Bitcoin's Quantum Fix Is a Sequence of Soft Forks and Only Step One Has a Merged Spec: BIP-360 P2MR Is Draft v0.12.1 With No PQ Signature Inside, the First Hash-Signature BIP (SHRINCS) Appeared This Month, Core Has No Open PR, and 5.6-6.9M BTC Sit Exposed While Taproot Took 22 Months
As of 22 September 2026 not one satoshi on mainnet can be made quantum-safe, and the shortest honest path needs at least three consensus changes in a fixed order. BIP-360 is the only piece with a merged spec, and it is Status: Draft, v0.12.1, now titled Pay-to-Merkle-Root (P2MR): a Taproot output with the key-path spend deleted (witness v2, bc1z), merged into bitcoin/bips in February 2026 after two renames (P2QRH, P2TSH, P2MR). Its text says it mitigates only "long exposure attacks" and that short-exposure protection "may require the introduction of post-quantum signatures", deferred to "a separate proposal". BIP-360 contains no post-quantum cryptography; the day you spend, you reveal an EC key in the mempool like everyone else.
The order is: (1) a PQ signature scheme gets a BIP and an opcode; (2) an output type to host it (P2MR, or Pieter Wuille's preferred P2TRv2) activates; (3) wallets and custodians ship it; (4) coins move; (5) something handles coins that never move. Step 1 began this month: Optech's 4 September newsletter records Conduition's SHRINCS draft BIP, hash-based, 48-byte public keys, 548-byte stateful signatures, 5,777-byte stateless fallback, which Antoine Riard put at roughly 90x today's on-chain cost unless discounted. Step 2 has no live Bitcoin Core PR: #35107 (18 April 2026) closed the same day with zero reviews, and the one regtest implementation on Delving Bitcoin (28 July, about 96 lines of consensus code, a 2-leaf P2MR spend at 129 vsize versus 137 for the P2TR script-path equivalent) opens with "I'm not proposing anything about activation". BIPs #2198 (June) made a depth-zero P2MR tree anyone-can-spend once revealed, deliberately, so wallets cannot drop the PQ fallback leaf to save bytes. Step 5 is BIP-361 (Lopp and five co-authors, Draft, Informational, April 2026). Its header reads "Requires: TBD Post Quantum Signature BIP", so by its own text it cannot activate before step 1 exists. Phase A (no sends to EC outputs) starts 160,000 blocks, about three years, after activation; Phase B, two years later, does not burn coins but encumbers ECDSA/Schnorr spends with a rescue protocol, and the authors back Hourglass V2 (Hunter Beast, March 2026: P2PK spends capped at 1 BTC per block, stretching the ~1.72M BTC pool over 32+ years) because no rescue protocol is known for keys that were public from day one.
The exposure figure depends on the snapshot. Deloitte's older count was ~25% of supply (about 2M BTC in P2PK plus 2.5M in reused P2PKH). Chaincode's May 2025 report gives 6.26M BTC (~US$650B): P2PK is 1,720,747 BTC, 8.68% of value in 0.025% of UTXOs; Taproot only 146,715 BTC; plausible range 4-10M (20-50%). Project Eleven's 110-page May 2026 report says 5.6-6.9M BTC (up to ~$500B): 4.99M in reused addresses (72.3%), 1.72M in P2PK (24.8%), ~198k in Taproot (2.9%). BIP-361 states over 34% of all bitcoin had a revealed key on 1 March 2026. Satoshi-era P2PK is the smaller problem; custodians reusing addresses is the larger one, fixable today with no fork.
What headlines got wrong: "BIP-360 merged" means merged into a document repo, not activated; "P2TSH" has been stale since February; "BIP-361 freezes coins" describes a phase five years after an activation that cannot begin yet; and the Bitcoin Security Consortium (23 July 2026: Anchorage, ARK, BlackRock, Block, Blockstream, Coinbase, Fidelity Digital Assets, Galaxy, Strategy; $15M over three years, no pooled fund, coordinated by Brink's Mike Schmidt as a volunteer) said at launch it "will not direct Bitcoin development or take positions on proposed protocol changes". Money buys review hours, not consensus.
Timing: Taproot, uncontroversial with a finished spec, went from BIP numbers (January 2020) to Core merge (October 2020) to lock-in (June 2021) to activation at block 709,632 on 14 November 2021: 22 months, 13 after merge. SegWit took over two years. Step 1's spec appeared this month. Chaincode plans a ~2-year contingency track and a ~7-year comprehensive one; Project Eleven says Q-day is more likely than not by 2033, possibly 2030. Taproot pace from a September 2026 draft lands a PQ output type around mid-2028 at the earliest, with wallet support, which Wuille calls "the bottleneck", after that; the mechanical migration is 76-142 days at 100% block space in the estimates Chaincode cites.
Watch: whether SHRINCS gets a BIP number and an opcode proposal; whether a Core PR for P2MR or P2TRv2 opens and stays open; whether BIP-361's "Requires" line ever names a real BIP; and the reuse-versus-P2PK split in Project Eleven's next snapshot, since falling address reuse is the only quantum progress that needs no fork.
