Let's get the personal question out of the way.
Tell us roughly when and how you hold, and we'll tell you how exposed you are. No wallet connection, no tracking — this is a lookup, not a scan.
Your coins are in P2PK addresses with permanently exposed public keys and no BIP-39 seed. If BIP 361 activates, your only recovery hope is Phase C, which may not support early wallet formats. Move them to a modern wallet as soon as P2MR is available.
If you have ever spent from this address, your public key is visible on-chain. BIP 361's sunset would eventually freeze any coins still in legacy formats. Migrate to a P2MR-compatible wallet before Phase A.
Taproot key-path spends reveal your internal public key. BIP 360 removes this path entirely in P2MR. Re-send your taproot UTXOs to P2MR addresses once wallets support them.
SegWit v0 (P2WPKH) still uses ECDSA and will be sunset. You likely have a seed phrase, so zk-recovery may work in Phase C, but do not rely on it. Migrate proactively.
Pre-2013 wallets are almost certainly P2PK or early P2PKH. Both have exposed public keys. Treat this as highest risk until you confirm otherwise.
Your coins are in P2PK addresses with permanently exposed public keys and no BIP-39 seed. If BIP 361 activates, your only recovery hope is Phase C, which may not support early wallet formats. Move them to a modern wallet as soon as P2MR is available.
Standard P2PKH addresses are vulnerable once spent. You have time, but do not wait until Phase B. Move to a P2MR-compatible wallet well before the deadline.
Taproot key-path spends reveal your internal public key. BIP 360 removes this path entirely in P2MR. Re-send your taproot UTXOs to P2MR addresses once wallets support them.
You have a modern seed phrase and SegWit v0 outputs. The risk is manageable if you migrate before Phase A (~3 years post-activation). Use this time to verify your backup and wait for wallet support.
Addresses starting with '1' are P2PKH; 'bc1q' is SegWit; 'bc1p' is Taproot. If you don't know, check your wallet's receive history or use a block explorer.
Your coins are in P2PK addresses with permanently exposed public keys and no BIP-39 seed. If BIP 361 activates, your only recovery hope is Phase C, which may not support early wallet formats. Move them to a modern wallet as soon as P2MR is available.
Standard P2PKH addresses are vulnerable once spent. You have time, but do not wait until Phase B. Move to a P2MR-compatible wallet well before the deadline.
Taproot key-path spends reveal your internal public key. BIP 360 removes this path entirely in P2MR. Re-send your taproot UTXOs to P2MR addresses once wallets support them.
You are in the best position: modern seed backup, plenty of time, and no exposed public keys if unspent. Verify your backup, watch for P2MR wallet support, and migrate casually before Phase A.
Most wallets created after 2021 default to SegWit or Taproot. Check your receive addresses: 'bc1q' = SegWit, 'bc1p' = Taproot, '1' = legacy P2PKH.
Your coins are in P2PK addresses with permanently exposed public keys and no BIP-39 seed. If BIP 361 activates, your only recovery hope is Phase C, which may not support early wallet formats. Move them to a modern wallet as soon as P2MR is available.
Standard P2PKH addresses are vulnerable once spent. You have time, but do not wait until Phase B. Move to a P2MR-compatible wallet well before the deadline.
Taproot key-path spends reveal your internal public key. BIP 360 removes this path entirely in P2MR. Re-send your taproot UTXOs to P2MR addresses once wallets support them.
You likely have a modern seed phrase and unspent SegWit outputs. Risk is low if you migrate before Phase A. Use this time to verify your backup and wait for wallet updates.
Open your wallet and check a receive address. '1...' = legacy P2PKH (medium risk). '3...' = P2SH (medium risk). 'bc1q...' = SegWit (low risk if unspent). 'bc1p...' = Taproot (high risk due to key-path). If your wallet was created before 2013 or you mined early coins, treat as highest risk.
Open your wallet and check a receive address. '1...' = legacy P2PKH (medium risk). '3...' = P2SH (medium risk). 'bc1q...' = SegWit (low risk if unspent). 'bc1p...' = Taproot (high risk due to key-path). If your wallet was created before 2013 or you mined early coins, treat as highest risk.
Read up to the level you need.
Four passes over the same proposal. Each one adds detail without contradicting the last. Expand the next tier when you want more.
Bitcoin uses math puzzles to prove you own your coins. A powerful enough quantum computer could solve some of those puzzles instantly, letting thieves steal from addresses whose public keys are visible on the blockchain. BIP 360 creates a new, safer address type that hides the risky piece. BIP 361 sets a timeline to slowly freeze the old, vulnerable coins so they can't be stolen — but also can't be spent by their owners unless they move them in time.
BIP 360 introduces Pay-to-Merkle-Root (P2MR), a new output type similar to Taproot but without the quantum-vulnerable "key-path spend." That means your public key is never revealed on-chain, closing the window for a quantum attacker to derive your private key.
BIP 361 is the migration plan. It sunsets legacy ECDSAThe original Bitcoin signature scheme. Quantum-vulnerable once the public key is revealed. and SchnorrTaproot's signature scheme. Also quantum-vulnerable when the public key is exposed. signatures in three phases after activation:
- Phase A · year 3 no new deposits to vulnerable address types.
- Phase B · year 5 legacy signatures become invalid; unmigrated coins are frozen.
- Phase C · TBD a zero-knowledge recovery path for owners who still hold their seed phrases.
About 34% of all bitcoins have exposed public keys. The proposal does not recommend an algorithm yet; that will come in a follow-up BIP.
BIP 360 defines P2MR as a SegWit version 2 output using bech32m encoding (prefix bc1z). It preserves the full tapscript Merkle-tree semantics but omits the internal public key, eliminating the key-path spend entirely. All spends must provide a script path and Merkle proof. This removes the long-exposure attack surface where a public key sits visible on-chain indefinitely, while keeping compatibility with Lightning, BitVM, Ark, and complex custody scripts.
- P2MR spends are larger than P2TR key-path spends because they always reveal a script path and Merkle proof.
- Fees are slightly higher, but the size increase is modest compared to typical post-quantum signature schemes.
- It is a soft fork: non-upgraded nodes see P2MR outputs as anyone-can-spend, but upgraded nodes enforce the rules.
BIP 361 attaches a consensus-level sunset to legacy signature verification. Phase A is a relay/policy rule: standard nodes reject transactions that create new outputs to P2PK, P2PKH, P2WPKH, and P2TR key-path templates. Phase B is a consensus change: the script interpreter no longer accepts ECDSAThe original Bitcoin signature scheme. Quantum-vulnerable once the public key is revealed. or SchnorrTaproot's signature scheme. Also quantum-vulnerable when the public key is exposed. signatures for those legacy output types. Phase C proposes a zk-proof circuit tied to BIP-39 seed entropy, allowing owners to unlock frozen UTXOs into a P2MR output without revealing the original private key. The zk circuit is not yet specified.
The proposal explicitly does not choose a post-quantum signature algorithm. Authors expect a separate BIP for ML-DSA (Dilithium) or SLH-DSA integration. BIP 360 is therefore a preparatory structural change, not a complete post-quantum solution.
- BIP 360 draft bitcoin/bips
- BIP 361 draft bitcoin/bips
- Bitcoin Dev mailing list archive groups.google.com
- Co-author thread by Hunter Beast & Ethan Heilman: search bitcoin-dev for "Pay-to-Merkle-Root"
- Jameson Lopp's public comments: https://x.com/lopp (search "quantum sunset")
Three phases, one clock.
The years are illustrative — activation hasn't happened and the clock starts from there, not today. What matters is the ordering.
How close is this to actually happening?
A composite read, not a forecast. Every item below moves independently; today most of them are flat.
Taproot took ~4.5 years from BIP to activation. BIP 360/361 has no reference implementation yet. If you are pricing urgency, price years, not months.
Four live disagreements, mapped by type.
Not all arguments are the same argument. The top row could in principle be resolved with evidence or shared definitions. The bottom row is genuinely unresolvable — reasonable people can disagree.
Positioned, not ranked.
Author and critic sit on a For ↔ Against axis. Alternative proposals sit above it — they don't oppose, they reroute.