BIP-360 and the Bitcoin Coins That Cannot Move

cover

Introduction

Moving a Bitcoin to a quantum-resistant output requires producing an elliptic-curve signature with the key that a quantum computer would break. That is the structural trap at the center of every migration plan. The coins facing the most acute exposure are the ones whose owners are absent, and an absent owner cannot sign a sweep transaction. No amount of wallet tooling, exchange coordination, or client-side upgrade work changes that reality. Any protocol-level treatment of those coins requires a consensus decision rather than a user action.

Alex Pruden, CEO of Project Eleven, made the coordination argument publicly at Consensus Miami in early May 2026, and his framing serves as an anchor for the problem: this migration will be harder than Taproot, because Taproot was opt-in and partial adoption was acceptable, while a post-quantum migration only delivers its security benefit if effectively everyone participates. He put Taproot’s rollout at roughly five years as a benchmark and argued that Bitcoin should move a post-quantum signature scheme out of research and into production before hardware timelines resolve, on asymmetric-risk grounds rather than on confident forecasting.

Our sourcing on this topic runs through early May 2026 and remains thinner than the subject deserves. BIP-360 was proposed in 2025 to add a quantum-resistant Taproot-style output type, and that much is on the record. Claims circulating about a February 2026 merge into Bitcoin Core, about the specific phasing in a companion migration BIP, about a 2026 Google Quantum AI result cutting the resource estimate for breaking secp256k1, and about a dedicated Ethereum post-quantum team are not things we could verify against primary documents. We treat them as unconfirmed and reason from mechanism instead, flagging each gap where it appears. The mechanics of public-key exposure, of sweep transactions, of block weight, and of the UTXO model are verifiable from the protocol itself, and they show where this migration breaks.

The exposure is uneven, and it is about public keys

Shor’s algorithm, published in 1994, is the reason this is a live engineering question rather than a theoretical abstraction. A sufficiently capable quantum computer running it could derive a private key from a known public key on an elliptic curve such as secp256k1. The relevant asset at risk is therefore not the address. It is the public key, and Bitcoin’s output types differ in whether they publish one.

Three categories matter. Early pay-to-public-key outputs, including the coinbase outputs associated with the Patoshi mining pattern, carry a raw public key in the script itself. They have been sitting in plain view since 2009. Pay-to-public-key-hash and its witness variant publish only a hash of the key while unspent, but reveal the key the moment they are spent, so any address that has ever been spent from and then reused is fully exposed. Taproot outputs commit a 32-byte tweaked public key directly in the scriptPubKey, which means an unspent Taproot output is pubkey-exposed by construction. The most recently designed output type in wide use is, on this axis, among the least protected.

Hash-based protection is weaker than it first appears. It does not provide durable secrecy; it is a delay that lasts exactly until the owner attempts to spend. The spending transaction reveals the public key and the signature in the same message, and that message sits in the mempool for some period before confirmation. Pruden described the resulting race condition: once a cryptographically relevant quantum computer exists, an attacker watching the mempool could derive the private key from the revealed public key, construct a competing transaction paying itself, attach a higher fee, and win block inclusion ahead of the legitimate owner. The defense window is one confirmation interval, and it shrinks as the attacker’s key-recovery time falls.

That mechanism has an immediate implication for migration sequencing. A holder who waits until a quantum computer is known to exist and then rushes to sweep coins into a quantum-resistant output broadcasts exactly the information the attacker needs, at the moment the attacker is watching. Sweeps must happen while key recovery remains infeasible, which means the migration’s timing cannot be driven by evidence of an active attack. It must be driven by a forecast, and that forecast is contested.

Pruden characterized Bitcoin Core developer sentiment on the threat as mixed rather than monolithic, with some contributors believing capable quantum computers will never arrive, against what he described as majority physicist opinion that they will and that timelines may be compressing. That disagreement is not a minor detail. A migration whose primary justification is a probability distribution over hardware progress cannot generate a hard deadline by technical argument alone, and Bitcoin has no mechanism for imposing deadlines by other means.

What an opt-in output type does and does not solve

BIP-360’s contribution, as proposed in 2025, is a new output type that authenticates spends with a post-quantum signature scheme rather than with Schnorr or ECDSA. Conceptually this is the tractable half of the problem. Adding an output type is a soft fork of the familiar kind. Nodes that do not upgrade see spends from the new type as anyone-can-spend under older rules and rely on upgraded nodes to enforce the real conditions, which is the same pattern that shipped SegWit and Taproot. Nothing about existing UTXOs changes. Wallets that want the new type use it; wallets that do not, do not.

