Taproot’s Quantum Problem: BIP-360, BIP-361 and the Freeze

When Bitcoin activated Taproot in November 2021, the sales pitch was privacy and efficiency: cheaper multisig, more flexible scripting, and ordinary payments that all looked identical on-chain. Almost five years on, the same upgrade sits at the center of the most uncomfortable engineering debate in Bitcoin, because the feature that made Taproot elegant also made it readable to a machine that does not exist yet. Taproot addresses publish a raw public key on the blockchain, and a large enough quantum computer could turn that public key into the private key that controls the coins.

In 2026 that risk stopped being a thought experiment. Over roughly six months, Google researchers cut their estimate of how much quantum hardware such an attack would need, an independent researcher collected a full Bitcoin for breaking a small cryptographic key on real quantum hardware, and Bitcoin developers answered with two proposals that would change how the network stores value: BIP-360, a new address type that hides the key again, and BIP-361, a plan to sunset the old signatures and, if it comes to that, freeze the coins that never move. Bitcoin trades around $64,500, still down by roughly half from its October 2025 record of $126,080 (CoinGecko), and none of this is live yet. The argument over whether Bitcoin can, or should, freeze anyone’s coins, even Satoshi Nakamoto’s, is already underway.

How Taproot changed what Bitcoin reveals

To see why quantum computing lands on Taproot specifically, it helps to remember what a Bitcoin address actually commits to. Legacy and SegWit addresses, the ones that begin with 1, 3 or bc1q, do not contain your public key. They contain a hash of it. The public key appears on the blockchain only at the moment you spend, when your wallet reveals the key and a signature together. Until then an observer sees a hash, and a hash is not something even a quantum computer can run backward into a private key.

Taproot changed that. The upgrade, delivered as BIP 340 (Schnorr signatures), BIP 341 (Taproot and MAST) and BIP 342 (Tapscript) and activated at block 709,632 on 14 November 2021 after the Speedy Trial signaling process (CoinDesk), introduced a new output type, P2TR, with addresses that start bc1p. A Taproot output embeds a public key, a tweaked Schnorr key, directly in the script. That was the point: a key-path spend looks the same whether it hides a single signer or an elaborate multisig contract, which is why Taproot improved privacy for the sophisticated spenders who use it. The side effect is that a Taproot coin is public-key-exposed the entire time it sits unspent, not just after its first spend. What made Taproot private to human observers made it legible to a future quantum adversary.

Store the key, break it later: the attack model

Bitcoin signatures rest on the elliptic-curve discrete logarithm problem over the secp256k1 curve. Deriving a private key from a public key is astronomically hard for classical computers. Shor’s algorithm, running on a sufficiently large fault-tolerant quantum computer, collapses that hardness. Mining, which relies on SHA-256 hashing, is comparatively safe, because the best-known quantum speedup for hashing is only quadratic; the exposure lives in the signatures, not in the proof of work. That distinction matters, because it means the threat is to who can move coins, not to how blocks are produced.

There are two ways an attacker with a working machine could use that capability:

• Long-exposure theft. Any coin whose public key is already visible can be stolen at leisure. That covers every Taproot output, every address reused after a spend, and the ancient coins from Bitcoin’s earliest years. The attacker simply computes the private key and sweeps the funds, with no time pressure at all.
• Short-exposure front-running. Even a hash-protected address reveals its public key in the mempool the instant you broadcast a spend. A fast enough quantum computer could derive the private key from that in-flight transaction and broadcast a competing one, paying itself, before the original confirms inside the roughly ten-minute block window.

The first category is the standing liability, and Taproot enlarges it, because a bc1p coin is exposed from birth rather than from first spend. No attacker can forge a signature today; the machines are not there. But an exposed public key is a permanent invitation the moment one arrives, and it cannot be un-revealed. That is why the debate is about migration timelines rather than emergency patches: the coins that are exposed now stay exposed until someone moves them to a safer output.

