Woofun AI reports that Bitcoin Improvement Proposal 361, titled "Post Quantum Migration and Legacy Signature Sunset," establishes a structured framework for defending the network against future quantum computing threats. Authored by Jameson Lopp alongside Christian Papathanasiou, Ian Smith, Joe Ross, Steve Vaile, and Pierre-Luc Dallaire-Demers, the proposal introduces a mandatory migration path for legacy cryptographic keys. The core objective is to systematically phase out outputs protected by vulnerable legacy cryptography and enforce stricter spending conditions on coins that fail to migrate, thereby securing the network’s long-term integrity.

The proposal’s development timeline reflects a deliberate, cautious approach to such a critical infrastructure change. Initially assigned on February 11, 2026, the document was updated on July 20, 2026, to refine its technical specifications and operational guidelines. Currently classified as a draft informational proposal, BIP-361 holds no immediate binding authority over the network. It has not been activated, meaning Bitcoin holders are under no current obligation to move their funds. The proposal serves as a technical blueprint rather than an active protocol rule, pending further consensus and development.

Successful implementation requires coordination across a broad spectrum of network participants, including wallet providers, exchanges, custodians, miners, and individual holders. These stakeholders would be granted several years to prepare for the transition. A critical dependency for the plan is the prior definition of a separate BIP that establishes a standardized post-quantum signature scheme and output type. Developers must first agree on this cryptographic standard, rigorously test its impact on verification processes and block space utilization, and secure sufficient network support before the migration timeline can commence.

The migration process is divided into distinct phases, beginning with Phase A, which would initiate 160,000 blocks after activation. The authors estimate this period to be approximately three years. During Phase A, transactions spending coins from legacy scripts would generally be permitted only if the funds are sent to a post-quantum destination. Existing wallets would not be immediately frozen, but users would lose the ability to move their BTC into another output protected solely by the same legacy signature system. This mechanism aims to halt the creation of new quantum-vulnerable outputs while maintaining a viable migration path for existing holdings.

Phase B would follow approximately two years after Phase A, placing the full transition roughly five years after activation. At this stage, spending unmigrated coins would require a quantum-safe recovery process designed to distinguish the legitimate wallet owner from an attacker who had derived a private key from an exposed public key. Funds that could not satisfy an accepted recovery method could become effectively unspendable. This measure is intended to prevent quantum attackers from stealing these assets, though it may also impact owners who missed the migration window and lack the information required to prove control.

The threat model centers on the ability of a quantum attacker to calculate a private key from a public key exposed on-chain. Crucially, such an attack would not necessarily reveal the wallet’s original seed phrase or the parent keys from which the address was derived. Many wallets created since 2012 utilize BIP-32 hierarchical deterministic wallets. When hardened derivation is employed, a legitimate holder may possess parent-key information that cannot be reconstructed by attacking a single exposed public key, providing a structural advantage for recovery.

To address these challenges, BIP-361 discusses the potential use of zero-knowledge systems, including ZK-STARK-based approaches, and commit-and-reveal mechanisms. These technologies could allow owners to prove knowledge of the original wallet structure without publishing the underlying secret.

However, no final recovery method has been selected, and the proposal acknowledges that researchers do not yet know how much legacy Bitcoin could be covered by these techniques. Early Pay-to-Public-Key outputs present a more difficult problem because their public keys have been visible since the coins were received. For these outputs, the draft identifies no established proof that would reliably separate the original holder from an attacker who had calculated the corresponding private key.

Woofun AI data shows that as of March 1, 2026, more than 34% of all bitcoin had already revealed a public key on-chain, significantly increasing exposure to potential quantum attacks. The authors support compatibility with a separate "Hourglass" style mechanism for affected P2PK coins, provided such a proposal is developed and activated before Phase B. Without an additional solution, some early or dormant holdings may not have the same recovery path as newer hierarchical wallets, leaving them vulnerable to permanent loss or theft.

Bitcoin currently relies on ECDSA and Schnorr signatures to prove that a transaction was authorized by the holder of a private key. Outputs whose public keys have not yet been revealed receive an additional layer of protection because the blockchain initially contains only a hash. Once coins are spent, the public key normally appears in the transaction data. A sufficiently capable quantum computer could theoretically use Shor’s algorithm to derive a private key from an exposed public key and authorize a competing transaction. BIP-361 does not claim that machines capable of doing this exist today but argues that migration would take long enough that the network should establish a process before the danger becomes immediate.

The urgency of this preparation has intensified following recent advancements in quantum computing research. Google Quantum AI researchers estimated that an attack on the elliptic-curve cryptography used by Bitcoin could require roughly 1,200 to 1,450 logical qubits.

Furthermore, revised estimates for the necessary physical hardware were reported to be about 20 times lower than earlier projections, suggesting that viable quantum threats may emerge sooner than previously anticipated. Grayscale’s research team has argued that blockchain networks should begin preparing now, because replacing the cryptography may be easier than coordinating millions of users, wallets, and service providers through a secure migration.

The proposed migration involves substantial operational changes beyond individual holders moving coins between addresses. Exchanges and custodians would need to update deposit systems, withdrawal infrastructure, and cold-storage procedures. Hardware-wallet manufacturers would need to support post-quantum keys and signatures, which may be substantially larger than those used by Bitcoin today. Miners and fully validating nodes would also need software capable of enforcing the new spending conditions. The changes are envisioned as soft forks, allowing older nodes to remain connected while leaving them unable to independently verify all of the new post-quantum rules.

BIP-361 currently lacks an activation block, implementation release, or approved post-quantum signature scheme. Its update on July 20 did not begin the proposed five-year transition. Developers still need to determine which cryptographic system Bitcoin could support without creating unreasonable signature sizes, verification costs, or pressure on block space. The recovery process for unmigrated funds also needs to be designed and tested, particularly for early P2PK outputs. The proposal provides the ecosystem with a possible order of operations: introduce a quantum-resistant destination, stop creating new legacy exposure, and later restrict coins that were never migrated. Whether this sequence becomes part of Bitcoin will depend on the missing signature standard, the viability of the recovery methods, and wider agreement over how to handle dormant funds.