Bitcoin BIP 360: What P2QRH Means for Quantum-Resistant Bitcoin

TL;DR: BIP 360 proposes P2QRH (Pay to Quantum Resistant Hash) as a new Bitcoin address type that supports post-quantum signature schemes including SLH-DSA (SPHINCS+), ML-DSA (CRYSTALS-Dilithium), and FALCON. It is a draft proposal as of mid-2026, not merged into Bitcoin Core, with no scheduled activation. P2QRH would protect new addresses using the new format but does not protect existing Bitcoin in legacy address types. Any activation requires a soft fork with broad community consensus.

What Is Bitcoin BIP 360?

BIP 360 is a Bitcoin Improvement Proposal that introduces P2QRH (Pay to Quantum Resistant Hash) — a new Bitcoin address type using post-quantum signature algorithms. It is modeled on the SegWit address upgrade that introduced P2WPKH and P2WSH. P2QRH would allow wallets to use SLH-DSA, ML-DSA, or FALCON signatures instead of secp256k1 ECDSA. As of mid-2026 it remains a draft proposal, not merged into Bitcoin Core, and not scheduled for activation on any known timeline.

Bitcoin Improvement Proposals are the mechanism by which changes to the Bitcoin protocol are proposed, discussed, and eventually implemented. BIP 360 was authored by Hunter Beast and submitted to the Bitcoin development mailing list, where it has received discussion from Bitcoin Core developers, cryptographers, and the broader technical community. The proposal draws on NIST's post-quantum cryptography standards (FIPS 204, FIPS 205) finalized in August 2024.

Understanding BIP 360 requires understanding what it proposes to change, what it does not change, and why the activation path is uncertain even if the cryptographic choices are sound.

What P2QRH Proposes

P2QRH introduces a new SegWit version (version 3) output type. Like P2WPKH and P2TR, P2QRH outputs commit to a hash of the spending condition — in this case, a hash of the quantum-resistant public key material. The spending transaction reveals the full public key and a valid post-quantum signature, which nodes validate before including the transaction in a block.

The proposal supports multiple post-quantum signature algorithms as options within P2QRH:

• SLH-DSA (SPHINCS+, FIPS 205) — hash-based signatures, security depends only on hash collision resistance. Most conservative choice cryptographically. Signatures of 7,856 to 49,856 bytes.
• ML-DSA (CRYSTALS-Dilithium, FIPS 204) — lattice-based signatures, NIST standardized. Smaller signatures than SLH-DSA (2,420 to 4,595 bytes) but larger than current ECDSA signatures.
• FALCON — lattice-based, NIST-selected (pending FIPS standardization). Smallest signatures among the candidates (666 to 1,280 bytes) but more complex to implement securely due to Gaussian sampling requirements.

The proposal also includes a witness discount for P2QRH data, recognizing that post-quantum signatures are significantly larger than ECDSA signatures. Without a discount, the fee cost of a P2QRH transaction would be prohibitive compared to existing address types. The exact discount figure has been a point of discussion in the mailing list, with the current draft proposing an 8 MB witness size allowance for P2QRH data.

What BIP 360 Does Not Protect

BIP 360 only protects funds explicitly moved into new P2QRH addresses. It does not protect any existing Bitcoin held in P2PK, P2PKH, P2WPKH, or P2TR addresses. Holders of legacy addresses would need to send their Bitcoin to a new P2QRH address to gain quantum protection — a re-signing campaign requiring every holder to act before capable quantum hardware arrives. Funds in P2PK addresses, where the public key is already permanently on-chain, would remain vulnerable regardless of BIP 360 activation.

This is the fundamental limitation of any opt-in address upgrade for Bitcoin: it cannot retroactively protect existing address types. The approximately 1.7 million BTC in P2PK outputs — including coins widely attributed to Satoshi Nakamoto — have public keys permanently on-chain and cannot be protected by BIP 360 unless the holder moves the funds to a new P2QRH address. Holders who have lost their seeds, or who are unreachable (deceased, incapacitated), cannot participate in the migration at all.

The situation is different for P2PKH and P2WPKH addresses that have never sent a transaction. These addresses have not yet exposed their public key on-chain. If their holders move funds to P2QRH addresses before they ever broadcast a spending transaction from the legacy address, they avoid having their public key exposed. This is a narrow but real protection path for holders who act before the threat window arrives.

BIP 360 Current Status and Activation Path

As of mid-2026, BIP 360 is a draft proposal. It has not been merged into Bitcoin Core, has not been assigned a final BIP number in some versions, and has not been scheduled for activation on any mainnet timeline. The proposal is under active technical discussion, with debate focused on:

• Algorithm selection (whether to include all three candidates or standardize on ML-DSA first)
• The witness discount size and fee implications for P2QRH transactions
• Whether to include a future migration mechanism for legacy addresses in the same soft fork
• Implementation complexity and its effect on Bitcoin Core maintenance burden

Bitcoin protocol changes require broad consensus among miners, node operators, Bitcoin Core developers, and the economic majority. Even uncontroversial soft forks with clear benefits (SegWit took approximately two years from proposal to activation) require significant coordination. A post-quantum signature upgrade — which involves cryptographic choices that are newer and less battle-tested in production at scale — faces additional scrutiny. A realistic timeline for BIP 360 activation, assuming it achieves consensus, is several years from the current draft stage.

How This Compares to QuanChain's Approach

BIP 360 represents an attempt to retrofit quantum resistance onto Bitcoin's existing architecture — a challenging problem because the architecture was designed around secp256k1 ECDSA and has accumulated years of permanently exposed public keys in its ledger history. QuanChain's architecture does not face this problem because it was designed with post-quantum signatures as a first-class requirement from genesis.

QuanChain uses ML-DSA-87 and SLH-DSA-SHA2-256f composite signatures in production on its testnet today. Its SpendAndRotate mechanism atomically retires key material with every transaction, meaning no public key accumulates on-chain in a funded state between spends — eliminating the harvest-now, decrypt-later attack surface that P2QRH still leaves open for legacy Bitcoin holders who have not migrated.

The difference is architectural, not merely algorithmic. BIP 360 adds a quantum-safe address type to Bitcoin. QuanChain's design ensures no quantum-unsafe key material ever appears in the funded state at the protocol level.