Google just moved the goalposts

For years the reassuring line was that breaking Bitcoin would take millions of physical qubits, comfortably beyond anything on a lab bench. In March 2026 Google’s Quantum AI team published research that shrank the estimate hard. In a responsible-disclosure blog post, the team said breaking the 256-bit elliptic-curve problem that secures cryptocurrency could take fewer than 1,200 logical qubits and about 90 million Toffoli gates in one circuit design (or fewer than 1,450 logical qubits and 70 million gates in another), needing fewer than 500,000 physical qubits on a superconducting system and completing in a few minutes (Google Research).

The figures are down sharply from earlier expectations that ran into the millions of physical qubits. Google deliberately disclosed the result through a zero-knowledge proof, verifying the finding without publishing a working attack recipe, and pointed to its own 2029 target for useful quantum systems as the reason to treat this as a planning problem rather than a reason to panic. Reporting at the time drew out the uncomfortable corollary for Bitcoin: because Taproot exposes public keys by default, the upgrade makes a bigger slice of supply reachable than the older address types ever did (CoinDesk).

Someone already won a bitcoin for breaking a key

Theory is one thing; a live demonstration concentrates minds. On 24 April 2026 the research group Project Eleven awarded its Q-Day Prize, a bounty of one full Bitcoin, to independent researcher Giancarlo Lelli for breaking a 15-bit elliptic-curve key on publicly accessible quantum hardware. It was the largest public demonstration of this attack class to date, a 512-times jump from the previous six-bit record, and it was done on cloud-accessible machines with no national lab or bespoke chip involved (CoinDesk).

A 15-bit key is trivially small next to the 256-bit keys that guard real coins, so nothing was ever at risk. The point was the trajectory. “The resource requirements for this type of attack keep dropping, and the barrier to running it in practice is dropping with them,” said Alex Pruden, Project Eleven’s chief executive (Project Eleven). Every increase in the key size a quantum machine can handle is another step toward the day the same technique reaches Bitcoin’s real parameters, which is why builders treat these bounty results as a clock rather than a curiosity.

How much bitcoin is actually exposed

The scale of the problem is what makes it politically hard. By early 2026, more than a third of all bitcoin, over 34% of supply, sat on addresses whose public key was already visible on-chain (crypto.news). Those coins fall into a few buckets, and the most exposed are not the ones most people hold.

The most sensitive slice is the oldest. Roughly 1.7 million BTC sit in early pay-to-public-key outputs from 2009 to 2011, a set that includes an estimated 1.1 million coins widely attributed to Satoshi Nakamoto. Nobody has moved them in more than a decade, which means nobody can migrate them either. Any plan that protects the network by locking down exposed coins runs straight into the reality that the single largest exposed holder may be gone for good. Estimates of the total at-risk pool range from about 5.5 million to 6.9 million BTC depending on how reused addresses are counted, worth well over $350 billion at current prices. That is not a rounding error; it is a chunk of the money supply large enough that its fate becomes a question about Bitcoin itself.

BIP-360: an address that hides the key again

The first half of Bitcoin’s answer is a new place to put coins. BIP-360, authored by Hunter Beast, Ethan Heilman and Isabel Foxen Duke and merged into the Bitcoin Improvement Proposals repository on 11 February 2026, defines an output type called Pay-to-Merkle-Root, or P2MR. Structurally it looks like Taproot with one crucial removal: the key-path spend is gone. Because there is no raw public key sitting in the output, a P2MR coin does not advertise the target a quantum attacker needs; everything is committed behind a Merkle root and revealed only through the script path when the coin is spent (bip360.org).