We were not able to review the current specification text, and the precise scheme selection, script format, and activation mechanism remain gaps in our sourcing rather than settled facts we are withholding. What is on the record is the shape of the cryptographic choice. NIST has standardized post-quantum signature families based on hash functions and on lattices, and Bitcoin developer discussion has reportedly trended toward the hash-based option. The stated reasons are not in our sources, though the general tradeoff is well understood in the cryptography literature: hash-based constructions rest on weaker and older assumptions about hash function security rather than on newer structured-lattice problems, at the cost of larger signatures and, in some constructions, statefulness that complicates key management. Conservatism about assumptions is a defensible priority for a protocol whose failure mode is irreversible.

Blockstream has already deployed a hash-based signature scheme on the Liquid network, which gives the debate something rare in this area: a production system carrying real value under a post-quantum scheme, with observable operational behavior. Liquid is a federated sidechain with a very different trust and throughput profile from Bitcoin’s base layer, so it cannot answer questions about mainnet fee markets or block weight. It can answer narrower questions about implementation maturity, signing performance, and whether the key-management model survives contact with custody operations.

The part an opt-in output type cannot solve is coverage. Every coin that is not moved into a quantum-resistant output stays exposed, and nothing in a new-output-type soft fork causes coins to move. Migration of the existing UTXO set is a separate problem with a separate political economy, which is where proposals for phased deprecation of legacy output types come in. Our sourcing does not describe the phasing in any such proposal, and we decline to reconstruct it. The mechanism question worth stating plainly is that any real deprecation means a consensus rule that eventually rejects otherwise-valid ECDSA and Schnorr spends. That is the only enforcement lever the protocol has, and it permanently destroys the spendability of anything left behind.

Opt-in works until the unmigrated coins become everyone’s problem

Taproot’s partial adoption was tolerable because the cost of not adopting fell entirely on the non-adopter, and the cost was mild: slightly larger transactions, no script-path privacy, no key aggregation. Adoption curves could run for years without imposing externalities on others.

Post-quantum migration inverts that dynamic. The first-order loss from staying on an exposed output type falls on the holder, but the second-order effects do not stay contained, and three channels carry them.

The first is collateral. BTCFi has spent years building lending markets, staking systems, and wrapped representations on top of the assumption that a Bitcoin UTXO is a settled claim. A quantum-vulnerable UTXO used as collateral is a claim with a probabilistic expiry, and the protocols holding it have no way to price that risk. If the exposure of a lender’s collateral base depends on whether unrelated counterparties completed a key rotation, migration status becomes a credit parameter, and no lending protocol currently tracks it as one.

The second is custodial concentration. Exchanges and custodians hold coins in cold storage structures designed for infrequent access, often multisig setups with geographically distributed key shards and signing ceremonies measured in days. Rotating those keys to a new output type is not a simple software upgrade; it requires repeating the original key ceremony across the entire book, plus proof-of-reserves reconciliation afterward. The institutions holding the largest concentrations of coins are the ones for whom moving is operationally slowest.

The third is monetary. A successful theft of long-dormant coins, particularly Satoshi-attributed coins, would not read as an isolated loss. It would read as evidence that Bitcoin’s issuance schedule and its property guarantees are conditional, and the market would reprice that interpretation across every coin, migrated or not. This channel turns an individual security decision into a collective one, which is why voluntary migration fails as a comprehensive defense.

Pruden’s asymmetry argument follows from this. Waiting costs relatively little if quantum hardware stalls, because a post-quantum output type sitting unused is a modest maintenance burden. Waiting costs a great deal if hardware arrives while the UTXO set is still mostly on secp256k1, because the migration itself becomes unsafe once attackers watch the mempool. The counterargument deserves a fair statement: Bitcoin’s history includes a long list of urgently forecast threats that did not materialize on schedule, consensus changes carry their own tail risks, and a scheme chosen under time pressure in 2026 could turn out to be the wrong choice for 2040. Developers who believe the threat is remote are not being careless by declining to spend Bitcoin’s limited coordination capacity on it now. They are making a different calculation about which risk is larger.

The sweep is the operation, and the operation has a cost

A migration is not a software update. It is an on-chain event in which a large fraction of the UTXO set gets spent into new outputs, and specific ordering constraints follow from that.

Wallet and library support must land first, because nothing downstream can move until there is a tested implementation that can generate post-quantum keys, construct the new output type, sign, and verify. Next come hardware signers, which have long firmware review cycles and, for hash-based schemes with state, may need storage and state-tracking behavior that existing devices were not designed for. Hot-wallet infrastructure at exchanges follows, which is the easiest institutional layer to move because keys are already online. Cold storage and custody follow, which is the slowest institutional layer and holds the largest balances. Finally, the long tail of self-custodied coins in paper backups, inherited seed phrases, and dormant wallets must migrate. We infer this sequence from the technical dependency structure rather than reporting it from a published plan; no source we reviewed specifies an operational order, and any real schedule would be determined by participants rather than by protocol rules.

