge. At current transaction throughput, moving all existing UTXOs to P2MR addresses would take months to years of dedicated block space. Users who lose access to their keys (including Satoshi's estimated 1.1 million BTC) cannot migrate, leaving those coins permanently vulnerable.

Premature vs. Late Adoption

There is tension between acting too early and too late. Deploying quantum resistance before the threat materializes imposes costs (larger transactions, reduced throughput, engineering effort) without immediate benefit. But waiting too long risks a catastrophic loss event if quantum computing progresses faster than anticipated. The "harvest now, decrypt later" threat model suggests that the security window is already open: data exposed today can be attacked with future hardware.

Testnet Progress

As of March 2026, BTQ Technologies released a testnet (v0.3.0) with the first working BIP-360 implementation, enabling all five Dilithium signature opcodes within the P2MR tapscript context. The testnet attracted over 50 miners, 100,000 mined blocks, and 100+ contributing cryptographers and developers. While promising, significant work remains before BIP-360 is ready for mainnet activation.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.