There is an important caveat that early coverage often blurred. BIP-360 does not, by itself, introduce a post-quantum signature scheme. It restructures the output so the key is no longer exposed, and it explicitly defers the actual quantum-resistant signatures to future proposals. The standardized building blocks already exist: the US National Institute of Standards and Technology finalized its first post-quantum standards in August 2024, including ML-DSA, a lattice-based signature, and SLH-DSA, a hash-based one, published as FIPS 204 and FIPS 205 (NIST). The problem for Bitcoin is size. Post-quantum signatures are many times larger than Schnorr’s compact 64 bytes, which would eat into block space and reopen the fee and block-size arguments the community has fought over for a decade. Hiding the key is the easy part; agreeing on how to sign without it is where the real cost lands.

BIP-361: the sunset clock, and the freeze

A safer address does no good if nobody moves to it. That is the job of BIP-361, titled Post Quantum Migration and Legacy Signature Sunset, authored by Jameson Lopp, Christian Papathanasiou, Ian Smith, Joe Ross, Steve Vaile and Pierre-Luc Dallaire-Demers. It is a draft, assigned the same day as BIP-360, and it lays out a two-phase soft fork designed to push the network off quantum-vulnerable signatures before an attacker can exploit them (bips.dev).

Phase A, running about 160,000 blocks or roughly three years after activation, stops the network from accepting new sends into quantum-vulnerable address types. You can still spend such coins, but only to move them into quantum-resistant outputs, which forces migration to begin. Phase B, about two years later, is the sharp end: the network stops honoring plain ECDSA and Schnorr spends and encumbers vulnerable coins with what the proposal calls a quantum-safe rescue protocol, so a legitimate owner can still recover funds while a quantum thief cannot simply forge a signature. In the authors’ framing, the design turns quantum security into a private incentive: fail to upgrade and you will encounter additional friction to access your funds. Crucially, none of this can activate until a separate post-quantum signature proposal is chosen and adopted first, which means BIP-361 is a clock with no hands attached yet.

The fight over freezing coins

Phase B is where the engineering turns into a values fight. If you do not migrate in time, your coins become unspendable through the ordinary path, locked behind a rescue mechanism you must actively use. Critics see that as confiscation dressed up as security, an inversion of the not-your-keys principle, and a precedent they distrust: if the network can freeze coins for one reason, the argument runs, it has established that it can freeze them at all. The Satoshi-era coins make the objection vivid, because a rule meant to deny a quantum thief a multi-million-coin jackpot also, unavoidably, freezes the holdings of a person who cannot come back to move them. To some, protecting Bitcoin by touching those coins is a betrayal of the thing being protected.

What makes BIP-361 unusual is that its lead author shares the discomfort. Jameson Lopp, the Casa co-founder who has spent years championing Bitcoin self-custody, has said plainly that he does not support the proposal and hopes it is never needed. “I know people don’t like this proposal. I don’t like it either. But I wrote it because I dislike the alternative even more,” he wrote, arguing that “in the face of an existential threat, individual economic incentives outweigh philosophical principles” (Bitcoin Magazine). The alternative he means is leaving several million coins as an open prize for the first entity to build a working machine, an outcome that could shatter confidence in Bitcoin far more violently than a contested soft fork ever would.

Not everyone wants to wait for a formal soft fork. On-chain analyst Willy Woo has published a self-help version of the same idea, urging holders to move coins out of Taproot addresses and back into hash-protected SegWit as an interim hedge, while insisting the asset itself endures: “Quantum will not break BTC because BTC will adapt” (Yahoo Finance). Others want faster collective action. Charles Edwards, founder of Capriole Investments, has argued that “Bitcoin’s only hope is a consensus upgrade to the network, agreed in 2026,” rather than a disorderly scramble of individual migrations once a threat is finally visible (crypto.news).

What the experts actually disagree about

Strip away the rhetoric and the real disagreement is about timing. Nobody serious claims a quantum computer can break Bitcoin today. The question is how much runway there is, and the estimates scatter. Google’s useful-systems milestone points at 2029. Various industry and academic projections cluster somewhere between 2027 and 2035. Ethereum Foundation researcher Justin Drake said after the Google paper that his confidence in a quantum day of reckoning arriving by 2032 had shot up significantly (CoinDesk). Skeptics, including Binance founder Changpeng Zhao, counter that there is no reason to panic, because the fix is a known quantity: upgrade to quantum-resistant algorithms when the time comes.

