Bitcoin Post-Quantum Roadmap: How BIP-360 and SHRINCS Could Help Quantum computing has quietly become one of the more serious long-term conversations in Bitcoin development. The concern isn't
Quantum computing has quietly become one of the more serious long-term conversations in Bitcoin development. The concern isn't hypothetical panic, it's a real cryptographic question: what happens to Bitcoin's security once a sufficiently powerful quantum computer can break the math behind digital signatures? This is exactly why the Bitcoin Post-Quantum Roadmap has started taking real shape, with several concrete proposals now on the table.
Key Takeaways
The Bitcoin Post-Quantum Roadmap currently splits into two phases: protecting coins before a quantum threat becomes real, and rescuing coins if it happens before users act.
A new proposal called BIP-360 introduces a way to hide a user's public key, closing the main vulnerability quantum computers could exploit.
Even with these proposals in motion, developers are clear that much of the quantum problem in Bitcoin remains unresolved.
To understand why this roadmap matters, it helps to understand the actual risk. Bitcoin wallets are secured using a type of cryptography that depends on a mathematical relationship between a private key and a public key. Right now, deriving one from the other is computationally impossible with normal computers.
A cryptographically relevant quantum computer, often shortened to CRQC, could theoretically break that relationship. If someone can see your public key, and a CRQC exists, they could, in theory, derive your private key and spend your coins. This is the core of the Bitcoin quantum computing threat that developers are now working to address well ahead of time.
Much of the current Bitcoin post-quantum migration work focuses on protecting coins before any quantum computer capable of breaking Bitcoin's cryptography actually exists. Two proposals sit at the center of this effort.
BIP-360 introduces a new type of Bitcoin address, called Pay-to-Merkle-Root, or P2MR. Its core idea is simple: instead of exposing a user's public key the way current addresses do, a P2MR address keeps that public key hidden until the moment coins are actually spent.
Even more importantly, P2MR is designed to support multiple spending paths, including at least one that wouldn't require revealing the public key at all. Right now, every Bitcoin spending method reveals the public key. Once post-quantum signature support eventually gets added to Bitcoin, P2MR addresses are built to work with it automatically, without needing another redesign later.
In short, BIP-360 is a minimal, proactive framework: it protects coins by hiding public keys well before a CRQC, or even a finished post-quantum signature scheme, actually exists.
Alongside BIP-360, researchers have proposed a new post-quantum signature scheme called SHRINCS, short for "Shrunken SPHINCS." What makes it notable is that it relies on the same hash function, SHA-256, that Bitcoin already uses for mining, meaning it doesn't introduce new mathematical assumptions into the protocol.
Compared to other hash-based, quantum-resistant approaches, SHRINCS is roughly ten times more compact and notably efficient to verify. According to details shared about the proposal, SHRINCS public keys come in at just 48 bytes. Its smallest signatures run around 548 bytes, with a stateless fallback built into every key pair that produces larger, 5,777-byte signatures when needed.
Source: official documentation
Combined with an opcode that would let the network verify SHRINCS signatures, this scheme, alongside BIP-360, gives Bitcoin a real path toward Bitcoin quantum resistant signatures without forcing every user to upgrade immediately. Both pieces are designed as optional, added through backward-compatible soft forks rather than a disruptive, mandatory overhaul.
Proposal
Purpose
Applies To
BIP-360
Hides public keys via a new address type (P2MR)
Coins held before a CRQC exists
SHRINCS
Compact, hash-based quantum-resistant signature scheme
Signature verification once post-quantum support is added
Lifeboat
Rescue protocol for coins not yet migrated
Coins at risk after a CRQC appears
Dropkick
Alternative rescue protocol with a more flexible activation approach
Coins at risk after a CRQC appears
The harder problem shows up if a CRQC becomes real before everyone has migrated their coins to a quantum-safe address. This is where the Bitcoin quantum resistance roadmap gets genuinely complicated.
Anyone still holding coins in an old-style address reveals their public key the moment they try to spend. If a CRQC exists at that point, an attacker could theoretically derive the private key fast enough to front-run the transaction and steal the funds before the rightful owner's spend confirms.
To address this, developers have proposed two rescue protocols for what's being called "quantum procrastinators," meaning users who didn't migrate in time. Both rely on the same underlying idea: publishing a commitment on-chain that proves you knew information tied to your address before an attacker did, giving you a way to reclaim your coins even after a CRQC appears.
These two proposals differ mainly in how strict they are about the ordering of on-chain commitments and how fees get attached to them. One version includes a built-in mechanism for anyone to prove a CRQC actually exists on-chain, which would automatically activate the necessary soft fork. The other leaves that activation mechanism more open, potentially working alongside the compact signature scheme described earlier.
It's easy to treat quantum computing as a distant, sci-fi problem, but Bitcoin's value comes precisely from the strength of its cryptography. A protocol securing hundreds of billions of dollars in value can't afford to start designing its defense only after a real threat shows up. That's exactly why this layered approach, prevention first, rescue mechanisms second, matters more than it might seem at first glance.
It also reflects a broader theme in how Bitcoin evolves: changes happen slowly, deliberately, and through rigorous debate, rather than being rushed out reactively. For something as foundational as how coins are secured, that pace is arguably a feature, not a flaw.
Put together, these proposals show real, active progress: a way to hide public keys early (BIP-360), a compact signature scheme built on Bitcoin's existing cryptographic foundation (SHRINCS), and rescue mechanisms for anyone who doesn't migrate in time. Together, this forms a genuinely coherent shape for how Bitcoin will become quantum resistant over time.
That said, it's worth being honest about where things actually stand. Developers working closely on these proposals have been direct that a significant amount of the underlying problem remains unsolved. Activation mechanisms, exact technical tradeoffs, and consensus among developers all still need to be worked out before any of this becomes part of Bitcoin's actual protocol.
Bitcoin's approach to Bitcoin post quantum cryptography is shaping up in layers: proactive protection now, a compact signature scheme built on familiar math, and rescue protocols as a safety net for stragglers. It's a thoughtful, early response to a threat that hasn't arrived yet, but the work is far from finished, and getting the details right matters more than getting them fast.
Source: Commentary and reporting shared by Christine D. Kim, Bitcoin researcher and newsletter writer, following recent developer discussions.
This article is for informational purposes only and does not constitute financial or technical advice. Bitcoin protocol proposals discussed here remain under active research and development and may change significantly before implementation.
