What a quantum-resistant Bitcoin address might actually look like
Updated August 6, 2026
A quantum-resistant Bitcoin address would carry a lattice-based or hash-based public key, such as ML-DSA or SLH-DSA, in place of today's elliptic curve key, with a signature running from several times larger to tens of kilobytes instead of the current 64 to 72 bytes. That's a replacement of the entire mathematical foundation of the signature, not just a bigger lock on the same design, and that difference is most of the reason this is a multi-year project rather than a version bump.
The problem in one sentence
Bitcoin signatures today rest on elliptic curve cryptography over the secp256k1 curve. The specific threat is Shor's algorithm, which, run on a sufficiently capable quantum computer, can solve the discrete logarithm problem that ECC's security depends on. That's a different and more serious issue than Grover's algorithm, which weakens hash functions somewhat but is generally dealt with just by using longer hash outputs, not a redesign. If you want the fuller picture of why this matters today and why it isn't urgent yet, the main explainer on quantum risk covers the timeline question in more depth.
Two different kinds of replacement math
In 2024, NIST finalized several post-quantum cryptography standards that the wider industry, Bitcoin included, now treats as the reference point. Two matter most here. ML-DSA (based on CRYSTALS-Dilithium) is a lattice-based signature scheme: newer math, relatively compact signatures, but an assumption that's only been studied hard for a decade or so. SLH-DSA (based on SPHINCS+) is hash-based: it leans only on the security of hash functions, which cryptographers trust deeply after decades of scrutiny, but its signatures run much larger, into the tens of kilobytes for some parameter sets.
A Bitcoin ECDSA or Schnorr signature today is roughly 64 to 72 bytes. Neither post-quantum candidate gets close to that. Every version of this trade-off comes down to picking between newer, smaller math and older, bulkier math, and Bitcoin hasn't settled on one yet.
What actually changes inside the address
A quantum-resistant address wouldn't just look different, it would carry different data. Bigger signatures mean bigger transactions, which means more block space consumed per spend and, likely, different fee dynamics once these addresses see real use. Fees are usually priced in sats per unit of that space rather than in whole coins, so anyone doing the arithmetic on what a heavier transaction actually costs may find a plain sats converter useful once real numbers are on the table. Wallet software would need new code paths to generate and validate the new key type, hardware wallets would need firmware updates, and block explorers and indexers would need to recognize a new witness version. None of that is exotic engineering, but all of it has to happen before anyone can safely move coins into the new format.
BIP-360, BIP-361, and the migration question
BIP-360 and BIP-361 are the draft proposals sketching out what a post-quantum address type and its migration path could look like. They're still drafts, under active review and revision, so treat any specific technical detail from them as provisional rather than settled protocol. What's clearer is the shape of the debate around them: roughly 5.4 million BTC, about a quarter of all bitcoin that will ever exist, already sits in addresses with an exposed public key, mostly because those addresses have spent before. About 1.1 million of that is tied to Satoshi-era mining, dormant since around 2010.
Some proposals floated in that debate would eventually restrict spending from long-dormant, exposed addresses if the owner hasn't migrated within some window. That's a genuinely uncomfortable idea for a lot of bitcoiners, because it means someone would have to decide whose coins are allowed to move, which cuts against one of Bitcoin's oldest norms. Expect that argument to run for a while yet, independent of the cryptography itself.
| Address type | Public key visible before first spend | Migration relevance |
|---|---|---|
| P2PKH ("1...") / P2SH ("3...") | No, only a hash is public until spent | Lower urgency if funds have never moved |
| SegWit v0, P2WPKH/P2WSH ("bc1q...") | No, same hash-first model | Lower urgency if funds have never moved |
| Taproot, P2TR ("bc1p...") | Yes, the key is committed in the address itself | Exposed from the moment funds arrive |
If you want to see where a specific address sits on that spectrum, the wallet checker looks up the on-chain spend history for a given address and estimates which exposure tier it falls into.
Why this is a rollout, not a switch
Even once a BIP is finalized, activation follows the same path Taproot did: a proposal, community review, a soft fork activation mechanism, then a long tail of wallets, exchanges, and custodians actually adding support. Segwit took years to reach majority adoption after its 2017 activation, and it didn't require anyone to accept new math, just a new script format. A post-quantum address type asks more of the ecosystem, and then it asks something bigger of users: actually generating a new address and moving funds into it, which is optional and slow by nature. Coins that never move stay exactly where they are, in whatever address type they started in, until someone with the keys chooses otherwise.
What we genuinely don't know yet includes which scheme, or combination of schemes, Bitcoin will settle on; how large the final signature overhead will end up being once a BIP stabilizes; whether any dormant-coin restriction ever gets real consensus; and, underneath all of it, how many years or decades remain before a quantum computer capable of threatening secp256k1 actually exists. Estimates for that last point still range from several years to a decade or more, and nobody serious is claiming more precision than that.