Dr. Sarah Chen
BIP-360 (Pay-to-Quantum-Resistant-Hash) is the leading proposal for adding post-quantum signature support to Bitcoin. It defines a new Taproot-compatible address type that can use ML-DSA, SPHINCS+, or Falcon signatures. As of September 2026 it is a proposal with no activation date. No major software wallet supports it yet. The proposal exists, the cryptography is standardised, and Bitcoin governance is the bottleneck.
What Is BIP-360 and Why Does Bitcoin Need It?
BIP-360, titled "Pay to Quantum Resistant Hash" (P2QRH), is a Bitcoin Improvement Proposal authored by Hunter Beast in 2024 that introduces a new address type designed to protect Bitcoin against quantum computing attacks. It is the only active, concrete proposal for adding post-quantum cryptography to Bitcoin at the protocol level.
Bitcoin needs it because the current signing algorithms, ECDSA for legacy addresses and Schnorr for Taproot, rely on the elliptic curve discrete logarithm problem over secp256k1. Shor's algorithm, running on a cryptographically relevant quantum computer, can solve this problem in polynomial time, deriving a private key from its corresponding public key. Every Bitcoin address that has ever published its public key (by signing a spend transaction) becomes vulnerable once a CRQC is available.
BIP-360 does not change existing addresses. It introduces a new address type that holders can voluntarily migrate to, using quantum-resistant signature schemes that NIST has standardised under FIPS 203, 204, and 205.
The P2QRH Technical Design: How It Works
P2QRH follows the pattern of previous Bitcoin address upgrades. Each generation has hashed the public key rather than embedding it directly in the scriptPubKey, providing one layer of quantum protection: a quantum adversary cannot derive the private key from the address alone because the public key is not revealed until the output is spent. P2QRH extends this with a second layer: when the output is spent, instead of an ECDSA or Schnorr signature, the spender provides a post-quantum signature using one of the approved algorithms.
The proposal is designed as a Taproot extension. P2QRH outputs use a SegWit v3 address format (the bech32m encoding that Taproot uses is bech32 SegWit v1; P2QRH would be a new version). Witness data would carry the post-quantum public key and signature, which are significantly larger than their classical equivalents.
| Algorithm | Public Key | Signature | vs Schnorr | NIST Standard |
|---|---|---|---|---|
| Schnorr (current) | 32 B | 64 B | 1x | N/A (not PQ) |
| ML-DSA-44 (Dilithium2) | 1,312 B | 2,420 B | 38x | FIPS 204 |
| ML-DSA-65 (Dilithium3) | 1,952 B | 3,309 B | 52x | FIPS 204 |
| Falcon-512 | 897 B | 666 B | 10x | FIPS 206 |
| SPHINCS+-128f | 32 B | 17,088 B | 267x | FIPS 205 |
All sizes in bytes. SPHINCS+ has smallest public key but largest signature. Falcon-512 has the best combined footprint but requires hardware constant-time implementation to avoid side-channel attacks.
The Block Size and Throughput Problem
Bitcoin's 1 MB base block size (4 MB with SegWit witness discount) creates a hard constraint on post-quantum migration. A Taproot spend currently uses approximately 58 bytes in witness data (32-byte public key, 64-byte signature, plus overhead). An ML-DSA-44 P2QRH spend would use approximately 3,764 bytes in witness data, a 65-fold increase. Falcon-512 would use approximately 1,595 bytes, still a 27-fold increase.
This means the number of P2QRH transactions that fit in a block would be drastically lower than the number of Taproot transactions. At current Bitcoin throughput of roughly 7 transactions per second, migrating even a significant fraction of the UTXO set to P2QRH addresses could take years of block space at current capacity, and the throughput cost during migration would affect the entire network.
BIP-360 discussions acknowledge this constraint and propose applying the SegWit witness discount to post-quantum signature data, reducing the effective byte count for fee calculation purposes. Whether this is sufficient to make P2QRH economically viable for routine use is an open question in the proposal.
If you want to track BIP-360's progress, follow the Bitcoin Improvement Proposals repository on GitHub and watch for changes to BIP-360 status. The proposal moves through stages: Draft, Proposed, Final, Active. It is currently in Draft. Any move to Proposed status would indicate meaningful developer consensus forming around the specification.