The trouble is that a safe migration is not fast. If BIP-361’s roughly five-year path from Phase A to Phase B is any guide, Bitcoin would need to start well before a quantum computer is provably near, which means acting on a probability rather than a certainty. That is the case Coinbase’s independent Quantum Advisory Council, whose members include Stanford cryptographer Dan Boneh, Justin Drake and Eigen Labs founder Sreeram Kannan, made in an April 2026 position paper: begin preparing now, do not wait for the threat to be undeniable, and treat NIST’s 2035 migration horizon as a ceiling rather than a comfort (Coinbase). The council’s blunt framing was to start preparing and not wait for consensus, which is precisely the thing a decentralized network cannot manufacture on demand.

Ethereum is doing it top-down; Bitcoin cannot

The contrast with Ethereum is instructive. On 26 February 2026 Vitalik Buterin unveiled a four-year Layer-1 plan, part of what he calls Lean Ethereum, to rebuild the network around quantum-resistant primitives, including replacing BLS validator signatures with a hash-based scheme called leanXMSS and hardening wallet signatures, data availability and zero-knowledge proofs (CoinDesk). Ethereum can drive that through a Foundation-coordinated roadmap with a broadly accepted north star and a small number of client teams executing it.

Bitcoin has no such steering wheel, and most of its adherents consider that a feature. Every change is a BIP that has to earn rough consensus, and a soft fork needs miners to signal and enforce it. That process just showed its teeth: the BIP-110 data-limit soft fork collapsed at the signaling stage in August 2026, splitting off a minority chain that mined a couple of blocks and stalled almost immediately. A network whose hashrate has climbed from kilohashes to a full zettahash is formidably secure, but that same distributed power is exactly what makes coordinated change slow. Bitcoin’s quantum defense is not only a cryptography problem; it is a governance problem, and rushing governance is the one thing Bitcoin is structurally built not to do.

The wallet, exchange and custody problem

Even if BIP-360 and BIP-361 were adopted tomorrow, the migration would depend on software most users never think about. Wallets would need to generate and back up new quantum-resistant addresses; exchanges and custodians would need to support deposits and withdrawals to them and physically move billions of dollars of coins; hardware wallets would need firmware capable of producing post-quantum signatures far larger than today’s. The track record is not encouraging: years after Taproot, bc1p deposit support at exchanges is still patchy, and a brand-new address type would lag further behind that.

Some of the plumbing is further along than the debate suggests. BTQ Technologies has already run a working BIP-360 implementation on a dedicated Bitcoin Quantum testnet (version 0.3.0 in March 2026, with more than 50 miners, over 100,000 blocks and Dilithium-based signature opcodes), evidence that the design is buildable rather than merely sketched (The Quantum Insider). The user experience is the harder half. Ethereum plans to lean on smart accounts to abstract away key management and smooth migrations; Bitcoin’s model keeps more of that burden on the individual holder, which raises the odds that a meaningful chunk of supply simply never migrates in time and ends up in exactly the frozen bucket BIP-361 describes.

Where the SEC actually fits

For US readers it is worth being precise about what regulators can and cannot do here. The Securities and Exchange Commission does not approve or block a Bitcoin soft fork. Bitcoin’s consensus rules are set by its participants, not by a securities regulator, and a protocol upgrade is not a registrable event. The SEC’s authority runs to securities, exchanges and issuers, not to whether the network adopts P2MR or sunsets a signature scheme.

