Quantum Resistance
Bitcoin Quantum Resistance
BIP (Bitcoin Improvement Proposal)
Toward Quantum Resistance: BIP 360 & SHRIMPS
Bitcoin’s elliptic curve cryptography has served us well for over 15 years, but quantum computers running Shor’s algorithm could one day break it. The good news? The Bitcoin development community is already shipping practical solutions instead of waiting for a crisis.
Two key pieces of the puzzle have emerged recently:
- BIP 360 — A new output type that protects against long-term exposure of public keys.
- SHRIMPS — A hash-based post-quantum signature scheme optimized for Bitcoin’s constraints, roughly 3× smaller than current NIST standards.
Together, they form a realistic, step-by-step path toward a quantum-resistant Bitcoin.
Bad things to do regarding quantum risk on Bitcoin
Here is a clear list of practices that increase your exposure if powerful quantum computers become practical:
What to know:
- Reusing addresses: Sending to or receiving on an address more than once. Once the public key is revealed by a spend, every future use of that same address is immediately vulnerable.
- Leaving bitcoin on an address after its public key has been revealed: Spending part of a UTXO and leaving change (or any remaining value) on the same address whose key was just published.
- Using old address types that reveal the public key earlier or more directly: Especially plain P2PK (pay-to-public-key) and Taproot (P2TR) key-path outputs. These put the public key on-chain as soon as the coins are received, making them vulnerable to long-exposure quantum attacks.
- Address reuse across multiple UTXOs: Having several UTXOs that all share the same public key / address. One spend reveals the key for everything sitting on that address.
- Keeping large amounts in hot wallets or exchange accounts long-term: Those keys are usually already online and their public keys are often exposed or easier to obtain.
- Spending from cold storage unnecessarily or frequently: Every spend publishes a public key. The fewer times you touch cold funds, the fewer keys you expose.
- Not generating fresh receive addresses: Continuously giving out or using the same receive address so that when you eventually spend, the key is already linked to a long history.
- Ignoring change outputs: Letting your wallet send change back to a previously used address instead of a brand-new one.
- Assuming multisig by itself protects against quantum: Multisig does not help against a cryptographic break of the underlying signatures. Each key can still be attacked independently once its public key is known.
- Delaying migration once post-quantum features become available: If Bitcoin later activates quantum-resistant signature schemes, leaving funds on old ECDSA/Schnorr keys longer than necessary.
Good habits that reduce your quantum surface
- Use a brand-new address for every receive.
- When you must spend, send change to a fresh, never-used address.
- Minimize how often you spend from cold storage.
- Prefer native SegWit (P2WPKH / bc1q) addresses for long-term cold storage — these keep the public key hidden behind a hash until you spend.
- Keep the bulk of your funds in unspent outputs whose public keys have never been published on-chain.
These practices meaningfully shrink the set of keys a future quantum computer could target under Bitcoin’s current cryptography.
The Quantum Threat in Simple Terms
Quantum computers threaten two scenarios:
- Long-exposure attacks — An attacker has years to break a public key that has already been published on-chain (common with P2PK coins, reused addresses, and Taproot key-path spends).
- Short-exposure attacks — An attacker must break a key while a transaction is in the mempool (seconds to minutes).
BIP 360 tackles the first. SHRIMPS (and future follow-ups) tackle the second by replacing vulnerable signatures with quantum-safe ones.
What Is BIP 360?
(Pay-to-Merkle-Root / P2MR)
Merged into the official Bitcoin BIPs repository on February 11, 2026, BIP 360 introduces a new native SegWit output type called Pay-to-Merkle-Root (P2MR).
It is modeled closely after Taproot (P2TR) but with one critical change: the quantum-vulnerable key-path spend is completely removed. Every P2MR output commits only to the Merkle root of a script tree.
- Address prefix: bc1z (Bech32m)
- ScriptPubKey: OP_2 + 32-byte Merkle root
- Requires: BIPs 340, 341, and 342
Key benefits:
- Preserves all the powerful scripting capabilities of Taproot (Lightning, BitVM, Ark, etc.).
- No internal public key is ever exposed on-chain until a script-path spend occurs.
- Makes long-exposure attacks impractical.
