What is BIP-360? A plain-English explanation

Updated August 6, 2026

BIP-360 is a draft proposal for a new Bitcoin address format designed to resist attacks from a future quantum computer, and it has not been adopted by the network. It's still a proposal, not a rule Bitcoin runs on today.

If you've read the main explainer on quantum risk to Bitcoin, you already know the short version: nothing that exists right now can break Bitcoin's cryptography, but the people who maintain the protocol like to plan decades ahead. BIP-360 is one piece of that planning. This page goes a level deeper into what it actually proposes and why the fix isn't as simple as it might sound.

Why you can't just patch the old address types

Bitcoin's signatures depend on elliptic curve math over the secp256k1 curve. A quantum computer running Shor's algorithm could, in theory, take a public key and work backward to the private key that produced it. That's not a weakness you patch by making numbers bigger. It's a different category of problem than the one quantum computers pose to hash functions.

Hash-based security (the kind protecting an address before its first spend) only faces Grover's algorithm, which gives a quantum computer a quadratic speedup at best. You defend against that by using a longer hash output. Simple, and no redesign needed. Shor's algorithm is a different animal. It doesn't just speed up the attack, it solves the underlying discrete logarithm problem efficiently. There's no "use a bigger secp256k1 key" fix, because the whole curve becomes tractable, not just slower to break. The only real defense is switching to a signature scheme built on math that Shor's algorithm doesn't help with, which means a new address format, not a patched old one.

What BIP-360 actually proposes

BIP-360, alongside the related BIP-361, sketches out a new type of Bitcoin address and output script built around a post-quantum signature scheme, plus a path for wallets and users to move funds into it over time. The general direction draws on the same family of algorithms NIST finalized as standards in 2024, things like ML-DSA (based on CRYSTALS-Dilithium) and SLH-DSA (based on SPHINCS+), rather than inventing something from scratch.

Beyond that, I'd rather be honest than precise: the exact scheme, the signature sizes, and the transition mechanics are still being argued over by contributors, and draft BIPs change shape as review continues. Post-quantum signatures also tend to be much larger than the ECDSA or Schnorr signatures Bitcoin uses now, which has real consequences for transaction fees measured in sats (worth a glance at the sats converter if you want a feel for how those unit costs stack up). None of that is locked in yet, and anyone telling you the final spec today is getting ahead of the process.

Why a new format is harder than it sounds

Adding a new address type is the easy part. Bitcoin has done it before: SegWit in 2017, Taproot in November 2021. The harder question is what happens to coins that never move to the new format, especially the ones that already have an exposed public key sitting on-chain.

An estimated 5.4 million BTC, roughly a quarter of the 21 million total supply, already sits in addresses where the public key is exposed, mostly because those addresses were spent from at some point. About 1.1 million BTC of that is tied to Satoshi Nakamoto's early mining, untouched since around 2010. You can check where any specific address lands on that spectrum with the wallet checker, which looks at spend history and address type to show an exposure tier.

The genuinely uncomfortable part

Some proposals floated alongside BIP-360 go further than just offering a new address type. They'd eventually restrict spending from long-dormant, exposed addresses, most visibly the Satoshi-era coins, if the owner doesn't migrate within some window. That idea runs straight into one of Bitcoin's oldest norms: nobody gets to decide whose coins are allowed to move. Whether the community would actually adopt something like that, and how it would even be enforced without a central authority making the call, is unresolved. I'm not going to pretend there's consensus on it, because there isn't.

Where things actually stand

As of now, BIP-360 is a draft. It hasn't activated, there's no deployed code path using it on mainnet, and no fixed date for when or if it will. Estimates for when a quantum computer capable of threatening secp256k1 might exist range from several years to a decade or more, and honestly, nobody knows for certain. That uncertainty is exactly why the proposal is being worked through carefully rather than rushed. Ethereum and most other cryptocurrencies built on elliptic curve cryptography face a version of this same question, so Bitcoin isn't unusually exposed here, it's just the one with the most value and history riding on getting the transition right.

What isn't settled yet is the exact signature scheme, the finished address format, and the transition timeline, and I won't pretend those questions have answers before the BIP review process actually settles them. Nothing calling itself the final version of BIP-360 today is one.