BIP-361 Sets a Five-Year Quantum Migration and Redefines Bitcoin Ownership

Bitcoin’s quantum debate just got concrete. A new proposal, BIP-361—Post Quantum Migration and Legacy Signature Sunset—doesn’t merely swap cryptography; it rewrites what it means to “own” coins. Under this draft, on-chain mobility by a deadline becomes part of custody. That’s the real shift.

Here’s the skeleton of the plan: - Publish and activate a quantum-safe transaction framework (via dependency BIP-360), then begin a sunset. - Roughly three years after activation, inbound transactions to legacy, quantum-exposed address types would be disallowed. - Two years later, all coins that remain on legacy ECDSA-only paths would be frozen by consensus. - A recovery path would persist for late movers using zero-knowledge proofs, preserving a way back without revealing keys.

Across that five-year window, Bitcoin’s long-standing rule of “a valid signature proves control” gives way to “a valid, timely migration proves you’re still the owner.” Co-author Jameson Lopp and five other developers advanced BIP-361 in the official repository, noting the draft remains without an activation schedule.

Why this urgency? Quantum attacks target public keys exposed on-chain to derive private keys, a scenario often labeled Q-Day. The proposal cites that more than 34% of all BTC has already revealed public keys, leaving those UTXOs vulnerable once sufficiently powerful quantum machines exist. Google, for its part, has set a formal target to complete its own post-quantum cryptography transition by 2029, arguing the horizon is nearer than it looks. That external clock is pushing the conversation.

The controversial core is not technical—it’s governance over property rights. Migrating to quantum-resistant addresses is straightforward in code terms once a vetted scheme is chosen. The tension is that BIP-361 is the first Bitcoin change that would render certain future spends invalid if holders miss the deadline. For some, that is prudent coordination: defer risk today and you invite a scramble later where the first actor with a working quantum computer loots exposed addresses at scale. In that scenario, market structure breaks—one visible quantum theft would likely crush confidence and price because every exposed output becomes a target. A schedule compels orderly migration before the panic.

Others see a line crossed. A protocol-enforced freeze, even for a narrow security objective, looks like confiscation to critics who anchor on self-custody absolutism. If consensus can freeze coins for a “good reason” today, the fear is that tomorrow’s soft fork could do the same under a different banner—sanctions, compliance, or any pressing policy aim. That’s the psychological scar in Bitcoin’s culture: change the social contract once, and you change expectations forever.

From a systems vantage point, the trade feels binary. Without a protocol-level intervention, coins tied to exposed public ECDSA keys remain withdrawable by an adversary once quantum arrives. In effect, absent migration, ECDSA-only coins become sitting ducks. Supporters argue a one-off, time-bound sunset is the least intrusive fix; skeptics counter that “time-bound” constraints rarely stay purely technical after precedent is set.

Operationally, the migration cost concentrates in UX and coordination. Wallets and custodians can automate upgrades, sweeping users to quantum-safe outputs under the hood; miners and nodes can enforce the new rules once activated. The real friction is human. A slice of holders won’t touch keys for years—lost seed phrases, estates, dormant treasuries. BIP-361 acknowledges this with a zero-knowledge recovery path, an elegant valve to reclaim frozen coins later without exposing private data. It softens edge cases but doesn’t remove the hard deadline.

There’s also fork risk. Bitcoin’s decentralized governance is resilient in calm markets and clumsy against a countdown. Competing chains—one enforcing a freeze, another preserving legacy spends—would splinter liquidity and brand. Yet a chain that ignores quantum risk may find its price dislocated the moment a credible theft hits the mempool. Voluntary-only migration assumes the threat arrives on a polite schedule. It rarely does.

Lopp has admitted he doesn’t like this design, only that he dislikes the alternative more. That ambivalence captures where the conversation sits. BIP-361 is still a draft, depends on BIP-360’s quantum-safe transaction framework, and has no activation date. But its key move is already clear: Bitcoin is being asked to treat “timely action” as part of ownership. That’s a heavy lift for a culture built on minimal intervention—and possibly the only way to keep exposed coins from becoming a bounty when Q-Day shows up early.