The consequences land downstream, on the products that now hold Bitcoin for ordinary Americans. Spot Bitcoin exchange-traded funds, which arrived after a long approval fight and turned a grudging maybe into a routine yes, custody hundreds of thousands of coins; a contested migration or a Phase B freeze would force issuers and custodians to decide which chain and which UTXOs count as the real Bitcoin, and whether vulnerable holdings must be moved on a deadline. Tax treatment is a quieter question: moving your own coins from a bc1p address into a quantum-resistant one is not a sale, so under current IRS treatment it should not by itself trigger a taxable disposal, though a forced freeze-and-rescue is genuinely novel ground. The federal government, meanwhile, is already forcing its own systems to migrate: NIST guidance deprecates vulnerable algorithms by 2030 and disallows them by 2035, and the NSA’s CNSA 2.0 sets comparable deadlines. None of that binds Bitcoin, but it is the backdrop the whole industry is measured against.

What happens next

The honest status is that nothing is decided. BIP-360 and BIP-361 are drafts. No post-quantum signature scheme has been selected for Bitcoin, and BIP-361 cannot activate until one is. A soft fork still needs miner signaling, which just failed in plain view for a far less consequential proposal. The real deadline is not a date on a quantum roadmap; it is the point at which Bitcoin has to reach rough consensus on a multi-year migration while the threat is still only probable. Acting early on an uncertain danger is the single hardest thing to ask of a leaderless network, and like every other item on crypto’s crowded 2026 calendar, this timeline is prone to slipping.

Three signals are worth watching over the next year:

• Whether the community converges on a specific post-quantum signature scheme, the missing piece BIP-361 depends on.
• Whether mainstream wallets and exchanges ship support for quantum-resistant address types, without which no migration can scale to the whole network.
• Whether miners ever signal for a quantum soft fork, the test BIP-110 just failed.

The optimists bet Bitcoin adapts, as it did through the block-size wars and the Taproot activation itself. The worriers want a decision locked in this year. The builders are shipping testnets and draft BIPs so that, if the machines arrive on the early end of the range, the option to respond already exists. Taproot gave Bitcoin a more private, more expressive base layer. It also, quietly, started a clock. The next few years will show whether a network engineered to resist change can change fast enough to protect the coins that change exposed.

Frequently Asked Questions

Does Taproot make Bitcoin more vulnerable to quantum computers?

In one specific way, yes. Taproot (bc1p) outputs place the public key on-chain from the moment coins arrive, so they are exposed for their whole life, while older address types hide the key behind a hash until the coins are first spent. A future quantum computer able to derive a private key from a public key would have a standing target in every Taproot output, which is why some analysts suggest migrating away from bc1p as an interim step.

What is BIP-360?

BIP-360 proposes a new Bitcoin output type called Pay-to-Merkle-Root (P2MR) that works like Taproot but removes the exposed key-path spend, so no raw public key sits in the output. It makes addresses quantum-resistant structurally but defers the actual post-quantum signature scheme to a later proposal. As of August 2026 it is a draft merged into the BIP repository, not an activated consensus rule.

Would BIP-361 really freeze Satoshi Nakamoto’s coins?

In principle, yes. BIP-361 would sunset legacy ECDSA and Schnorr signatures in two phases, and any coins never migrated to a quantum-resistant address, including the roughly 1.1 million ancient coins attributed to Satoshi that nobody can move, would end up locked behind a rescue protocol. It is a draft proposal, it remains highly controversial, and even its lead author says he hopes it never has to be used.

How soon could a quantum computer break Bitcoin?

No one knows for certain. Google’s own milestone for useful quantum systems is around 2029, broader expert estimates cluster between 2027 and 2035, and no machine can break real 256-bit Bitcoin keys today. The concern driving the debate is that a safe migration itself takes roughly five years, so Bitcoin would have to start well before the threat is proven.

What can Bitcoin holders do about the quantum threat now?

The practical steps today are limited. Avoiding address reuse helps, and some analysts such as Willy Woo suggest holding coins in hash-protected SegWit addresses rather than Taproot ones as an interim measure. Longer term, holders will need wallet support for quantum-resistant address types once proposals like BIP-360 and BIP-361 are activated.

Marcus Okafor covers Bitcoin protocol development and market structure for HOGE Wire.