Bitcoin’s Quantum Upgrade Debate: What BIP 361 Could Mean for Old Wallets

Bitcoin’s Quantum Upgrade Debate: What BIP 361 Could Mean for Old Wallets

Custom Image
Bitcoin has survived network splits, regulatory bans and years of predictions that it would fail. Now, a proposed cryptographic upgrade raises a different question: could protecting Bitcoin from future quantum attacks mean freezing some existing coins?
 
BIP 361, a draft proposal, outlines a phased transition away from vulnerable signature schemes that could eventually restrict spending from certain legacy outputs. The timing is significant. On October 7, 2026, Europol named wallets with exposed public keys as the primary point of quantum risk, renewing attention on older Bitcoin holdings.
 
If the proposal advances, what happens to dormant wallets, Satoshi-era coins and funds whose owners cannot migrate them? The implications depend on which coins are vulnerable to quantum attacks and which could be affected by a freeze.
 
Here is how BIP 361's proposed phases work, what they could mean for Bitcoin holders, and why the proposal remains unresolved.
 

What Is BIP-361, and Why Is Bitcoin Debating a Quantum Sunset?

Bitcoin's quantum debate has moved beyond whether its cryptography might eventually fail. The harder question is how the network should respond before that happens, particularly if protecting existing holdings means restricting access to coins that have not been upgraded.
 
BIP-361, titled Post Quantum Migration and Legacy Signature Sunset, is a draft proposal authored by Jameson Lopp and five co-authors. It outlines a phased transition away from Bitcoin's existing ECDSA and Schnorr signatures toward quantum-resistant alternatives.
 
Crucially, the proposal depends on a separate post-quantum signature standard that has not yet been specified. It is not an approved Bitcoin upgrade, and no activation date has been set.
 

What Is the BIP-361 Proposal for Bitcoin?

BIP-361 proposes a way for Bitcoin to transition away from cryptographic signatures that could become vulnerable to sufficiently powerful quantum computers. Bitcoin currently relies on the Elliptic Curve Digital Signature Algorithm (ECDSA) and Schnorr signatures to verify that someone spending coins controls the corresponding private key.
 
A sufficiently capable quantum computer running Shor’s algorithm could potentially derive a private key from its exposed public key, allowing an attacker to authorize transactions without the owner's permission.
 
The BIP-361 proposal outlines a phased process for moving funds to quantum-resistant addresses before restricting older signature schemes. Under its proposed rules, coins that remain in affected legacy outputs could eventually become unspendable through conventional transactions.
 
However, BIP-361 is still a draft and depends on a separate proposal defining the post-quantum signature system Bitcoin would adopt. No activation date has been established, so the proposed restrictions are not currently in effect.
 

Why Is Bitcoin's Quantum Debate Heating Up Now?

On March 31, 2026, Google Quantum AI published updated estimates suggesting that a future quantum computer could attack the elliptic-curve cryptography used by cryptocurrencies with fewer than 500,000 physical qubits under specified hardware assumptions. This was a resource estimate, not evidence that such an attack is currently possible.
 
Europol's October 7 report added urgency, identifying exposed public keys as the primary point of cryptocurrency quantum risk and recommending a phased transition to quantum-resistant cryptography. Together, these developments have sharpened the question facing Bitcoin developers: how can the network prepare early without unfairly penalizing holders who cannot move their coins?
 

Why Is Vitalik Buterin Raising Concerns About AI and Quantum-Resistant Cryptography?

Bitcoin's quantum migration debate raises another question: how reliable will the replacement cryptography be as technology advances? Ethereum co-founder Vitalik Buterin has highlighted the possibility that AI could accelerate mathematical research and expose weaknesses in cryptographic systems previously considered secure.
 
In his October 7 post on X, Buterin said AI-driven advances in mathematics could significantly weaken lattice-based cryptography, which underpins some post-quantum systems, including ML-DSA. He urged the industry to take both quantum-vulnerable and potentially AI-vulnerable cryptography seriously, while explicitly cautioning against rushing to move funds between wallets.
 
This matters to Bitcoin's migration debate because replacing vulnerable signatures is only part of the challenge. Developers must also assess the security assumptions behind proposed alternatives.
 
Buterin's comments do not invalidate BIP-361 or establish that post-quantum signatures have been broken; they highlight why choosing and implementing a replacement requires careful scrutiny rather than a rushed response.
 