Two economic features of the sweep phase require examination. First, it represents a demand shock to block space concentrated in whatever window the migration actually occupies. Every migrating UTXO needs an input, and consolidation only partly offsets that footprint. If a deprecation deadline exists, rational holders wait until close to the cutoff, compressing demand further and driving fees up exactly when the least sophisticated holders attempt to move. Second, the sweep transaction reveals the old public key, so a holder who migrates late is exposed during the interval when attacker capabilities are most likely to exist. Late migration is more expensive and less safe simultaneously, creating a steep penalty for anyone who misses the window.

Signature size meets a fixed block weight

Bitcoin’s block weight limit does not adjust to accommodate a heavier signature scheme. Schnorr signatures under Taproot are 64 bytes, and a single-input, single-output key-path spend is among the smallest transactions the protocol supports. Post-quantum signature schemes, in both the hash-based and lattice-based families NIST standardized, carry substantially larger signatures and in several cases larger public keys. We do not have verified figures for the specific parameter sets under consideration for Bitcoin, and quoting sizes for an unconfirmed scheme would be irresponsible. The directional conclusion holds without the exact numbers.

Two distinct effects follow. The migration itself is a one-time cost: a large volume of transactions spending old outputs, each still authenticated by a compact ECDSA or Schnorr signature, meaning the sweep phase is expensive primarily because of transaction count rather than signature size. The permanent cost arrives afterward, when every spend from a quantum-resistant output carries the larger signature in its witness. Effective transactions per block falls by whatever ratio the new witness data imposes, and the fee required to occupy a given fraction of block space rises correspondingly. The witness discount introduced with SegWit softens this, since witness data is weighted at one quarter relative to non-witness data, but it does not remove the overhead.

The consequences reach beyond base-layer fee levels. Lightning channel operations, coinjoin constructions, and batching schemes with many inputs all scale their on-chain footprint with per-signature size. Multisig experiences the sharpest increase, since a threshold structure multiplies the signature count. If post-quantum signatures are sufficiently large, some multisig configurations that are economically routine today become expensive enough to alter how custody is structured, pushing institutional holders toward fewer, larger signing quorums or toward aggregation schemes that may not yet exist for the chosen primitive. Modeling this properly requires the actual parameter set and an assumption about migrated-UTXO composition. Neither is available, and the throughput cost of post-quantum Bitcoin remains unquantified in public research.

Five million coins nobody can move

Inside the CoinDesk account of Pruden’s remarks, a figure of upward of five million dormant coins appears, attributed to a person identified only as Harper and including Patoshi-pattern coins. We have no methodology for that number and no independent confirmation, and dormancy definitions vary widely depending on the lookback window chosen, so we treat it as an order-of-magnitude indication rather than a precise measurement. The qualitative claim is defensible regardless: a large, monetarily significant block of coins sits in output types that publish public keys and has not moved in over a decade.

By definition, those coins cannot migrate. Migration requires a signature; a signature requires a key; a coin dormant because the key is lost stays dormant. The set of coins that will remain quantum-vulnerable after any voluntary migration is therefore nearly identical to the set of coins whose owners are gone. Every policy option is a decision about what to do with them.

Leaving them untouched means that whoever first builds a cryptographically relevant quantum computer can spend them. There is an argument, which appears in no source we reviewed and which we present as an open theoretical position, that this is consistent with Bitcoin’s permissionless design. Coins have historically gone to whoever solved the applicable computational problem, as with proof-of-work mining. The counterargument is direct: mining allocates newly issued coins under rules established in advance; a quantum attack reallocates coins already owned, under rules nobody agreed to, and the first entity with a capable machine is far likelier to be a nation-state or a major enterprise than an individual user. That does not represent a permissionless outcome.

Freezing them requires a consensus rule that refuses to accept spends from quantum-vulnerable output types after a designated block height, protecting dormant supply from theft by making it permanently unspendable. The fixed supply narrative survives intact because no coins are created, but a protocol rule change permanently strips spending rights from identifiable outputs. If a private key is later recovered legitimately, the coins remain locked.

Pruden’s own preference is a third option. He argued for allowing dormant coins to be recycled back into the end of the supply curve, extending miner incentives after the subsidy approaches zero, and he explicitly characterized this as confiscation while stressing that the market and community must decide. The engineering appeal is clear: Bitcoin’s long-run security budget depends on fee revenue replacing block subsidy, a transition that lacks a proven outcome. Recycling dormant coins converts a quantum vulnerability into decades of additional issuance to fund hashrate.

