BIP 361: Bitcoin's Five-Year Quantum Migration Plan

A draft Bitcoin Improvement Proposal would stop users sending bitcoin to quantum-vulnerable addresses about three years after it activates, and restrict spending with Bitcoin’s current signatures two years after that. BIP 361, titled “Post Quantum Migration and Legacy Signature Sunset”, is written by Jameson Lopp and five co-authors. It was merged into the Bitcoin BIPs repository as a draft on 14 April 2026, according to the repository’s change history, and its rescue-protocol section was corrected three days later.

The proposal is a draft, not a change to Bitcoin. It depends on a separate proposal for a post-quantum signature type, which its header lists as “TBD”, and any change to the consensus rules would need wide support from node operators, miners and users.

How the two phases would work

BIP 361 describes itself as turning “quantum security into a private incentive: fail to upgrade and you will encounter additional friction to access your funds”.

Phase A would begin 160,000 blocks, roughly three years, after activation. From then on, the only permitted sends from legacy scripts would be to post-quantum scripts, so no new funds could go into quantum-vulnerable addresses. Existing coins would stay where they are.

Phase B would follow two years later. Nodes would tighten the rules for verifying ECDSA and Schnorr signatures by requiring a “quantum-safe rescue protocol”. The aim, the authors write, is to “rule out quantum attackers, but to permit spends from the authentic coin-holders”. One example they give is a proof that the owner knows a wallet’s parent key under BIP-32 hardened derivation, which a quantum attacker would be unlikely to know.

Old pay-to-public-key coins are a special case. The authors say no rescue protocol is currently thought possible for them, and support a separate “Hourglass” style proposal for those coins.

The authors’ case

The authors say that as of 1 March 2026, “over 34% of all bitcoin have revealed a public key on-chain”, and that those coins could be stolen by a large enough quantum computer. They warn that an attacker might move funds slowly so as not to be noticed, and that upgrades to Bitcoin “historically” take years. “This proposal is radically different from any in Bitcoin’s history just as the threat posed by quantum computing is radically different,” they write.

The proposal cites McKinsey for estimates of a cryptographically relevant quantum computer “as early as 2027-2030”, and Google for algorithms “improving up to 20X”. The Google research it links, from May 2025, found that RSA-2048 encryption could in theory be broken by a quantum computer with about 1 million noisy qubits running for a week, a 20-fold cut on its 2019 estimate. That work concerns RSA rather than the elliptic-curve signatures Bitcoin uses, and Google noted that machines with relevant error rates then had only about 100 to 1,000 qubits.

The BIP also says NIST “ratified three production-grade PQ signature schemes in 2024”. NIST’s August 2024 release finalised three standards, but only two, ML-DSA and SLH-DSA, are for signatures; the third, ML-KEM, is for key exchange. A FALCON-based signature standard was still to come.

Why the rescue protocol decides how harsh this is

Critics of plans like this say they break the principle that only the holder of a key decides what happens to their coins. BIP 361’s answer depends almost entirely on Phase B. If rescue protocols can cover most coins, the authors argue, restricting old signatures “will be at most mildly confiscatory”. If they cannot, more coins become stuck, and the BIP is open that “abandoned keys that never migrate remain unspendable”, which it lists as a benefit.

So the important unknowns are technical rather than political: which signature scheme Bitcoin adopts, how many wallets can produce the proofs a rescue protocol would need, and what happens to the oldest coins. Those questions are already being worked on elsewhere, from Coinbase’s stated position on the transition to the Quantum Alliance of blockchain groups.

The timescales are comparable with government plans. The UK’s National Cyber Security Centre has asked organisations to plan by 2028, carry out priority migrations by 2031 and finish moving to post-quantum cryptography by 2035. The UK is also funding domestic quantum companies, as we reported in our story on new UK quantum grants. Europol has made the point that the near-term risk is keys already exposed on-chain, as we covered in our Europol report.

Correction, 22 October 2026: an earlier version of this article described a three-phase plan ending in a “Phase C” under which unmigrated coins would become permanently unspendable, and put Phase B at five years after activation as a separate step. BIP 361 has two phases; Phase B comes two years after Phase A and is designed to let genuine holders spend through a rescue protocol. We have also corrected the description of NIST’s 2024 standards and removed an unsourced dollar figure.