What Is BIP-360? Bitcoin's Quantum-Resistance Proposal Explained

Quantum computers cannot break Bitcoin's signature system today. But upgrading a global decentralized network can take years, so Bitcoin developers and researchers are discussing ways to reduce future quantum exposure well before a cryptographically relevant quantum computer exists.

One of the most developed proposals is BIP-360, which introduces a proposed Bitcoin output type called Pay-to-Merkle-Root (P2MR).

BIP-360 is sometimes described as Bitcoin's first major protocol-level step toward quantum resistance. That description is useful as long as one important point stays clear: BIP-360 is still a Draft proposal. It has not been activated on Bitcoin and has no scheduled activation date.

This guide explains what P2MR changes, what it leaves unchanged, how it differs from Taproot, and where it fits into Bitcoin's broader discussion about post-quantum migration.

Key Takeaways

• BIP-360 proposes a new Bitcoin output type called Pay-to-Merkle-Root (P2MR).

• P2MR works like Taproot but removes the "key path," so no public key sits exposed on the blockchain while coins are unspent.

• It protects against long-exposure quantum attacks, not short-exposure attacks during a transaction.

• It does not add post-quantum signatures. Those are planned for future proposals.

• BIP-360 was merged into the official BIPs repository in February 2026, but it remains a draft and is not scheduled for activation.

First, What Is a BIP?

BIP stands for Bitcoin Improvement Proposal. It is a design document that describes a possible change to Bitcoin, from wallet standards to changes in the rules every node follows.

Writing a BIP does not change Bitcoin. Neither does getting it merged into the official BIPs repository on GitHub. As Bitcoin Magazine notes in its report on how Bitcoin advances toward quantum resistance, a merge means the proposal is documented and open for discussion, not that it has been endorsed or scheduled. A consensus change like BIP-360 would still need broad community agreement, working code, and a soft-fork activation before it affects anyone's coins.

The Problem BIP-360 Is Trying to Solve

Bitcoin uses digital signatures to authorize spending. A sufficiently capable future quantum computer running Shor's algorithm could, in theory, derive a private key from an exposed elliptic-curve public key.

The important word is exposed.

Different Bitcoin output types expose public-key information at different times. Very old Pay-to-Public-Key (P2PK) outputs place a public key directly on-chain. Taproot (P2TR) outputs also contain a tweaked public key from the moment the output is created. Other common address types can hide the public key behind a hash while the output remains unspent, although spending or reusing keys can expose additional information.

BIP-360 focuses on a specific problem: providing a script-tree output with Taproot-like functionality that does not expose an elliptic-curve key in the output itself.

A Quick Taproot Refresher: Two Ways to Spend

A Taproot output can normally be spent through two main paths:

1. Key-path spending. The spender produces a Schnorr signature for the Taproot output key. This is compact and private, but the tweaked public key is already visible in the output before it is spent.

2. Script-path spending. The spender reveals one chosen Tapscript leaf and a Merkle proof showing that the script belongs to the committed script tree.

Taproot and Tapscript are used by a growing range of Bitcoin applications and protocol constructions. Some newer Lightning-related designs, BitVM-style constructions, Ark and other systems can make use of these capabilities, but Lightning itself predates Taproot and should not be described as being founded on it.

BIP-360 keeps the script-tree approach while removing the key-path option entirely. Instead of committing to an internal elliptic-curve key plus a script tree, P2MR commits only to the script-tree Merkle root.

How P2MR Works in Plain English

That is exactly what P2MR does. As the Ledger Academy glossary entry on BIP-360 and P2MR explains, instead of locking coins to a public key, a P2MR output locks them to a Merkle root, a single short fingerprint that commits to a whole tree of spending scripts.

Here is what that means in practice:

• While your coins sit unspent, the blockchain shows only the Merkle root. There is no public key for a quantum computer to attack.

• When you spend, you reveal just the script you are using, plus a short proof that it belongs to the tree.

• Wallets handle the complexity in the background. You would simply see a new address format.

According to the BIP's official specification, P2MR would be a new SegWit version 2 output, and mainnet P2MR addresses would start with bc1z, alongside today's bc1q (SegWit) and bc1p (Taproot) addresses.

Giannis Andreou's Medium explainer, Bitcoin's Quantum Upgrade Path: What BIP-360 Changes and What It Does Not, highlights another important point: scripting features such as multisig, timelocks, conditional payments, inheritance and custody setups all keep working, because they live in the script tree.

From P2QRH to P2MR: A Short History

BIP-360 has changed substantially since its earliest draft. The current canonical changelog shows a longer evolution than the name P2MR alone suggests.

The current authors are Hunter Beast, Ethan Heilman and Isabel Foxen Duke.

The important distinction is that inclusion in the BIPs repository makes BIP-360 a documented proposal for review. It does not mean Bitcoin developers, miners, node operators or users have agreed to activate it.

What BIP-360 Changes, and What It Doesn't

This is the part most headlines skip. BIP-360 is deliberately narrow.

The short-exposure gap matters. When you spend from a P2MR output, the script you reveal may still contain an elliptic-curve public key. A fast enough quantum attacker could, in theory, crack it in the minutes before your transaction is confirmed. The authors say closing that gap will require post-quantum signatures, which they have intentionally left to a separate future BIP so the output type can be debated on its own.

BIP-360 does not change Bitcoin's SHA-256 proof-of-work or the basic function of ASIC miners. OneMiners discusses that mining-versus-signature distinction in its quantum-computing article. However, use the official BIP rather than that article for the details of BIP-360 itself: the current BIP-360 specification does not include ML-DSA or any other post-quantum signature scheme.

The Trade-Offs

No upgrade is free. The main costs of P2MR are:

• Slightly bigger transactions. Without a key path, every spend goes through the script path, which carries more data. The specification gives an example of about 135 bytes of witness data for a simple P2MR spend, compared with 66 bytes for a Taproot key-path spend. That means somewhat higher fees, although P2MR is still smaller than an equivalent Taproot script-path spend.

• A big ecosystem effort. Wallets, exchanges, custodians and hardware wallets would all need to add support.

• User migration. Coins only become protected once their owners move them to P2MR addresses. Andreou expects this to happen gradually over years, the same way SegWit and Taproot adoption did.

Why Developers Are Acting Now

There is no public evidence that a quantum computer can break Bitcoin today, and estimates for when a cryptographically relevant quantum computer might exist vary widely.

The reason developers are discussing migration early is that large cryptographic transitions can take many years. Governments are already planning similar migrations in other systems.

In October 2026, the U.S. National Security Agency reiterated a transition schedule under which new commercial National Security Systems are expected to support quantum-resistant algorithms beginning in 2027, while legacy systems that cannot support the new standards are to be phased out by 2030. The broader U.S. national-security transition has a longer-term goal of quantum-resistant systems by 2035.

NIST's post-quantum transition planning likewise proposes deprecating some quantum-vulnerable public-key algorithms after 2030 and disallowing commonly used higher-strength ECDSA configurations after 2035.

The BIP-360 project site presents a more aggressive scenario, citing industry quantum-computing roadmaps that its authors believe could threaten ECDSA in as little as two to five years. That is the BIP-360 team's risk estimate, not a scientific consensus or an established prediction of “Q-Day.”

The useful conclusion is therefore not that Bitcoin has only a few years left. It is that the timing is uncertain, while designing, activating and deploying a Bitcoin-wide cryptographic migration could itself take years. Preparing early gives the ecosystem more options if quantum progress accelerates.

What Comes Next

BIP-360 is only one part of the discussion. A separate draft, BIP-361: Post Quantum Migration and Legacy Signature Sunset, proposes a phased framework for moving users away from quantum-vulnerable legacy signatures after a post-quantum output type exists. BIP-361 does not itself define the new post-quantum signature scheme; its current specification explicitly depends on a still-to-be-defined post-quantum signature BIP.

So the broader path could involve several separate decisions: whether to activate P2MR, which post-quantum signature scheme or schemes Bitcoin should support, how wallets and exchanges migrate users, and how the network should eventually handle legacy outputs that remain vulnerable.

1. Review and testing of the specification and code.

2. Soft-fork activation, if the community agrees.

3. Wallet and exchange support for bc1z addresses.

4. Gradual user migration to P2MR outputs.

5. Follow-up proposals adding post-quantum signature schemes such as ML-DSA or SLH-DSA to cover short-exposure attacks.

The hardest open question is social, not technical: what should happen to coins that are never moved, including very early coins? Hunter Beast has said the team is studying that problem too, but BIP-360 itself stays out of it.

What BIP-360 Means for You Today

For now, nothing changes for your coins, and there is nothing you need to do urgently. Still, a few habits help:

• Avoid address reuse. Use a fresh receiving address every time.

• Keep your wallet software updated so you can adopt P2MR if and when it activates.

• Verify addresses on a hardware signer before signing, as Ledger recommends.

• Ignore anyone asking you to "upgrade to BIP-360." There is nothing to upgrade yet. Any message asking for your seed phrase to "protect your coins from quantum computers" is a scam.

Frequently Asked Questions

What is BIP-360 in simple terms? It is a draft proposal for a new Bitcoin address type, called Pay-to-Merkle-Root (P2MR), that hides public keys while coins are unspent, protecting them from future quantum attacks.

Is BIP-360 active on Bitcoin? No. It was merged into the BIPs repository in February 2026 for documentation and discussion, but it is still a draft with no activation date.

What does a P2MR address look like? Mainnet P2MR addresses would start with "bc1z."

Does BIP-360 make Bitcoin fully quantum-proof? No. It addresses long-exposure attacks only. Full protection would also need post-quantum signatures, which are planned for future proposals.

What was P2QRH? P2QRH (Pay to Quantum Resistant Hash) was BIP-360's original name in its December 2024 draft before the design was reworked into P2MR.

Will BIP-360 affect Bitcoin mining? No. It changes how coins are locked and spent, not how blocks are mined.

Final Thoughts

BIP-360 is a careful first step, not a finished solution. By removing Taproot's exposed key path while keeping its flexible scripts, P2MR gives Bitcoin a way to protect unspent coins from the most likely kind of future quantum attack. It still needs consensus, activation and years of adoption, and full protection will require post-quantum signatures later. For everyday holders, the takeaway is calm preparation: avoid address reuse, keep your software updated, and watch for P2MR support from trusted wallets.

This article is for educational purposes only and is not financial or security advice. Bitcoin proposals can change before activation, so always check the latest information from official sources.