The Activation Path: Why This Will Be Slow
Bitcoin's governance process is conservative by design. Adding a new script version (SegWit v3 for P2QRH) requires a soft fork, which requires near-universal miner signalling and broad node operator adoption. The precedents are SegWit (activated in 2017 after years of debate) and Taproot (activated in 2021 after two years from initial proposal to activation). Both were less technically radical than introducing post-quantum cryptography with 40 to 260 times larger signatures.
The activation path for BIP-360 requires: finalising the cryptographic specification (which algorithm or algorithms to support), building reference implementations in Bitcoin Core and major wallets, generating enough community consensus to proceed with miner signalling, and then the soft fork activation period itself. Realistically, given the current state of the proposal and the complexity of the change, a 2028 to 2030 activation window is optimistic.
This timeline is tight against the 2029 to 2033 institutional Q-Day planning horizon. If a CRQC capable of attacking secp256k1 arrives before P2QRH is deployed and widely adopted, Bitcoin holders will have no on-chain migration path available.
What P2QRH Means for Bitcoin Holders Right Now
For individual Bitcoin holders, BIP-360 is a future option that does not change what they can do today. The current best practice for quantum risk reduction on Bitcoin remains: avoid reusing addresses, keep significant holdings in addresses that have never signed a transaction, and monitor BIP-360 development for the activation signal that a migration path is becoming available.
For protocol developers and wallet software teams, BIP-360 is a design requirement to plan for. Wallets that want to support post-quantum Bitcoin migration will need to implement ML-DSA or Falcon key generation, large witness transaction construction, and new address format encoding before or shortly after any activation. The implementation work is substantial enough that it needs to begin before activation, not after.
Quantum-Safe Now, Not When Governance Allows
QuanChain implements ML-DSA from genesis with no governance risk. Every account is quantum-resistant by default, with no migration window to miss.
Learn About Quantum-Native DesignFrequently Asked Questions
What is BIP-360 P2QRH in simple terms?
BIP-360 is a proposal to add a new type of Bitcoin address that uses quantum-resistant signature algorithms instead of ECDSA or Schnorr. The abbreviation P2QRH stands for Pay-to-Quantum-Resistant-Hash. It works like existing Bitcoin addresses in that the address is a hash of the public key, but when you spend from a P2QRH address you provide a post-quantum signature (ML-DSA, Falcon, or SPHINCS+) instead of a classical ECDSA or Schnorr signature.
Has BIP-360 been activated on Bitcoin?
No. As of September 2026, BIP-360 is a Draft proposal. It has not been included in any Bitcoin Core release and has not gone through the miner signalling process required for soft fork activation. There is no confirmed activation date. Bitcoin governance is slow and conservative; similar soft forks (SegWit, Taproot) took two or more years from initial proposal to activation.
Which post-quantum algorithm does BIP-360 use?
BIP-360 proposes supporting multiple post-quantum algorithms: ML-DSA (FIPS 204, derived from CRYSTALS-Dilithium), Falcon (FIPS 206), and SPHINCS+ (FIPS 205). Each has different size and performance tradeoffs. Falcon-512 has the smallest combined key and signature size of the lattice-based options. SPHINCS+ has the smallest public key but the largest signatures (17,088 bytes versus 64 bytes for Schnorr). The final algorithm selection remains under discussion.
What happens to my Bitcoin if BIP-360 is never activated?
Existing Bitcoin is unaffected by whether BIP-360 is activated. Your current holdings continue to work under the existing address types. The risk is that without a post-quantum migration path, Bitcoin holders cannot move to quantum-resistant custody if a CRQC becomes available before activation. In that scenario, addresses with exposed public keys would be at risk and there would be no protocol-level remedy on the Bitcoin blockchain.
Can I use BIP-360 P2QRH addresses today?
No. P2QRH addresses do not exist on the main Bitcoin network until the soft fork is activated. You could experiment on a local regtest network or Bitcoin testnet if a reference implementation becomes available, but these addresses have no value and would not protect real funds. The proposal needs to move from Draft to a finalised specification, then be implemented in Bitcoin Core and activated via soft fork before P2QRH addresses are usable on mainnet.