Sources (6)
AI Research
Key Takeaway
No satoshi can be quantum-safe on mainnet until a post-quantum signature BIP (first draft: SHRINCS, September 2026) activates alongside an output type to hold it, and BIP-360 P2MR, BIP-361 and the $15M consortium are all upstream of that gate, not substitutes for it.
As of 22 September 2026 not one satoshi on mainnet can be made quantum-safe, and the shortest honest path needs at least three consensus changes in a fixed order. BIP-360 is the only piece with a merged spec, and it is Status: Draft, v0.12.1, now titled Pay-to-Merkle-Root (P2MR): a Taproot output with the key-path spend deleted (witness v2, bc1z), merged into bitcoin/bips in February 2026 after two renames (P2QRH, P2TSH, P2MR). Its text says it mitigates only "long exposure attacks" and that short-exposure protection "may require the introduction of post-quantum signatures", deferred to "a separate proposal". BIP-360 contains no post-quantum cryptography; the day you spend, you reveal an EC key in the mempool like everyone else.
The order is: (1) a PQ signature scheme gets a BIP and an opcode; (2) an output type to host it (P2MR, or Pieter Wuille's preferred P2TRv2) activates; (3) wallets and custodians ship it; (4) coins move; (5) something handles coins that never move. Step 1 began this month: Optech's 4 September newsletter records Conduition's SHRINCS draft BIP, hash-based, 48-byte public keys, 548-byte stateful signatures, 5,777-byte stateless fallback, which Antoine Riard put at roughly 90x today's on-chain cost unless discounted. Step 2 has no live Bitcoin Core PR: #35107 (18 April 2026) closed the same day with zero reviews, and the one regtest implementation on Delving Bitcoin (28 July, about 96 lines of consensus code, a 2-leaf P2MR spend at 129 vsize versus 137 for the P2TR script-path equivalent) opens with "I'm not proposing anything about activation". BIPs #2198 (June) made a depth-zero P2MR tree anyone-can-spend once revealed, deliberately, so wallets cannot drop the PQ fallback leaf to save bytes. Step 5 is BIP-361 (Lopp and five co-authors, Draft, Informational, April 2026). Its header reads "Requires: TBD Post Quantum Signature BIP", so by its own text it cannot activate before step 1 exists. Phase A (no sends to EC outputs) starts 160,000 blocks, about three years, after activation; Phase B, two years later, does not burn coins but encumbers ECDSA/Schnorr spends with a rescue protocol, and the authors back Hourglass V2 (Hunter Beast, March 2026: P2PK spends capped at 1 BTC per block, stretching the ~1.72M BTC pool over 32+ years) because no rescue protocol is known for keys that were public from day one.
The exposure figure depends on the snapshot. Deloitte's older count was ~25% of supply (about 2M BTC in P2PK plus 2.5M in reused P2PKH). Chaincode's May 2025 report gives 6.26M BTC (~US$650B): P2PK is 1,720,747 BTC, 8.68% of value in 0.025% of UTXOs; Taproot only 146,715 BTC; plausible range 4-10M (20-50%). Project Eleven's 110-page May 2026 report says 5.6-6.9M BTC (up to ~$500B): 4.99M in reused addresses (72.3%), 1.72M in P2PK (24.8%), ~198k in Taproot (2.9%). BIP-361 states over 34% of all bitcoin had a revealed key on 1 March 2026. Satoshi-era P2PK is the smaller problem; custodians reusing addresses is the larger one, fixable today with no fork.
What headlines got wrong: "BIP-360 merged" means merged into a document repo, not activated; "P2TSH" has been stale since February; "BIP-361 freezes coins" describes a phase five years after an activation that cannot begin yet; and the Bitcoin Security Consortium (23 July 2026: Anchorage, ARK, BlackRock, Block, Blockstream, Coinbase, Fidelity Digital Assets, Galaxy, Strategy; $15M over three years, no pooled fund, coordinated by Brink's Mike Schmidt as a volunteer) said at launch it "will not direct Bitcoin development or take positions on proposed protocol changes". Money buys review hours, not consensus.
Timing: Taproot, uncontroversial with a finished spec, went from BIP numbers (January 2020) to Core merge (October 2020) to lock-in (June 2021) to activation at block 709,632 on 14 November 2021: 22 months, 13 after merge. SegWit took over two years. Step 1's spec appeared this month. Chaincode plans a ~2-year contingency track and a ~7-year comprehensive one; Project Eleven says Q-day is more likely than not by 2033, possibly 2030. Taproot pace from a September 2026 draft lands a PQ output type around mid-2028 at the earliest, with wallet support, which Wuille calls "the bottleneck", after that; the mechanical migration is 76-142 days at 100% block space in the estimates Chaincode cites.
Watch: whether SHRINCS gets a BIP number and an opcode proposal; whether a Core PR for P2MR or P2TRv2 opens and stays open; whether BIP-361's "Requires" line ever names a real BIP; and the reuse-versus-P2PK split in Project Eleven's next snapshot, since falling address reuse is the only quantum progress that needs no fork.