How Do BIP-361’s Three Phases Work?

BIP-361 proposes a gradual transition to quantum-resistant Bitcoin addresses, followed by restrictions on older signature schemes. Rather than freezing vulnerable coins immediately, the draft gives holders time to migrate before a proposed deadline. Its three phases cover the migration period, restrictions on legacy spending and a possible recovery mechanism for funds that remain frozen. None of these measures is currently in force because BIP-361 remains a draft.
 

Phase A: When Will Bitcoin Stop Accepting Payments to Legacy Addresses?

Phase A would begin 160,000 blocks, roughly three years after BIP-361 activation. From that point, Bitcoin transactions would no longer be permitted to send funds to quantum-vulnerable output types. Holders would need to move eligible coins into supported post-quantum addresses before the next phase.
 
The goal is to accelerate migration before quantum attacks become practical. However, this restriction would not take effect three years from today. The proposed countdown depends on BIP-361 first being activated.
 

Phase B: Could Bitcoin Freeze Unmigrated Coins?

Phase B would begin two years after Phase A, or approximately five years after BIP-361 activation. Under the draft, nodes would tighten transaction verification rules to restrict spending through legacy ECDSA and Schnorr signatures, with a quantum-safe rescue protocol intended to help legitimate owners prove their right to spend eligible funds.
 
Coins that cannot satisfy the new rules could become unspendable under conventional transactions. The change would also create a coordination challenge: miners that fail to enforce the new consensus rules could produce blocks that upgraded nodes reject. This is one reason the proposal remains controversial, particularly for dormant wallets whose owners may not learn about the migration in time.
 

Phase C: Could Bitcoin Owners Recover Frozen Funds?

Phase C is a possible recovery mechanism, but its design and timing remain undetermined. The draft discusses using proof of knowledge of a wallet's seed-derived secrets, potentially through zero-knowledge proofs, to help legitimate owners recover funds without exposing their seed phrases.
 
However, this approach would not necessarily cover every legacy holding. Some early Bitcoin outputs predate hierarchical deterministic wallets, making seed-based ownership proofs unsuitable for them. The authors discuss a separate proposal as a possible solution for those coins.
 
Phase C is therefore not a guaranteed safety net. Its feasibility depends on further research and agreement on additional protocol changes.
 

BIP-361's Proposed Timeline at a Glance

Phase
Proposed Timing
Main Effect
Phase A
3 years after activation
Stops payments to quantum-vulnerable outputs
Phase B
5 years after activation
Restricts legacy signature spending
Phase C
Undetermined
Possible recovery route for eligible frozen funds
 
The timeline is a proposal, not an established Bitcoin upgrade schedule. The central trade-off is clear: earlier migration could reduce future quantum exposure, but strict spending restrictions could also affect owners who fail to migrate or cannot prove ownership through the eventual recovery mechanism.
 

Which Old Bitcoin Wallets Could Be Affected by BIP-361?

Not every old Bitcoin wallet faces the same quantum risk. The key distinction is whether a coin's spending public key has already been revealed on the blockchain. A sufficiently powerful quantum computer could potentially use that information to derive the corresponding private key, but the risk depends on the output type and its transaction history
 

Which Bitcoin Address Types Are Most Exposed to Quantum Attacks?

Early pay-to-public-key (P2PK) outputs are a prominent example because they contain the public key directly. These include some coins mined during Bitcoin's early years, including holdings attributed to Satoshi Nakamoto. Taproot (P2TR) outputs are also exposed under this model because their public keys are visible on-chain.
 
Other address types, including legacy P2PKH (Pay-to-Public-Key-Hash, is a method of sending bitcoin to a specific address), and SegWit P2WPKH, can become exposed when a public key is revealed during a transaction and funds remain associated with that key.
 
Address reuse can therefore increase exposure. However, an address beginning with 1 or bc1q is not automatically vulnerable to a long-exposure attack simply because of its format.
 

How Much Bitcoin Has an Exposed Public Key?

The estimates vary by methodology. BIP-361 states that more than 34% of Bitcoin had revealed public keys on-chain as of March 1, 2026. Glassnode's separate analysis estimates that 6.04 million BTC, or 30.2% of issued supply, was exposed at rest.
 
Glassnode divides its estimate into 1.92 million BTC exposed by output design and 4.12 million BTC exposed through operational practices such as address reuse and spending patterns. The figures should not be treated as contradictory measurements of an identical category: the reports use their own classification methods and exposure definitions.
 
Approximately 1.1 million BTC is commonly attributed to Satoshi Nakamoto, much of it associated with early mining outputs. That attribution is an estimate, not verified proof of ownership, and the coins should not automatically be assumed lost or inaccessible.
 

Which Bitcoin Holders May Face Less Immediate Exposure?

Coins whose public keys have not yet been revealed are not currently exposed to the same long-exposure attack described above. That does not make them quantum-proof: spending them can reveal public keys, potentially creating a short window in which a sufficiently capable attacker could act.
 
BIP-361 also does not guarantee recovery for every frozen coin. Its possible Phase C recovery mechanism remains undefined, and the proposal's authors note that early P2PK outputs may require a separate solution because a seed-based ownership proof may not work for them.
 
The distinction matters: quantum exposure describes a potential cryptographic weakness, while a BIP-361 freeze would be a consequence of proposed network rules. A coin could face one risk, both, or neither under a particular scenario.
 

Is Freezing Old Bitcoin Coins Fair? The Arguments for and Against

BIP-361 raises a difficult question about Bitcoin's future: if quantum computers eventually threaten existing wallets, should the network prevent vulnerable coins from being spent, even if that means restricting legitimate owners?
 
The proposal's supporters and critics disagree over how to balance network security with Bitcoin's principle that users should control their own funds
 

Why Do Supporters Want Bitcoin to Freeze Quantum-Vulnerable Coins?

The security argument is that exposed coins could become targets for attackers with sufficiently powerful quantum computers. If large dormant holdings were stolen and moved into circulation, the resulting sales could disrupt the market and undermine confidence in Bitcoin.
 
Freezing vulnerable outputs after a migration deadline would prevent attackers from spending those coins through the affected signature schemes. BIP-361's authors argue that this could protect the wider network from the consequences of quantum theft.
 

Would Freezing Old Bitcoin Violate Property Rights?

Critics argue that making legitimate coins unspendable would contradict Bitcoin's promise that ownership does not depend on permission from a central authority. A freeze could affect holders who remain in legacy wallets through no deliberate choice of their own, including people who are unaware of the proposed changes.
 
Jameson Lopp, one of BIP-361's authors, has acknowledged his discomfort with the proposal, describing it as a contingency plan he hopes will never need to be adopted. His position reflects the difficult trade-off: allowing vulnerable coins to remain spendable could expose them to theft, while freezing them could deny access to their legitimate owners.
 

Could Bitcoin Limit Spending Instead of Freezing Old Coins?

Freezing quantum-vulnerable coins is not the only option. The Hourglass proposal offers a different approach by limiting how quickly vulnerable coins can be spent rather than making them entirely unspendable.
 
Its second version proposes restricting certain pay-to-public-key spending to one transaction and a net amount of one bitcoin per block. It remains a draft, not an adopted Bitcoin rule.
 
The main approaches involve different trade-offs:
  • Freeze vulnerable coins: Prevent spending through affected legacy signatures after a migration deadline, reducing the risk of quantum-enabled theft but potentially locking out legitimate owners.
  • Limit spending: Throttle transactions involving vulnerable coins, potentially reducing the risk of a sudden influx of stolen BTC without permanently blocking all spending.
  • Prioritize migration: Give holders time to move funds to quantum-resistant addresses before stricter rules take effect, although this may not help owners who have lost access to their wallets.
 
Each approach has limitations, and none has been adopted as Bitcoin consensus rules. Any soft fork would require sufficient coordination among developers, miners, businesses, wallet providers and users.
 

What Should Old Bitcoin Wallet Holders Do Now?

Bitcoin holders do not need to panic, but they should understand their wallets' potential exposure and follow credible security updates. BIP-360 and BIP-361 remain drafts, and no quantum-resistant Bitcoin output type has been adopted through these proposals.
 
  • Check your address type: Public-key exposure varies by output type and transaction history.
  • Avoid address reuse: Fresh addresses can reduce long-term public-key exposure, but do not guarantee quantum resistance.
  • Monitor upgrade developments: Follow official Bitcoin developer updates and wallet-provider announcements for migration guidance. KuCoin users can also monitor KuCoin’s official announcements for relevant exchange security updates.
  • Beware of false claims: No existing wallet should be assumed quantum-proof, and rushed transfers to unverified services can create additional risks.
 
The priority is preparation, not panic. Wait for verified migration guidance rather than treating ordinary transfers as a complete quantum-security solution.
 

Conclusion

BIP-361 offers a possible path for Bitcoin to prepare for quantum attacks, but its proposed migration comes with a difficult trade-off. Restricting vulnerable signatures could reduce the risk of future theft, yet it could also leave legitimate holders unable to spend coins they never migrated. The proposal remains a draft, and its timeline, recovery mechanism and required post-quantum signature system are not finalized.
 
For holders of older Bitcoin wallets, the sensible response is to understand public-key exposure, avoid unnecessary address reuse and follow verified upgrade guidance rather than panic over speculative deadlines.
 
Whether Bitcoin eventually adopts a freeze, spending limits or another approach, its ability to address quantum risks will depend on technical progress and broad agreement across the network.
 

🔥 Beyond the Headlines: What KuCoin 5.0 Means for You

Market news moves fast — but where you act on it matters just as much. This October, KuCoin launches KuCoin 5.0, transforming KuCoin into a rebuilt platform. Here's what actually changes for you:
 
  • One account for everything. Older platforms split your money across separate "spot," "margin," and "futures" accounts and expected you to understand why. KuCoin 5.0's unified account removes that entirely — deposit once, and everything is simply there (only available to VIPs for now).
  • Stocks, indices, and commodities. KuCoin 5.0 expands beyond crypto into global markets. When crypto chops sideways and equities rally (or the reverse), you rotate in minutes instead of opening a brokerage account and waiting days for fiat rails.
  • Real-world assets (RWA). Tokenized exposure to traditional assets like commodities, right inside your crypto account. One of the fastest-growing segments in global finance is no longer reserved for institutions — you access it from the same balance you trade with.
  • Earn while you learn. Not ready to trade? KCUSD lets your stablecoins earn daily, auto-compounding interest. The lowest-stress way to put your idle deposit to work for 4% yield.
  • An AI assistant in plain language. Ask questions, get market context, understand what you're looking at — built into the platform, no jargon required.
  • An app that doesn't overwhelm. Faster, cleaner, and consistent — intuitive from the first tap, not after a tutorial.
  • Safety you can check, not just trust. A MiCAR-licensed EU entity, Proof of Reserves you can verify yourself, and internationally certified security (SOC 2 Type II, ISO 27001:2022).
 
Create your account in minutes — and start on the platform built for where crypto is going, not where it's been.
 

FAQs

What is BIP-361 in Bitcoin?

BIP-361 is a draft proposal for transitioning Bitcoin to quantum-resistant cryptography. It outlines a phased migration and possible restrictions on spending through legacy signature schemes.

Could BIP-361 freeze old Bitcoin wallets?

Potentially. If adopted, its proposed rules could make coins in certain legacy outputs unspendable unless holders migrate them or qualify for a future recovery mechanism.

Which Bitcoin wallets are most vulnerable to quantum attacks?

Wallets with exposed public keys, including early pay-to-public-key outputs and Taproot outputs, face greater potential exposure to attacks from sufficiently powerful quantum computers.

When will Bitcoin implement its quantum upgrade?

There is no confirmed implementation date. BIP-361 remains a draft and depends on a separate proposal defining the post-quantum signature system Bitcoin would adopt.

What should Bitcoin holders do to prepare for quantum attacks?

Check your wallet's address type, avoid unnecessary address reuse, secure your recovery phrase and follow official Bitcoin developer and wallet-provider announcements for verified migration guidance.
 
 

Disclaimer

The information provided on this page may originate from third-party sources and does not necessarily represent the views or opinions of KuCoin. This content is intended solely for general informational purposes and should not be considered financial, investment, or professional advice. KuCoin does not guarantee the accuracy, completeness, or reliability of the information, and is not responsible for any errors, omissions, or outcomes resulting from its use. Investing in digital assets carries inherent risks. Please carefully evaluate your risk tolerance and financial situation before making any investment decisions. For further details, please consult KuCoin’s Terms of Use and Risk Disclosure.