The cost is that it establishes a precedent that the protocol can reassign ownership of specific balances when a compelling reason exists. Bitcoin’s monetary credibility does not rest solely on the 21 million cap; it rests on the guarantee that consensus rules do not reassign balances. A precedent that dormancy plus vulnerability justifies reallocation invites future arguments about other justifications. On the question of which option damages monetary credibility less, freezing provides a narrower precedent than recycling, because it removes spendability without transferring value to anyone, and because a frozen output could theoretically be unfrozen by a subsequent rule change, whereas reissued coins cannot be recalled. Freezing still requires deciding whose coins get frozen, and any threshold drawn by address type or age risks catching live holders who were simply inactive.

This dynamic makes the comparison to Taproot especially clear in the direction Pruden intended. Taproot was a complex engineering problem with a straightforward social consensus. Post-quantum migration is a complex engineering problem tied to a social question Bitcoin has never resolved, and the decision cannot be deferred indefinitely, because leaving it unaddressed defaults to letting an attacker resolve it.

Why the UTXO model makes this harder than an account model

The structural difference between Bitcoin and account-based chains explains why the same cryptographic threat produces fundamentally different migration challenges. To be explicit about the boundary of our evidence: claims regarding a dedicated Ethereum post-quantum team and specific account-abstraction migration roadmaps are not confirmed in our sources, and we reason strictly from underlying data models rather than reporting specific project timelines.

In Bitcoin, the authentication condition is part of the output itself. A UTXO is a script combined with a value amount, and the only mechanism for changing how that value is authenticated is to spend it and construct a new output with a different script. No protocol operation exists to modify a coin’s spending condition while leaving the UTXO in place. The spend requires the existing private key signature, which forms the core vulnerability trap, and it requires an active owner.

In an account model, the balance resides at a persistent identifier, and the authentication logic is state associated with that identifier. If that logic is executed as smart contract code rather than as a hardcoded protocol rule, the verification method can be updated while the balance remains stationary. Smart contract accounts already use this capability to rotate signers and alter verification logic without moving underlying assets. A post-quantum upgrade for such an account is a logic migration rather than a transfer of funds, eliminating the fee pressure of a mass sweep and avoiding the need to broadcast an exposed legacy public key.

Three qualifications prevent this from being a complete solution. Externally owned accounts, where the authentication rule is fixed at the protocol level as ECDSA, face the same fundamental challenge as Bitcoin and still represent a substantial share of value on account-based networks. Upgradable authentication logic introduces its own attack surface, and an upgrade mechanism that a quantum attacker could manipulate presents severe risks. Finally, in both architectures, an owner who has lost their keys cannot initiate an upgrade, meaning the dormant-coin dilemma persists across both paradigms. The account model simplifies the migration path for active holders, but it does not resolve the governance dilemma for abandoned assets.

What would actually indicate progress

The concrete indicators worth monitoring are narrower than the general discussion around them.

First, whether a post-quantum output type receives a concrete activation pathway rather than remaining a draft specification. A merged BIP and an active consensus rule represent distinct milestones, and verified reporting confirms only that BIP-360 was proposed in 2025. Confirmation of its current standing in Bitcoin Core, along with the specifics of any phased-migration proposal, remains the central gap in public tracking.

Second, whether the selected signature scheme is published with formal parameter sets and empirical witness sizes. Until these benchmarks are available, assertions regarding post-quantum Bitcoin’s throughput capacity remain speculative. Liquid’s operational hash-based deployment offers the closest empirical reference, and verifiable data from it concerning signing performance and key-state tracking would inform the technical debate more than further timeline forecasts.

Third, whether major custodians publish formal migration schedules with explicit dates. Cold storage key rotation across deep institutional reserves represents the critical path, and institutions managing the largest balances face the slowest operational procedures alongside the strongest incentives to begin early. Their absence from public discussions as of mid-2026 provides a clearer signal of near-term urgency than informal developer surveys.

Fourth, whether the dormant-coin question finds an institutional venue for discussion. It currently has none. Pruden presented his coin-recycling proposal as an individual position and noted that the market would decide, which accurately reflects that no formal mechanism exists to make such a determination. A consensus change altering the spendability of five million coins cannot be resolved through a standard soft fork activation cycle, and the absence of a forum for that debate presents a more immediate constraint on migration than the underlying cryptographic challenges.

One analytical discrepancy remains unresolved. Pruden’s estimate of roughly $2.3 trillion in at-risk digital assets represents a broad framing without an articulated methodology, and it contrasts with the approximately $700 billion estimate frequently cited for quantum-exposed Bitcoin specifically. These two figures evaluate different asset scopes, and neither is accompanied by a public ledger accounting specifying which output types were evaluated at which date. Any institution evaluating exposure risk requires that accounting baseline first, because a migration whose exact parameters remain unmeasured is difficult to budget and impossible to schedule reliably.