Comparison Table:
| Feature | Pay-to-Taproot (P2TR) | Pay-to-Merkle-Root (P2MR / BIP 360) |
|---|---|---|
| Key-path spend | Yes (Schnorr signature) | Removed (quantum protection) |
| Script-path spend | Yes | Yes (identical to Taproot) |
| Quantum long-exposure safe | No | Yes |
| Witness size (typical) | Smaller | Larger (always script path) |
| Address prefix | bc1p | bc1z |
BIP 360 is intentionally conservative — it is “Step 1” that creates a safe on-ramp for future post-quantum signatures without breaking existing scaling tools.
Current status:
Draft BIP, first live implementation running on BTQ Technologies’ Bitcoin Quantum testnet (v0.3.0, released March 19, 2026). No activation date yet.
What Is SHRIMPS?
Announced at the end of March 2026 by Jonas Nick (Blockstream researcher), SHRIMPS is a stateful, hash-based post-quantum signature scheme built specifically for Bitcoin.
- Signature size: ~2.5 KB (roughly 3× smaller than NIST’s SLH-DSA at similar security levels).
- Multi-device friendly: Multiple devices loaded from the same seed (like BIP-32) can independently generate signatures without coordination issues.
- Design goal: Fit Bitcoin’s tight block space and fee constraints while remaining quantum-resistant.
It builds on the same hash-based family as related proposals (e.g., SHRINCS for single-device ultra-compact signatures). SHRIMPS removes the single-device limitation, making it more practical for real-world wallets and hardware signers.
SHRIMPS is not yet a BIP, but it is explicitly discussed as a strong candidate to pair with output types like P2MR.
How BIP 360 and SHRIMPS Work Together
Think of it as layers of defense:
- BIP 360 (P2MR) provides the output wrapper — a quantum-safe address format that never exposes a long-lived public key.
- SHRIMPS provides the signature primitive — compact, quantum-resistant signatures that can be used inside script paths.
This combination allows Bitcoin to keep Taproot-style efficiency for complex contracts while migrating the actual cryptography to post-quantum algorithms. Future soft forks could activate specific signature schemes inside P2MR outputs.
The full migration will likely take several years (estimates range from 3–7 years once activation begins), involving node software, wallets, exchanges, and user education. Starting now gives the ecosystem time to move calmly.
Why This Matters for Bitcoin Users
- HODLers: You’ll eventually have a clear path to migrate legacy and Taproot coins to safer bc1z addresses.
- Developers: Lightning, BitVM, Ark, and other Layer 2/3 solutions can continue building on familiar scripting primitives.
- Institutions & Governments: Signals that Bitcoin is taking quantum risks seriously (aligning with broader timelines like U.S. CNSA 2.0).
Even if a powerful quantum computer is still years away, proactive upgrades protect network credibility and your sats.
Current Status & Next Steps (as of April 2026)
- BIP 360 → Merged as Draft; live on BTQ Quantum testnet.
- SHRIMPS → Newly proposed; under discussion in Bitcoin developer circles.
- Broader roadmap → Expect more BIPs for signature activation, test vectors, and migration tools.
Watch the authors and discussions:
- BIP 360: Hunter Beast (@cryptoquick), Ethan Heilman, Isabel Foxen Duke
- SHRIMPS: Jonas Nick (@n1ckler)
Official Resources
- BIP 360: bip360.org and GitHub BIP text
- BTQ Bitcoin Quantum testnet announcement
- SHRIMPS proposal discussions (Delving Bitcoin, recent developer mailing lists, and X threads)
Bottom line: Bitcoin is not sitting idle. BIP 360 gives us a safer output type today, and SHRIMPS shows how compact post-quantum signatures can fit Bitcoin’s unique needs. Combined, they represent a thoughtful, engineering-driven approach to quantum resistance — preserving what makes Bitcoin great while preparing for the future.
The quantum clock is ticking, but the protocol is already moving. Stay informed, use fresh addresses where possible, and support the developers doing the hard work.This page was last updated April 2026 and combines the latest public information on both proposals.
Attacking bitcoin mining with a quantum computer would require the energy of a star, academics say
One paper finds that attacking the bitcoin blockchain through quantum mining would demand the energy output of a star. Another replicates every major “quantum factoring breakthrough” using a 1981 home computer and a dog.
What to know:
- Quantum computers pose a genuine long-term risk to bitcoin, but current fears often conflate wallet vulnerabilities with largely impractical threats to mining.
- New research finds that a quantum 51% attack on bitcoin mining would require star-level energy and hardware on a scale that is physically unreachable.
- The more realistic concern is that future quantum machines could eventually target exposed or older bitcoin wallets, though developers are already pursuing upgrades to harden the network against such attacks.
Bitcoin Quantum Resistance:
